In this post, we’ll explore how to host applications for free on your local network while making them securely accessible from anywhere over the internet using Cloudflare Tunnels. I’ve been running various applications this way for over a year, and it’s been a major upgrade in how I run services on my network. The ability to host applications locally while accessing them through any web browser has opened up exciting possibilities for running services without ongoing cloud costs.
1 What You Can Build
Before diving into the technical details, let’s look at some real examples of what you can run. I’m currently hosting:
- Jupyter notebooks for AI development, running on my GPU AI workstation - it’s like a private version of Google Colab
- Open WebUI - a free, open-source AI chat interface that can use both locally-running models via Ollama and OpenAI’s models through their API plus any other models that support the OpenAI API format - it’s like a private version of ChatGPT
- Access to my router’s web configuration and network management
- Application and network monitoring through Uptime Kuma
- Direct access to my Synology NAS and its applications such as Surveillance Station and File Hosting
- PiKVM for remote hardware management of my AI workstation
- A local TV streaming service using a HD HomeRun tuner that I built using Fast HTML and FFmpeg
- Various development and testing environments
All of these applications run on my local hardware but are accessible through any web browser, needing only an internet connection, without the need to install a VPN.
2 Key Benefits
Here’s why this approach is valuable:
Cost Efficiency: Running applications locally can be dramatically cheaper than cloud hosting. My NAS has over 30TB of storage - hosting this in the cloud would cost hundreds monthly.
Hardware Utilization: Use your existing hardware, including GPUs for AI workloads, without paying cloud compute costs.
Privacy Control: All data remains on your local network, with Cloudflare only acting as a secure gateway.
Simplified Access: No VPN needed - just open a browser and log in. This is especially useful when using computers where you can’t install a VPN client.
Certificate Management: Cloudflare handles all SSL certificates automatically - no more managing or renewing certificates manually.
Zero Port Forwarding: No need to expose ports on your router or manage dynamic DNS.
3 How Cloudflare Tunnels Work
A Cloudflare Tunnel creates a secure connection between your local network and Cloudflare’s edge network through these components:
- A lightweight daemon runs locally, establishing an outbound connection to Cloudflare
- Traffic is routed through Cloudflare’s global network to your local services
- All traffic is encrypted end-to-end
- Authentication and access controls are managed at the edge
The architecture looks like this:
Cloudflare Tunnel Architecture:
Browser -> Cloudflare Edge -> Encrypted Tunnel -> Local Daemon -> Your Services
This design eliminates the need for inbound firewall rules while providing enterprise-grade security features.
4 Getting Started
Let’s walk through setting up your first Cloudflare Tunnel. You’ll need:
- A domain name (can be registered through Cloudflare or elsewhere)
- A Cloudflare account
- Docker installed on your local machine
- An application you want to make accessible
4.1 Initial Setup
First, register your domain with Cloudflare or point your existing domain’s nameservers to Cloudflare. While propagation can technically take up to 24 hours, it usually completes within minutes.
For the smoothest experience, I recommend: - Setting up Docker before starting (Synology NAS comes with it pre-installed) - Installing Portainer for easy Docker management - Having your applications ready to expose - Follow along with the Cloudflare Zero Trust setup guide
4.2 Running the Tunnel
The easiest way to run the tunnel is through Docker. Here’s a basic command:
docker run -d \
--name cloudflared \
--restart unless-stopped \
cloudflare/cloudflared:latest \
tunnel --no-autoupdate run --token YOUR_TUNNEL_TOKEN
The --restart unless-stopped flag ensures the tunnel restarts automatically after system reboots. You should copy and paste the docker command from your Cloudflare Zero Trust dashboard which will have your token already included. Before running the command, you should edit it to include the extra arguments specified above.
4.3 Adding Access Rules to Secure Your Applications
The first thing you’ll want to do after creating the tunnel is to set up Access Rules. This is where you’ll define who can access your applications. This is an important step to keeping your applications and local network secure.
Set up a default access group and wildcard subdomain application definition to ensure all new applications are secure by default.
Navigate to Access -> Access Groups
Click on the “Add a Group” button
Enter a name for your access group (ex: “Default Access Group”)
Check the “Set as default group” checkbox
Under “Define group criteria” -> “Include” -> “Selector” select “Emails” and add the list of email addresses you want to have access to your applications separated by commas. Only include email addresses you trust and ones you’re sure you want to have access to your applications.
Click “Add require” at the bottom of the section.
Under “Require” -> “Selector” select “Country” and add the country you want to allow access from. This is a great extra security measure to further lock down access to your applications. You can always change this later.
Click “Add exclude” at the bottom of the section.
Under “Exclude” -> “Selector” select “Country” and add the country you want to block access from. I have added Russia, China, and North Korea to my exclude list because state sponsored hacking from these countries is more common.
Add any additional rules you want to further secure your applications.
Finally, click “Save” at the bottom of the page.
4.4 Adding A Master Wildcard Subdomain to apply security by default to any new applications
Navigate to Access -> Applications
Click on the “Add an application” button
Select “Self-hosted”
For “Application name” enter a name for your application (ex: “Master Wildcard”)
Under “Session Duration” select an appropriate duration for your session which is how long until the user will need to re-authenticate. If you plan on mostly using trusted devices you can set this to a longer duration but if you plan on using it on untrusted devices regularly you should set this to a shorter duration.
For “Subdomain” enter a wildcard
*For “Domain” select your domain name (ex: mydomain.com)
Under “Identity providers” select all of the identity providers you want to use to authenticate users. By default “One-time PIN” is selected which is Cloudflare’s magic link authentication. I recommend adding Google as a provider as well if you typically use Google accounts to access your applications.
