Self-host from home without port forwarding

A home server usually needs port forwarding, a static IP or dynamic DNS, and it exposes your home IP address. Cloudflare Tunnel needs none of that: the server makes an outbound connection to Cloudflare and visitors arrive through it. It works behind CGNAT, on mobile broadband and on networks where you can't change the router.

In this tutorial you publish three apps from a Linux home server (a blog, a photo library on a NAS, and a status page), keep them running across reboots, and put a login in front of an admin panel.

What you need

1. A machine that stays on, running what you want to publish: a Linux box, a NAS that runs Docker, a Raspberry Pi, a Mac mini.
2. Teitunnel on it: the desktop app, the CLI on a headless server, or the Docker image next to your other containers.
3. A domain on Cloudflare (before you start), and an API token for the server (Account · Cloudflare Tunnel · Edit, Zone · DNS · Edit, Zone · Zone · Read, and the two Access permissions for logins).

1. Install the command and give it the token

On the server, install the teitunnel command (install), then:

teitunnel cloudflared install          # a verified cloudflared, if the server has none
export CLOUDFLARE_API_TOKEN=…          # for this shell; never written to disk

2. Publish each app

One route per app, each on its own hostname:

teitunnel route add blog.yourhost.com 8080
teitunnel route add photos.yourhost.com http://192.168.1.10:2342
teitunnel route add status.yourhost.com 3001

Each command shows the plan (a DNS record and the tunnel's configuration) and asks before applying; the first one also creates this server's tunnel. Routes can point at the machine itself (8080) or at any other device on your network (http://192.168.1.10:2342). One tunnel carries them all.

Before a route makes a service public, the exposure check looks at it for things like a served .env file or an open admin tool, and warns you.

3. Keep them running

sudo -E teitunnel always-on on         # a system service: starts at boot, restarts if it stops
teitunnel routes                       # every route and whether it's live
teitunnel doctor                       # problems, with fixes

In the desktop app instead: Tunnels ▸ Keep running when Teitunnel quits.

4. Protect what isn't public

Anything you publish is reachable by anyone who finds the hostname. For admin panels, dashboards and private apps, require a login: Cloudflare asks for a one-time code sent to an email address you allowed, before the request reaches your server.

teitunnel route add admin.yourhost.com 9000 --allow team@yourhost.com

For the public ones, edge protection can challenge scripts and block AI crawlers per hostname, and an offline page replaces Cloudflare's error 1033 while the server is down.

For whole networks (a NAS's SMB shares, a printer, SSH to every machine), share a private network with WARP clients instead of publishing each service.

5. Watch it

• teitunnel uptime: each route's uptime, checked every minute through Cloudflare.
• teitunnel analytics: requests, errors and response times per route from Cloudflare's edge (needs Zone · Analytics · Read).
• teitunnel serve: a small web dashboard and API on the server (Servers).

Good to know

• Streaming lots of video? Cloudflare's terms limit serving mostly video or large files through its CDN on some plans. Check Cloudflare's current service terms for media servers such as Jellyfin or Plex, or use a private network for them.
• Uploads are limited to 100 MB per request on Cloudflare's Free and Pro plans. Apps like Nextcloud upload large files in chunks, which works.
• Requests time out after 125 seconds if your server doesn't answer (error 524).
• Certificates: the free certificate covers one level of subdomain (photos.yourhost.com), not photos.home.yourhost.com.
• Several machines? Put the same route on each and turn on load balancing for failover.
• Your home IP stays private: DNS points at Cloudflare, not at your house.

Where to go next