Use cases
SSH, RDP and databases through Cloudflare Tunnel
Reach a machine's SSH, Remote Desktop, file shares or database from anywhere through Cloudflare Tunnel, with no inbound port open, and lock it down with Cloudflare Access.
A route doesn't have to be a website. It can carry SSH, Remote Desktop, SMB file shares or
any TCP service such as Postgres, so you can reach a machine at home or in the office
without opening port 22 to the internet. In this tutorial you make a machine reachable over
SSH at ssh.yourhost.com, behind a login only you can pass, and connect to it from a
laptop.
You need: Teitunnel on the machine you want to reach (the app, or the
CLI on a server), a Cloudflare account with a domain, Cloudflare Zero
Trust set up once for the login (free for up to 50 users), and cloudflared on the computer
you connect from.
1. Add the route
On the machine you want to reach, add a route with a non-HTTP origin and a login:
teitunnel route add ssh.yourhost.com ssh://localhost:22 --allow team@yourhost.comIn the app: Routes ▸ New route, Public hostname ssh on yourhost.com,
Service ssh://localhost:22, then under Advanced turn on Require a login and add
your address under Who can sign in. Review, then Add Route.
The login is optional but strongly recommended: without it, anyone with cloudflared can reach the port (SSH still asks for your key or password). With it, Cloudflare checks who you are before a single packet reaches the machine.
Other services work the same way:
teitunnel route add desktop.yourhost.com rdp://localhost:3389 --allow team@yourhost.com
teitunnel route add files.yourhost.com smb://localhost:445 --allow team@yourhost.com
teitunnel route add db.yourhost.com tcp://localhost:5432 --allow team@yourhost.com2. Keep it running
You can't reach the machine while its connector is down, so make it survive restarts: Tunnels ▸ Keep running when Teitunnel quits in the app, or on a server:
sudo -E teitunnel always-on on3. Install cloudflared on the computer you connect from
A browser can't open these routes. On your laptop, install
cloudflared
(brew install cloudflared, winget install Cloudflare.cloudflared, or your package
manager). The route's Connect section in Teitunnel shows the exact commands for it.
4. Connect
Once:
ssh -o ProxyCommand="cloudflared access ssh --hostname %h" ssh.yourhost.comTo make plain ssh ssh.yourhost.com work, add this to ~/.ssh/config:
Host ssh.yourhost.com
ProxyCommand cloudflared access ssh --hostname %hWith a login on the route, cloudflared opens your browser to sign in the first time; you get a one-time code by email.
5. Let a machine through (optional)
A CI job or a backup script can't sign in with an email code. Give it a service token instead:
teitunnel service-token create ssh.yourhost.com --name backup # prints both headers oncecloudflared sends them with --service-token-id and --service-token-secret (see
Cloudflare's cloudflared access documentation).
Many machines, or a whole network
One route per service is right for a few machines. To reach many hosts and ports (every
server in a rack, a NAS, printers), share a private network
and connect with the Cloudflare WARP client instead: then ssh 192.168.1.20 just works.
Troubleshooting
Where to go next
Last updated on
Self-host from home without port forwarding
Publish a website, NAS, dashboard or self-hosted app from a home server with Cloudflare Tunnel, even behind CGNAT, with your home IP hidden and no open ports.
Cloudflare Tunnel for Docker Compose
Add Teitunnel to a Docker Compose stack and route hostnames to the containers next to it through Cloudflare Tunnel, with the API token kept in a Docker secret.