# What Is Cloudflare Tunnel? How It Works, Setup & the October 2026 cloudflared Update

> What is Cloudflare Tunnel? Learn how cloudflared works, set up a tunnel on Ubuntu, use it safely with xCloud, and apply the October 2026 security update.

A Cloudflare Tunnel is the answer when you want to show a client the site running on your laptop, or let a teammate reach an internal dashboard without opening another port on your server. The usual alternative is a public IP, an open port and a firewall rule you hope you remember to close later.

**Cloudflare Tunnel** solves this the other way around. Your server makes an outbound connection to Cloudflare, and visitors reach your app through Cloudflare, so no inbound port has to be open for that app at all. If you already route your domain through Cloudflare, read our guide to [**Cloudflare firewall rules for your web app**](/cloudflare-firewall-rules-to-secure-your-web-app/) next to this one.

There is also news. On **October 20, 2026**, Cloudflare asked everyone running a tunnel to **upgrade cloudflared to 2026.10.2 or later**, because older versions trust compromised certificates. This guide covers what Cloudflare Tunnel is, how it works, how to set one up, how xCloud users can use it safely, and exactly how to apply that update.

![What is Cloudflare Tunnel: your server connects out to Cloudflare through cloudflared](/_landing/blog/what-is-cloudflare-tunnel-cover.jpg)

## TL;DR (Too Long, Didn't Read?)

Short on time? Here is the whole guide in a few lines:

- **Cloudflare Tunnel** connects a server to Cloudflare through a small program called **`cloudflared`**, using outbound connections only.
- Visitors reach your app through a hostname on your Cloudflare domain. **No inbound port** has to be open for that app.
- It is **free on all Cloudflare plans**. It was called **Argo Tunnel** until 2021.
- Pair it with **Cloudflare Access** to put a login in front of private tools and SSH.
- **Security update:** upgrade every `cloudflared` to **2026.10.2 or later** (latest is 2026.10.4), then restart it.
- On **xCloud**, keep your sites on their normal setup and use a tunnel for private tools, team SSH and local previews.

## What Is Cloudflare Tunnel?

**Cloudflare Tunnel is a free Cloudflare service that publishes an app or server to the internet, or to your team, without a public inbound port.** A small daemon called `cloudflared` runs next to your app, dials out to Cloudflare, and keeps that connection open. Cloudflare then sends requests for your hostname down that connection.

Think of it like a hotel phone line. Guests cannot ring your room directly, because the room has no outside number. Instead you call the front desk once, keep the line open, and the desk passes calls through. Nobody outside ever learns your room number.

### A Few Things Worth Knowing

- **It used to be called Argo Tunnel.** Cloudflare renamed it in 2021 when it became free for everyone. Older tutorials and forum posts still use the old name.
- **Each tunnel keeps four long-lived connections to two Cloudflare data centers**, so a single network hiccup does not take your app offline. You can see this on your own server: `cloudflared` reports four ready connections.
- **It carries more than websites.** Cloudflare lists HTTP, HTTPS, TCP, SSH and RDP among the supported protocols.
- **It is not a VPN for your laptop.** It publishes services from the server side. Your visitors need nothing installed (except for SSH and other non-HTTP protocols, covered below).

| Term | What it means |
|---|---|
| **Tunnel** | A named, persistent link between your infrastructure and Cloudflare, identified by a UUID |
| **`cloudflared`** | The open-source program that runs on your server and opens the tunnel |
| **Connector** | One running `cloudflared` process. Several connectors can serve one tunnel |
| **Public hostname** | The address visitors use, such as `tools.example.com`, routed to a local service |
| **Cloudflare Access** | Zero Trust login in front of a hostname: email codes, Google, GitHub and more |
| **Quick Tunnel** | A temporary `trycloudflare.com` URL for testing, no account needed |

## How Does Cloudflare Tunnel Work?

Here is the part that trips people up: **the connection starts from your server, not from the visitor.**

1. You install `cloudflared` on the server (or in a container next to your app).
2. `cloudflared` authenticates with a tunnel token and opens outbound connections to the nearest Cloudflare data centers.
3. You map a public hostname to a local service, for example `tools.example.com` → `http://localhost:8080`.
4. A visitor opens `tools.example.com`. Cloudflare receives the request, applies your rules (WAF, Access login, caching), then passes it down the open tunnel.
5. `cloudflared` forwards it to `localhost:8080` and sends the response back the same way.

Because the server only ever dials out, there is **no listening port for that app** that scanners can find. The trade-off is that **Cloudflare sits in the middle of every request**. That is exactly what makes tunnels powerful, and also why the security update below matters so much.

### Is Cloudflare Tunnel Free?

Yes. Cloudflare documents Tunnel as **available on all plans, including Free**. Before 2021, Argo Tunnel was billed by bandwidth. Today the costs only appear if you add extras, such as **Argo Smart Routing** or more Zero Trust seats than the free allowance.

### Quick Tunnels vs Named Tunnels

**Quick Tunnels** give you a random `trycloudflare.com` address with one command and no account. Cloudflare is clear that they are for **testing and development only**:

- No uptime guarantee, and the hostname changes every time.
- Up to **200 in-flight requests**. More get a `429` error.
- No Server-Sent Events (SSE).

For anything you want to keep, create a **named tunnel** on your own domain. That is what the setup steps below do.

## Cloudflare Tunnel vs ngrok vs Tailscale Funnel

These three show up together in almost every search, and each is good at something different.

| | **Cloudflare Tunnel** | **ngrok** | **Tailscale Funnel** |
|---|---|---|---|
| **Built for** | Publishing apps and private tools long-term | Developers testing local apps | Sharing a service from your Tailscale network |
| **Your own domain** | Yes, any domain on Cloudflare | On paid plans | No, uses your `ts.net` name |
| **Login in front of the app** | Cloudflare Access | ngrok traffic policies (OAuth and more) | None built in: Funnel is public, your app handles login |
| **Request inspection while debugging** | Basic logs | ✅ Excellent built-in inspector | Basic |
| **Cost to start** | Free on all plans | Free tier with limits | Free tier |

**Rule of thumb:** use **ngrok** when you are debugging webhooks on your laptop and want to replay requests. Use **Tailscale Funnel** when your team already lives on Tailscale. Use **Cloudflare Tunnel** when the app should stay up, sit on your own domain and get Cloudflare's protection in front of it.

## How to Set Up Cloudflare Tunnel on Ubuntu

This walk-through uses a **remotely managed tunnel**, meaning you configure routes in the Cloudflare dashboard and the server only holds a token. You need a domain on Cloudflare and SSH access to an Ubuntu server with **sudo**. On xCloud, create a sudo user first and connect with [**SSH keys**](/docs/how-to-generate-and-add-ssh-keys-in-xcloud/).

### Step 1: Install cloudflared from Cloudflare's Package Repository

Installing through **apt** means future security updates arrive with a normal `apt upgrade`, which is the lesson of this month.

```bash
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
sudo apt-get update && sudo apt-get install cloudflared
cloudflared --version
```

The last line should print **2026.10.2 or newer**.

### Step 2: Create the Tunnel in the Cloudflare Dashboard

In the Cloudflare dashboard, go to **Networking → Tunnels** and choose **Create a tunnel**. Pick **Cloudflared** as the connector type and give the tunnel a clear name, such as `prod-tools`.

Cloudflare then shows an install command with a long token. Copy the **`sudo cloudflared service install <TOKEN>`** line.

### Step 3: Run cloudflared as a Service

Paste the command from the dashboard on your server:

```bash
sudo cloudflared service install YOUR_TUNNEL_TOKEN
sudo systemctl status cloudflared
```

This creates a **systemd service** that starts on boot. Treat the token like a password: anyone who has it can run your tunnel.

### Step 4: Route a Public Hostname to Your App

Back in the tunnel settings, add a **public hostname**: choose a subdomain (for example `tools`), your domain, and the local service, such as `http://localhost:8080`. Cloudflare creates the DNS record for you.

Open `https://tools.example.com`. You should see your app, served over HTTPS with Cloudflare's certificate.

### Step 5: Put Cloudflare Access in Front of Anything Private

A tunnel makes an app **reachable**. It does not decide **who** may reach it. For admin panels and internal tools, add a **Cloudflare Access application** for the hostname and allow only your team's emails or your Google Workspace. Visitors then see a Cloudflare login before your app ever receives a request.

👉 Cloudflare's own walk-through: [**Create your first tunnel**](https://developers.cloudflare.com/tunnel/get-started/).

## October 2026: Update cloudflared Now (eMudhra Certificate Issue)

This is where things get serious. On **October 19, 2026**, Cloudflare learned that **eight eMudhra (emSign) intermediate certificates use weak private keys**. Anyone who recovers those keys can create a certificate for any website. Every `cloudflared` released before **2026.10.2** still trusts them.

Cloudflare reports **no active exploitation** on its services so far. The fix is still worth doing today, because the tunnel is the path all of your traffic takes. Full details are in Cloudflare's post, [**8 eMudhra certificates are compromised**](https://blog.cloudflare.com/emudhra-certificate-compromise/).

| Where cloudflared runs | Minimum safe version | How to update |
|---|---|---|
| Linux via apt / yum | **2026.10.2** | Upgrade with the same package manager, then restart the service |
| Linux plain binary | **2026.10.2** | Replace the binary from the latest GitHub release, then restart |
| macOS via Homebrew | **2026.10.2** | `brew upgrade cloudflared` |
| macOS, not Homebrew | **2026.10.3** | Install the latest release |
| Docker / Kubernetes | **2026.10.3 image** | Pull **and redeploy** `cloudflare/cloudflared:2026.10.3` or newer |

### Are You Affected?

Run this on every machine with a tunnel, or check the connector versions under **Networking → Tunnels**:

```bash
cloudflared --version
```

Anything **below 2026.10.2** needs the update. The latest release at the time of writing is **2026.10.4**.

### Upgrade Without Breaking Anything

1. **Check HTTPS origins first.** If a tunnel points at an `https://` origin whose certificate chains to an affected eMudhra certificate, the new `cloudflared` will reject it. Replace that certificate before you upgrade. **Never "fix" this with `noTLSVerify`**, because that removes the protection the update restores. Origins on plain `http://localhost` are not affected.
2. **Upgrade the way you installed.** For apt, run `sudo apt-get update && sudo apt-get install --only-upgrade cloudflared`. For a plain binary, download the new release and replace the old file.
3. **Restart the service:** `sudo systemctl restart cloudflared`.
4. **Confirm:** `cloudflared --version` shows the new version, and the tunnel reports **Healthy** in the dashboard.

The restart drops a single-connector tunnel for a few seconds. If that matters, add a **second replica** first and upgrade one connector at a time. In Docker, restarting the old container does nothing: you must **redeploy with the new image**.

### Tip: Plain Binaries Are Where Updates Get Missed

Many people install `cloudflared` once with `--no-autoupdate` and forget it. We found exactly that on one of our own machines this week: a hand-installed binary on 2026.10.1, behind by one release. A package manager install (Step 1 above) turns the next security fix into a routine `apt upgrade`.

## How xCloud Users Can Use Cloudflare Tunnel

The honest take first: **xCloud does not have a built-in Cloudflare Tunnel feature, and your hosted sites do not need one.** xCloud already serves your sites over HTTPS, manages the firewall, and works with Cloudflare for DNS, SSL and the [**Cloudflare Enterprise CDN**](/cloudflare-enterprise-cdn-faster-secure-website/). Ports **80** and **443** stay open for your sites and for SSL renewals. If you close them, Cloudflare shows [**error 522**](/docs/cloudflare-522-ports-80-443-closed/).

Where a tunnel earns its place is everything **around** your sites.

### 1. Private Tools on a Docker Server

Running an internal dashboard, a database admin UI or a small automation tool with [**Custom Docker on xCloud**](/docs/how-to-deploy-custom-docker-with-xcloud/)? Add a `cloudflared` service to the same [**Docker Compose**](/what-is-docker-compose/) file and point a hostname at the app's internal port. With Cloudflare Access in front, only your team can open it, and you never add a firewall rule for it.

```yaml
services:
  cloudflared:
    image: cloudflare/cloudflared:2026.10.4
    command: tunnel --no-autoupdate run
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}
    restart: unless-stopped
```

Pin a version as above, and bump it when Cloudflare ships a security release.

### 2. Team SSH Without Opening Port 22 to Everyone

xCloud's [**SSH Lockdown**](/docs/how-to-configure-ssh-lockdown/) limits port 22 to xCloud's infrastructure and IPs you approve. That is great until a teammate works from a café with a new IP every day.

A tunnel can carry SSH for them instead: route `ssh.example.com` to `ssh://localhost:22`, protect it with Cloudflare Access, and teammates connect through `cloudflared access ssh`. Port 22 stays locked to xCloud and your fixed IPs. **Never remove xCloud's own IPs from the lockdown**, or the dashboard loses access to your server.

### 3. Share a Local Build Before You Deploy It

Building a theme, a plugin or an [**n8n workflow**](/n8n-hosting-on-your-own-server/) on your laptop? A Quick Tunnel lets a client or a webhook reach it in seconds:

```bash
cloudflared tunnel --url http://localhost:8080
```

When it is ready for real feedback, deploy it to xCloud and use a [**staging environment**](/docs/how-to-create-a-staging-environment-in-xcloud/). Staging gives you a stable URL and runs on the same server setup as production, which a laptop tunnel never will.

### 4. Keep the Firewall On Anyway

A tunnel removes the need to open a port for one app. It does not replace [**Firewall Management**](/docs/how-to-configure-firewall-management-in-xcloud/) for the rest of the server. Our [**VPS security guide**](/maximize-your-vps-security/) covers the other layers worth keeping.

## Common Cloudflare Tunnel Problems and Fixes

| Symptom | Likely cause | Fix |
|---|---|---|
| **Error 1033** in the browser | `cloudflared` is not running or cannot reach Cloudflare | `sudo systemctl status cloudflared`, then check outbound network access |
| **502 Bad Gateway** | The local service is down or on a different port | Confirm the app answers on the exact `localhost:PORT` in the route |
| Tunnel **Healthy**, app shows a TLS error | HTTPS origin with a certificate `cloudflared` no longer trusts | Replace the origin certificate. Do not use `noTLSVerify` |
| Old version after "upgrading" in Docker | Container restarted with the old image | Pull and redeploy with the new image tag |
| Tunnel drops for a few seconds on update | Single connector | Add a replica before upgrading |

## Quick Checklist

- [ ] Every `cloudflared` reports **2026.10.2 or later**
- [ ] Installed through a package manager, or a reminder set to update plain binaries
- [ ] Private hostnames protected by **Cloudflare Access**
- [ ] No HTTPS origin relies on `noTLSVerify`
- [ ] Tunnel token stored like a password
- [ ] Firewall still on for everything the tunnel does not serve

## Secure Your Tunnel and Your Sites Today

Cloudflare Tunnel is one of the simplest ways to publish a tool or a server without opening a port. It is free, it is fast to set up, and paired with Cloudflare Access it puts a proper login in front of anything private.

This week, do two things. Run `cloudflared --version` on every machine with a tunnel and upgrade anything older than **2026.10.2**. Then look at which tools you expose through open ports and ask whether a tunnel with Access would be safer.

**For the sites themselves, let the platform carry the load.** [**xCloud Managed Hosting**](/managed-hosting/) handles HTTPS, firewall rules, security updates and Cloudflare integration for you, so your time goes into the work, not into the occasional 3 a.m. patch. Prefer to bring your own server? [**Self-managed hosting**](/self-managed-hosting/) gives you the same dashboard on any VPS.

If you have found this blog helpful, feel free to [**subscribe to our blogs**](https://xcloud.host/blog/) for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our [**Facebook community**](https://www.facebook.com/groups/xcloud.community) to share insights and engage in discussions.

## Frequently Asked Questions

### Is Cloudflare Tunnel free?

Yes. Cloudflare Tunnel is available on all Cloudflare plans, including Free. You pay only for optional extras such as paid Zero Trust seats beyond the free allowance or Argo Smart Routing.

### Do I need to update cloudflared after the eMudhra certificate issue?

Yes. Every cloudflared older than 2026.10.2 still trusts the eight affected eMudhra intermediate certificates. Upgrade to 2026.10.2 or later (2026.10.3 or later on macOS when you did not install with Homebrew), restart the service and confirm the tunnel shows Healthy.

### Is Cloudflare Tunnel the same as Argo Tunnel?

Yes. Argo Tunnel was the original name. Cloudflare renamed it Cloudflare Tunnel in 2021 when it became free for everyone, and the cloudflared software stayed the same.

### Can I use Cloudflare Tunnel with my xCloud server?

Yes, for the right jobs. Keep your xCloud sites on their normal setup with ports 80 and 443 open, and use a tunnel for private tools, team SSH access through Cloudflare Access, or sharing a local build before you deploy it to xCloud.

### Do I still need a firewall if I use Cloudflare Tunnel?

Yes. A tunnel removes the need to open a port for the app it serves, but your server still runs other services. Keep the firewall on, and only close a port once nothing but the tunnel needs it.

### My tunnel stopped working after I upgraded cloudflared. What should I check?

First check whether the tunnel points at an HTTPS origin whose certificate chains to an affected eMudhra certificate, because the new version rejects it. Replace that origin certificate instead of turning on noTLSVerify. Then confirm the service restarted and the tunnel shows Healthy in the dashboard.