Cloudflared-windows-amd64.exe -
cloudflared.exe tunnel login A browser window will open. Log in to your Cloudflare account and select the domain you want to use. This generates a cert.pem file in %USERPROFILE%\.cloudflared\ . That certificate is your global API credential—keep it safe. Tunnels are persistent connections with their own configuration. Let’s create one.
cloudflared.exe service install This creates a service named “Cloudflare Tunnel Agent”. Start it:
net start cloudflared Or use the Services GUI ( services.msc ). The service automatically runs at boot. | Local Service | Example URL | Config service line | |------------------------|--------------------------------------|--------------------------------------| | IIS (default website) | http://localhost:80 | service: http://localhost:80 | | Node.js dev server | http://localhost:3000 | service: http://localhost:3000 | | Jellyfin / Plex | http://localhost:8096 | service: http://localhost:8096 | | SMB / RDP (via Access) | tcp://localhost:3389 | service: tcp://localhost:3389 | | SSH | tcp://localhost:22 | service: tcp://localhost:22 | cloudflared-windows-amd64.exe
Now, route traffic to a local service. For example, if you run a web app on localhost:3000 :
– Cloudflared does not listen on ports locally (it connects outbound). The error may be your local web server. cloudflared
Invoke-WebRequest -Uri "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe" -OutFile "$env:USERPROFILE\Downloads\cloudflared.exe" Move it to a permanent location, e.g., C:\cloudflared\cloudflared.exe , and add that folder to your PATH for easy access. Cloudflared needs to authenticate with your Cloudflare account.
First, ensure your config is ready. Then: That certificate is your global API credential—keep it
If you run a web server on your Windows machine—whether for development, home automation, or a personal website—you know that exposing it to the internet can be risky. Port forwarding is messy, dynamic DNS is a hassle, and your ISP might block incoming traffic altogether.
Open or PowerShell and navigate to where cloudflared.exe lives, then run:
cloudflared.exe tunnel create my-first-tunnel This creates a tunnel (with a UUID) and stores its credentials in .cloudflared . It also creates a tunnel configuration file template.
cloudflared.exe tunnel --url http://localhost:3000 Cloudflare gives you a random https://random-name.trycloudflare.com URL. This uses Cloudflare’s Quick Tunnels feature—no authentication, no config. “Access is denied” – Run Command Prompt or PowerShell as Administrator when installing the service or writing to Program Files .
cloudflared.exe tunnel login A browser window will open. Log in to your Cloudflare account and select the domain you want to use. This generates a cert.pem file in %USERPROFILE%\.cloudflared\ . That certificate is your global API credential—keep it safe. Tunnels are persistent connections with their own configuration. Let’s create one.
cloudflared.exe service install This creates a service named “Cloudflare Tunnel Agent”. Start it:
net start cloudflared Or use the Services GUI ( services.msc ). The service automatically runs at boot. | Local Service | Example URL | Config service line | |------------------------|--------------------------------------|--------------------------------------| | IIS (default website) | http://localhost:80 | service: http://localhost:80 | | Node.js dev server | http://localhost:3000 | service: http://localhost:3000 | | Jellyfin / Plex | http://localhost:8096 | service: http://localhost:8096 | | SMB / RDP (via Access) | tcp://localhost:3389 | service: tcp://localhost:3389 | | SSH | tcp://localhost:22 | service: tcp://localhost:22 |
Now, route traffic to a local service. For example, if you run a web app on localhost:3000 :
– Cloudflared does not listen on ports locally (it connects outbound). The error may be your local web server.
Invoke-WebRequest -Uri "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe" -OutFile "$env:USERPROFILE\Downloads\cloudflared.exe" Move it to a permanent location, e.g., C:\cloudflared\cloudflared.exe , and add that folder to your PATH for easy access. Cloudflared needs to authenticate with your Cloudflare account.
First, ensure your config is ready. Then:
If you run a web server on your Windows machine—whether for development, home automation, or a personal website—you know that exposing it to the internet can be risky. Port forwarding is messy, dynamic DNS is a hassle, and your ISP might block incoming traffic altogether.
Open or PowerShell and navigate to where cloudflared.exe lives, then run:
cloudflared.exe tunnel create my-first-tunnel This creates a tunnel (with a UUID) and stores its credentials in .cloudflared . It also creates a tunnel configuration file template.
cloudflared.exe tunnel --url http://localhost:3000 Cloudflare gives you a random https://random-name.trycloudflare.com URL. This uses Cloudflare’s Quick Tunnels feature—no authentication, no config. “Access is denied” – Run Command Prompt or PowerShell as Administrator when installing the service or writing to Program Files .
