Cloudflare TunnelIt is a service from Cloudflare that allows us to access devices or services within a private network, such as NAS, Web Server, Dashboard, API, n8n, or various back-end systems, from outside via the Internet securely, without needing to open Port Forwarding from the Router or Firewall directly into the internal system.

For example, if you haveSynology NASBeing in the office and wanting to access the DSM page from outside, normally you might need to open port 5000 or 5001 to the internet, which has security risks. But when using Cloudflare Tunnel, we can access it through a domain name, such as nas.example.comIt can be done without opening a port from the outside directly to the NAS.

Cloudflare Tunnel is therefore suitable for home users, Homelab, small businesses, shops, offices, and organizations that want convenient and more secure access to internal systems from the outside.

What is Cloudflare Tunnel?

Cloudflare Tunnelis a system that uses a program calledcloudflaredActs as a connector within our network, with cloudflared connecting out to Cloudflare. Then, Cloudflare acts as an intermediary to receive requests from external users and forward them back to the internal services through the created tunnel.

The key point is that the connection is of the type Outbound ConnectionFrom the inside out to Cloudflare instead of allowing outsiders to connect directly. Therefore, it helps reduce the risk of exposing internal service ports to the internet.

How is Cloudflare Tunnel different from VPN or Port Forwarding?

Topic Port Forwarding VPN Cloudflare Tunnel
Opening a port from the outside You need to open the port on the Router or Firewall Often need to open VPN ports No need to open an inbound port to the internal system
Access Access via Public IP or DDNS You must connect to a VPN before use Access through the domain name, such as nas.example.com
Hiding Public IP Often reveals the real IP Depends on the settings Help reduce the exposure of the source WAN IP
Access control Have to handle it yourself Manage through the VPN system Can be used with Cloudflare Access, Identity Provider, and MFA
Suitable for work Easy-to-use service, but risky if not configured properly Access the entire network or full Remote Access Only open the services you want through the domain name

Example of using Cloudflare Tunnel

  • Open the DSM page of Synology NAS through a domain name, such as nas.example.com
  • Open n8n within the organization through a domain name, such as n8n.example.com
  • Open the company’s Web Application for access from outside
  • Open internal dashboards such as Grafana, Uptime Kuma, or Home Assistant
  • Open internal API for external use in a controlled manner
  • Works with systems behind CGNAT where Port Forwarding cannot be done

Advantages of Cloudflare Tunnel

  • No need to open Port Forwarding:Reduce the risk of exposing NAS, Server, or Web App ports directly to the internet
  • Access via HTTPS:Users can access via HTTPS on the standard port 443, even if the internal service is HTTP.
  • No need to remember the port number:Originally, you might have had to remember 192.168.200.11:5000, but it can be changed to nas.example.com.
  • Hide WAN IP:External users connect via Cloudflare instead of accessing the organization's public IP directly
  • Suitable for many services:You can create subdomains separated by system, such as nas.example.com, n8n.example.com, monitor.example.com
  • Can be used with Zero Trust:You can add Cloudflare Access to enforce login, restrict email, restrict IP, or enable MFA before accessing critical systems.

Things to prepare before starting use

1. Domain Name

You must have a domain name that can be managed through DNS via Cloudflare, for example

  • example.com
  • yourcompany.co.th
  • mydomain.com

After adding the domain to Cloudflare, we can create subdomains for various services, such as

  • nas.example.com for Synology NAS
  • n8n.example.com for n8n
  • web.example.com for Web Server
  • monitor.example.com for Monitoring Dashboard

In this example, a domain will be usedsynctechtestcloudflare.onlineFor the purpose of explanation

2. Cloudflare Account

You need to have a Cloudflare account to manage DNS domains and Cloudflare Zero Trust, which can be registered through the Cloudflare website. Then, add your domain to the Cloudflare Dashboard.

3. Cloudflare Zero Trust

Cloudflare Tunnel will be managed through the systemCloudflare Zero TrustWhich is used to create a Tunnel, manage Connectors, configure a Public Hostname, and set additional Access Policies

4. Device for installing cloudflared Connector

There must be a device within the LAN that is always turned on, such as a Server, Mini PC, Linux Server, Windows Server, Synology NAS, or Docker Container. In this article, the example used will be Synology NAS + Container Manager

Add domain to Cloudflare

  1. Log in to Cloudflare Dashboard
  2. Go to the Account Home page
  3. Select Add a domain or Add site
  4. Enter the domain name you want to use
  5. Choose the plan you want. If you are starting general use, you can choose the Free Plan.
  6. Check the original DNS Record that Cloudflare scanned
  7. Follow the steps until Cloudflare displays the Nameserver that needs to be set at the domain provider.

Then there will be a package price option screen. If starting general usage, you can chooseFreeThen pressContinueTo go to the next step

Cloudflare Free Plan

Then Cloudflare will scan the existing DNS records. If it is a new domain or a domain specifically intended for use with the Tunnel, you can review the list and click Continue to proceed.

The next step is Cloudflare will display the Nameservers that need to be set up with the domain provider.

Go back to your domain provider, then change the old Nameserver to the Nameserver specified by Cloudflare.

After changing the Nameserver, go back to Cloudflare and clickCheck nameservers nowTo allow Cloudflare to check the status, this step may take anywhere from a few minutes to several hours, depending on the domain provider and DNS propagation.

   

When the Nameserver is updated and successfully verified, the domain status will be displayed on the Cloudflare Dashboard asActive

Create Cloudflare Tunnel

After the domain is available, the next step is to create a Cloudflare Tunnel, which will connect our LAN network with Cloudflare's services.

The Tunnel settings consist of 2 main parts.

  1. Create a Tunnel on Cloudflare
  2. Create a Connector within the LAN to communicate out to the created Tunnel

When both parts work together, we will be able to make internal LAN services such as Synology NAS, n8n, or Web Server accessible via a domain name.

Steps to create a Tunnel in Cloudflare

  1. Log in to Cloudflare Dashboard
  2. Go to the menuZero Trust
  3. Go to NetworksorNetworking
  4. SelectConnectorsorTunnels
  5. SelectCloudflare Tunnels
  6. PressCreate tunnelorAdd a tunnel
  7. Select Connector Type asCloudflared
  8. Name the Tunnel likesynctech, office-nasormain-office
  9. Press Save tunnel or Create tunnel

Name the Tunnel to be easy to remember, such assynctechThen press Save tunnel

Install cloudflared Connector on Synology NAS using Container Manager

In this article, cloudflared will be installed using a Docker Container on Synology NAS viaContainer ManagerBecause it uses fewer resources than installing on a Virtual Machine and is suitable for running all the time

Cloudflare will display Docker commands to install the Connector like this

docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token YOUR_TUNNEL_TOKEN

Precautions:Do not share the real Tunnel Token on websites, images, or public documents because this Token is used to connect the Tunnel to Cloudflare. If the Token is leaked, you should delete the existing Connector or create a new Token immediately.

Step 1: Download the cloudflared image

  1. Log in to Synology DSM
  2. OpenContainer Manager
  3. Go to the menuRegistry
  4. Search for the wordcloudflareorcloudflared
  5. Select Image namedcloudflare/cloudflared
  6. PressDownload
  7. Select Tag aslatestOr the desired version

Step 2: Create a Container

  1. Go to the menuImages
  2. Select Imagecloudflare/cloudflared
  3. PressRun
  4. Name the container, for examplecloudflared, cf-tunnelorsynctech-tunnel
  5. ActivateEnable auto-restartSo that the container automatically restarts after the NAS restarts
  6. Press Next to go to the Command settings page

Step 3: Enter Execution Command

If using the Docker CLI, we can use the full commands provided by Cloudflare, such as

docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token YOUR_TUNNEL_TOKEN

But when using Synology Container Manager, we have already selected the Image, so there is no need to enter the word docker run cloudflare/cloudflared:latestFor repetition, include only the command parts that need the Container to run, for example

tunnel --no-autoupdate run --token YOUR_TUNNEL_TOKEN

Or some pages of Cloudflare may show similar commands. Use the same principle, which is to enter only the command after the Image name in the Execution Command field.

Then press Next and Done. Once the Container is running successfully, go back to the Cloudflare Tunnel page to check the status. If the connection is successful, the status will show as HealthyorConnected

Add LAN services to Cloudflare Tunnel

After the Tunnel and Connector are operational, the next step is to add services within the LAN, such as Synology DSM, n8n, Web Server, or internal Dashboard, so that they can be accessed via a domain name.

When adding a service, such as the GUI page of Synology NAS, Cloudflare will automatically create a DNS CNAME Record and connect it through a Tunnel.

Example: Open Synology DSM via Cloudflare Tunnel

Assume the Synology NAS within the LAN uses the following IP and Port

http://192.168.200.11:5000

And want to access through the domain

nas.synctechtestcloudflare.online

Steps to add a Public Hostname

  1. Go to Cloudflare Zero Trust
  2. Choose Networks or Networking
  3. Select Tunnels
  4. Select the tunnel that has been created
  5. Press Configure or Edit
  6. Go to the tabPublic Hostnames
  7. PressAdd a public hostname

Fill in the information as follows

Topic Sample value Description
Subdomain nas Subdomain name, such as nas.example.com
Domain synctechtestcloudflare.online Select the domain set up in Cloudflare
Service Type HTTP Choose according to the protocol of the internal service. If the internal DSM page uses HTTP, select HTTP.
URL 192.168.200.11:5000 IP and Port within the LAN of Synology NAS
   

Once saved, Cloudflare will create a route for this subdomain to go through the Tunnel to the specified internal LAN service. Then, test access through the obtained URL, for example

https://nas.synctechtestcloudflare.online

Add Cloudflare Access for security

Although Cloudflare Tunnel helps reduce the risk of opening Port Forwarding, it does not mean that the internal system is automatically secure. If you open important systems, such as Synology DSM, Router, Firewall, n8n, or internal Dashboard, you should use Cloudflare AccessAdd more

Cloudflare Access helps enforce users to authenticate before accessing the system, such as logging in with Email, Google Workspace, Microsoft Entra ID, or using MFA/OTP according to the specified policy.

Recommended Policy Example

  • Only company emails are allowed
  • Use Login via Google Workspace or Microsoft Entra ID
  • Enable MFA or OTP before logging in
  • Restricted to certain countries or certain IPs
  • Create separate policies by system, such as NAS, n8n, Dashboard

Example of Subdomain Naming

Internal services Internal IP / Port Recommended subdomain
Synology DSM 192.168.200.11:5000 nas.example.com
n8n 192.168.200.11:5678 n8n.example.com
Web Server 192.168.200.20:80 web.example.com
Monitoring Dashboard 192.168.200.30:3000 monitor.example.com

Add update.sh to update the cloudflared Container on Synology

Since running cloudflared through Docker usually uses the command --no-autoupdateTherefore, there should be a method to update the Image and create a new Container periodically, in order to get the latest version of cloudflared.

The example below is a scriptupdate.shFor users who use Synology NAS and can run Docker commands via SSH, the script will pull the latest image, stop the old container, delete the old container, and create a new container with the same token.

Precautions:Before actual use, adjust the valueTUNNEL_TOKENThis is your own token and you must not publish this file to the public.

#!/bin/sh

CONTAINER_NAME="cloudflared"
IMAGE_NAME="cloudflare/cloudflared:latest"
TUNNEL_TOKEN="YOUR_TUNNEL_TOKEN"

echo "Pull latest cloudflared image..."
docker pull ${IMAGE_NAME}

echo "Stop old container..."
docker stop ${CONTAINER_NAME} 2>/dev/null || true

echo "Remove old container..."
docker rm ${CONTAINER_NAME} 2>/dev/null || true

echo "Start new cloudflared container..."
docker run -d \
--name ${CONTAINER_NAME} \
--restart unless-stopped \
${IMAGE_NAME} \
tunnel --no-autoupdate run --token ${TUNNEL_TOKEN}

echo "Show container status..."
docker ps | grep ${CONTAINER_NAME}

echo "cloudflared update completed."

How to use update.sh on Synology

  1. Enable SSH on Synology NAS only when needed
  2. Create a file named update.shsuch as keep it at/volume1/docker/cloudflared/update.sh
  3. Change valueYOUR_TUNNEL_TOKENIt is a real token of Tunnel
  4. Set the file permissions to be executable

chmod +x /volume1/docker/cloudflared/update.sh

Then run the script with the command

/volume1/docker/cloudflared/update.sh

If you want to set it to run periodically, you can use Task SchedulerOn Synology DSM, go to Control Panel > Task Scheduler and create a Scheduled Task of the User-defined script type to run the update.sh file at an appropriate interval, such as once a month.

Recommendations:For the production system, automatic updates should not be set too frequently. The status should be checked after each update, and there should be a rollback plan in case the new container malfunctions.

Precautions for using Cloudflare Tunnel

  • Critical systems should not be accessible to everyone on the internet without Cloudflare Access.
  • The real Tunnel Token should not be disclosed in articles, images, or public documents.
  • You should set a password and enable MFA on destination services, such as Synology DSM.
  • User permissions should be limited according to necessity
  • Logs and the status of the Tunnel should be checked periodically.
  • You should regularly update the cloudflared image to the latest version.
  • You should back up the important system settings.
  • You should avoid exposing unnecessary services through a Public Hostname
  • If it is an internal organizational system, the policy should be designed clearly before actual implementation.

Summary

Cloudflare Tunnel is a convenient and secure way to allow access to services within a LAN from the outside, without having to open Port Forwarding directly to the Router or Firewall. It is suitable for use with Synology NAS, Web Server, n8n, Monitoring Dashboard, and internal organization systems.

For those using Synology NAS, cloudflared can be easily installed through Container Manager, uses few resources, and is suitable for running all the time. Once connected successfully, you can add a Public Hostname to expose internal services, such as Synology's DSM, through a domain name immediately.

For long-term maintenance, there should be steps to update the cloudflared Container, such as using the update.sh file to pull the latest image and create a new Container, as well as checking the Tunnel status after each update.

However, if it is a critical system, one should not rely on Tunnel alone. It should be used in conjunction with Cloudflare Access, MFA, strong passwords, access restrictions, and log monitoring to make the system more secure.

Need expert advice or would like to request a quotation? Contact us today:
E-mail: [email protected]
LINE Official: @sync.co.th

Add SyncTech on LINE Official

The Company reserves the right to correct any typographical or printing errors and shall not be held liable for any inaccuracies resulting from such errors.
*** This article is the intellectual property of SyncTech Solution Company Limited. Reproduction, modification, or redistribution of this content, in whole or in part, is strictly prohibited without prior written permission from the Company. ***