How to Set Up Cloudflare Tunnel on Synology NAS

The advantage of this approach is that external users connect via Cloudflare instead of connecting directly to the organization's Public IP, eliminating the need to set up Port Forwarding for those services.

How is Cloudflare Tunnel Different from VPN and Port Forwarding?

Although all three methods provide remote access to internal systems, their underlying concepts differ significantly.

Use Cases for Cloudflare Tunnel

• Exposing Synology DSM via nas.example.com
• Exposing n8n via n8n.example.com
• Publishing internal Web Applications
• Accessing Dashboards like Grafana or Uptime Kuma
• Exposing REST APIs for external systems to call
• Operating networks situated behind CGNAT

Benefits of Cloudflare Tunnel

• No Port Forwarding Required: Reduces the risk of exposing internal services directly to the internet.
• Supports CGNAT: Can be used even without a dedicated Public IP.
• Domain Name Access: Easier to remember than IP addresses and port numbers.
• Multi-Service Support: Create separate subdomains for distinct systems.
• Integrates with Cloudflare Access: Adds an identity verification layer before accessing the system.

While Cloudflare Tunnel minimizes the risks of Port Forwarding, it does not automatically make your system secure. For critical services like Synology DSM, ERPs, Routers, or internal Dashboards, it should always be paired with Cloudflare Access and Multi-Factor Authentication (MFA) for an extra layer of security.

What to Prepare Before Using Cloudflare Tunnel

Before creating a Cloudflare Tunnel, you should have the basic components ready to ensure proper connection and reduce installation issues.

1. Domain Name

Cloudflare Tunnel requires a domain name whose DNS can be managed via Cloudflare. You can use a new or existing domain, such as:

• example.com
• example.co.uk
• mydomain.net

After adding the domain to Cloudflare, you can create subdomains for each service, for instance:

• nas.example.com for Synology DSM
• n8n.example.com for n8n
• web.example.com for Web Server
• monitor.example.com for Grafana or Uptime Kuma
• api.example.com for REST APIs

In this article, we will use the example domain synctechtestcloudflare.online, which you can replace with your own domain.

2. Cloudflare Account

You need a Cloudflare account to manage your DNS and Cloudflare Tunnel. If you don't have one, you can sign up for free and add your domain to the Cloudflare Dashboard.

For general use cases like exposing Synology DSM or Web Applications, you can start with the Free Plan.

3. Cloudflare Zero Trust

Cloudflare Tunnel is managed through Cloudflare Zero Trust, which is used to create tunnels, check connector statuses, and define which services to route through domain names.

In this guide, we will use Cloudflare Zero Trust to:

• Create a Tunnel
• Connect the cloudflared Connector
• Add a Public Hostname
• Implement Cloudflare Access at the end of the guide

4. A Machine to Install cloudflared

The cloudflared program acts as the connector between Cloudflare and your internal network. Therefore, it should be installed on a device that is always on, such as:

• Synology NAS
• Linux Server
• Windows Server
• Mini PC
• Virtual Machine
• Docker Container

In this guide, we will use Synology NAS + Container Manager because it is easy to install, consumes minimal resources, and is suited for 24/7 operation.

Adding a Domain to Cloudflare

If your domain is not yet using Cloudflare DNS, the first step is to add it to your Cloudflare account.

Step 1: Add a Domain

1. Log into the Cloudflare Dashboard
2. Go to Account Home
3. Click Add a domain
4. Enter the domain name you wish to use

Step 2: Select a Plan

Cloudflare will prompt you to select a plan. For general or trial usage of Cloudflare Tunnel, you can select the

Free Plan

Then click Continue to proceed.

Step 3: Review DNS Records

Cloudflare will scan for existing DNS Records and display them for review.

If the domain has an active website or email system, ensure all crucial DNS records have been imported correctly.

If it's a brand new domain specifically for Cloudflare Tunnel, you can review the list and click Continue immediately.

Step 4: Change Nameservers

Cloudflare will provide 2 new Nameservers. Replace your domain's old nameservers at your Domain Registrar with these new ones.

Log into your domain provider's management panel and update the nameservers to the ones provided by Cloudflare.

Step 5: Wait for Verification

After updating the Nameservers, return to Cloudflare and click

Check nameservers now

so Cloudflare can verify the status.

Nameserver updates can take anywhere from a few minutes to several hours, depending on the domain registrar.

Once the domain is successfully verified, Cloudflare will show the status as

Active

With the domain active, you are ready to create a Cloudflare Tunnel in the next step.

Creating a Cloudflare Tunnel

Once your domain is Active, the next step is to create the Cloudflare Tunnel, which acts as the bridge between Cloudflare and your internal network.

Cloudflare Tunnel consists of 2 main parts:

1. Creating the Tunnel on Cloudflare.
2. Installing the cloudflared program inside your network to connect to the created Tunnel.

Once both components are working together, you can expose internal services like Synology NAS, Web Servers, or n8n via a domain name.

Step 1: Enter Cloudflare Zero Trust

From the Cloudflare Dashboard, select Zero Trust to enter the Cloudflare Zero Trust management interface.

Step 2: Open the Cloudflare Tunnel Menu

Inside Cloudflare Zero Trust, navigate to the Networks > Tunnels menu to manage tunnels, as shown in the image.

Then click the Create tunnel button to create a new Tunnel.

Step 3: Select Connector Type

Cloudflare will ask you to choose a connector type. For this guide, select

Cloudflared

because we will install the cloudflared program on a Synology NAS using Container Manager.

Step 4: Name the Tunnel

Assign a meaningful name to the Tunnel, for example:

• synctech
• main-office
• office-nas
• head-office
• branch-01

This article uses the name:

synctech

Then click Save tunnel.

Step 5: Copy the Tunnel Token

After successfully creating the Tunnel, Cloudflare will display installation commands for the Connector. Within these commands, you will find a Tunnel Token used to connect to your specific Tunnel.

When using Synology Container Manager, we only need the command portion:

tunnel --no-autoupdate run --token YOUR_TUNNEL_TOKEN

Replace YOUR_TUNNEL_TOKEN with the actual Token provided by Cloudflare.

Example:

tunnel --no-autoupdate run --token eyJhIjoiNTU2MDgwOGM3ZDk1NGNl...

In this article, the Tunnel Token is partially redacted for security. Always use your own account's actual Token for your setup.

Installing cloudflared on Synology NAS

Once you have the Tunnel Token, the next step is to install cloudflared on your Synology NAS via Container Manager to connect the Tunnel to your internal network.

This article uses Container Manager because it is easy to configure, resource-efficient, and ideal for continuous 24/7 operation.

Step 1: Download the Image

Log into your Synology DSM and open Container Manager.

Go to the Registry menu and search for:

cloudflare/cloudflared

Select the image published by Cloudflare and click Download.

For the tag, you can choose:

latest

to use the newest version.

Step 2: Create a Container

Once the download is complete, go to the Images menu, select cloudflare/cloudflared, and click Run.

Name the Container, for example:

• cloudflared
• cf-tunnel
• synctech-tunnel

Then enable:

Enable auto-restart

so the Container automatically restarts if the Synology NAS reboots.

Step 3: Define Execution Command

In the Execution Command field, enter the following command:

tunnel --no-autoupdate run --token YOUR_TUNNEL_TOKEN

Example:

tunnel --no-autoupdate run --token eyJhIjoiNTU2MDgwOGM3ZDk1NGNl...

(It is recommended to add --no-autoupdate to prevent unexpected container crashes in the long run. If you need to update the version, it is better to download a new image (Pull latest) rather than letting the program self-update inside the container.)

Then click Next and Done.

Verify Connector Status

After the Container starts, return to the Cloudflare Tunnel page. If the connection is successful, you will see the statuses:

• Healthy
• Connected

This indicates that the Synology NAS has successfully connected to Cloudflare and is ready for adding internal services.

Once the status is Healthy, you are ready to configure internal services for access via Cloudflare Tunnel in the next step.

Adding Internal Services to Access via Cloudflare Tunnel

Now that the Tunnel and Connector are running, the next step is deciding which services in your network can be accessed from the internet.

Cloudflare links a domain name (Subdomain) you define to a specific internal service via the Tunnel. This allows users to access the service via a domain name without needing to connect directly to the organization's Public IP.

In this example, we will expose the Synology DSM interface via Cloudflare Tunnel.

Assume the Synology NAS is accessible locally at:

http://192.168.200.11:5000

And you want users to access it externally via:

https://nas.synctechtestcloudflare.online

Once configured, users can instantly use that domain name without any Port Forwarding configured on the router.

Step 1: Open Public Hostname Settings

Return to the Cloudflare Tunnel page, select the created Tunnel, and click Configure.

Select the Public Hostnames tab and click Add a public hostname.

Step 2: Configure Public Hostname

Fill out the information as follows:

For this example, the internal Synology DSM operates over:

http://192.168.200.11:5000

So we select:

Service Type = HTTP

If your service operates over HTTPS, such as:

https://192.168.200.11:5001

You can choose Service Type = HTTPS. (Note: For most Synology NAS setups, the default certificate is Self-signed. Cloudflare will block this and display a 502 Bad Gateway error. To fix this, you must go to Additional application settings > TLS and enable No TLS Verify before using the service.)

Step 3: Test the Connection

Once you save the settings, Cloudflare will automatically generate the corresponding DNS Records.

Try opening the URL in a web browser, for example:

https://nas.synctechtestcloudflare.online

If everything is correct, the Synology DSM login screen will appear via Cloudflare Tunnel.

Examples of Configuring Public Hostnames for Other Services

Cloudflare Tunnel allows you to create multiple Public Hostnames within a single Tunnel, making it possible to expose various services using the same primary domain.

Separating subdomains by service type makes administration easier and allows you to independently configure access permissions for each system via Cloudflare Access later.

Implementing Cloudflare Access for Enhanced Security

Cloudflare Tunnel allows internal access without Port Forwarding, but it doesn't mean internal systems are automatically secure.

Cloudflare Tunnel only builds the connection path between Cloudflare and the internal service. It does not authenticate or verify the user. Therefore, if you expose critical services like Synology DSM, n8n, Routers, Firewalls, or corporate Dashboards, they must be used in conjunction with Cloudflare Access.

Cloudflare Access is a service within the Cloudflare Zero Trust suite that helps define who can reach internal systems. Users must verify their identity before they can connect to designated services.

What Can Cloudflare Access Do?

• Require users to log in before system access
• Support Google Workspace
• Support Microsoft Entra ID
• Support GitHub and other Identity Providers
• Enforce Multi-Factor Authentication (MFA)
• Restrict access based on Email
• Restrict access based on Country
• Restrict access based on Public IP
• Configure Session Durations

Usage Example

Suppose you expose Synology DSM at:

https://nas.example.com

Instead of showing the Synology login page immediately, Cloudflare Access will verify the user's identity first.

For instance, you can allow only users with a company email:

@sync.co.th

Once authenticated, Cloudflare then forwards the request to the Synology DSM inside your network.

Best Practices

Even though Cloudflare Tunnel drastically reduces Port Forwarding risks, a securely designed system should utilize multiple layers of defense.

• Enable Cloudflare Access for all critical services.
• Enforce Multi-Factor Authentication (MFA).
• Apply Least Privilege access permissions.
• Set appropriate Session Timeouts.
• Use strong, hard-to-guess passwords.
• Regularly update Synology DSM and cloudflared.
• Periodically review Tunnel and internal service logs.
• Regularly back up system data.
• Store Tunnel Tokens securely.
• Expose only the services strictly necessary for actual use.

What to Avoid

What to Check if You Cannot Connect?

If the Tunnel status is Healthy but you still cannot open the service via the domain name, check the following in order:

1. Is the cloudflared Container still in a Running state?
2. Is the Tunnel Token correct?
3. Is the Public Hostname configured properly?
4. Does the Service Type match the target service (HTTP vs. HTTPS)?
5. Are the IP Address and Port of the internal service correct?
6. Can you access the service from a local machine inside the LAN normally?
7. Have the domain's DNS records fully propagated?
8. Check the Container Logs for detailed error messages.

Summary

Cloudflare Tunnel is a robust alternative that safely exposes internal services like Synology NAS, Web Servers, n8n, Dashboards, and APIs to the internet without needing to configure Port Forwarding or expose the organization's Public IP.

For Synology NAS users, installing cloudflared via Container Manager is simple, requires few resources, and is well-suited for continuous operation. Once connected, you can immediately add Public Hostnames to access internal services via domain names.

However, for critical services, you should not rely on Cloudflare Tunnel alone. It should be combined with Cloudflare Access, Multi-Factor Authentication (MFA), strict user permissions, and regular log reviews to maximize system security.

When properly implemented, Cloudflare Tunnel minimizes the complexity of exposing internal services, facilitates remote access conveniently, and significantly enhances system security for home users, small businesses, and enterprises alike.