Configure a tunnel

After creating your Cloudflare Tunnel, you can configure various aspects of how cloudflared runs and connects your infrastructure to Cloudflare's network. This section covers advanced configuration options to optimize tunnel performance, security, and availability.

• Configure cloudflared parameters : Modify tunnel service parameters to control how cloudflared runs on your system, including logging, connection settings, and protocol options.
• Tunnel with firewall : Configure firewall rules to allow cloudflared egress traffic while blocking all ingress, implementing a positive security model.
• Tunnel availability and failover : Deploy multiple cloudflared replicas for high availability and automatic failover across your infrastructure.
• Tunnel permissions : Manage tunnel tokens and control who can run your remotely-managed tunnels.
• Cipher suites : Review the TLS cipher suites supported by cloudflared for secure connections between your origin and Cloudflare's network.

Common configuration scenarios

Optimize for production

For production deployments, consider the following steps:

• Deploy replicas - Run multiple cloudflared instances for redundancy.
• Configure logging - Set appropriate log levels for monitoring and troubleshooting.
• Review system requirements - Ensure your infrastructure meets performance needs.
• Configure firewall rules - Implement egress-only traffic patterns for security.

Secure your tunnel

All tunnel connections between cloudflared and Cloudflare's network are secured with TLS 1.3 and post-quantum encryption by default, ensuring your traffic is protected against current and future cryptographic threats.

Enhance tunnel security with:

• Tunnel token management - Control access to your tunnel credentials.
• Egress-only firewall rules - Allow only necessary outbound connections.
• Least privilege permissions - Run cloudflared as a non-root user with minimal permissions needed for tunnel operation.

Improve reliability

Maximize tunnel uptime with:

• Multiple replicas - Deploy cloudflared across different hosts.
• Health alerts - Get notified when your tunnel is degraded or goes down.
• Health metrics - Monitor tunnel resource usage to identify potential bottlenecks.
• Load balancing - Distribute traffic across tunnel connections.
• Automatic failover - Leverage built-in connection redundancy.

Next steps

• Monitor your tunnels to track performance and troubleshoot issues.
• Configure routes to control how traffic reaches your applications.
• Set up private networks for internal resource access.