Create a tunnel (dashboard)

Follow this step-by-step guide to create your first remotely-managed tunnel using Cloudflare One.

Before you deploy

Before deploying your tunnel, run connectivity pre-checks to validate that your environment can connect to Cloudflare Tunnel endpoints. These tests verify DNS resolution and network connectivity on port 7844, helping you identify and resolve firewall or DNS issues before deployment. Running these checks sets your deployment up for success and helps narrow down the cause of any later connectivity issues.

1. Create a tunnel

1. Log in to Cloudflare One ↗ and go to Networks > Connectors > Cloudflare Tunnels.

2. Select Create a tunnel.

3. Choose Cloudflared for the connector type and select Next.

4. Enter a name for your tunnel. We suggest choosing a name that reflects the type of resources you want to connect through this tunnel (for example, enterprise-VPC-01).

5. Select Save tunnel.

6. Next, you will need to install cloudflared and run it. To do so, check that the environment under Choose an environment reflects the operating system on your machine, then copy the command in the box below and paste it into a terminal window. Run the command.

7. Once the command has finished running, your connector will appear in Cloudflare One.

   

8. Select Next.

The next steps depend on whether you want to publish an application to the Internet or connect a private network.

2a. Publish an application

Follow these steps to publish an application to the Internet. If you are looking to connect a private resource, skip to the Connect a network section.

Prerequisites

Before you publish an application through your tunnel, you must add a website to Cloudflare.

To add a published application when creating a new tunnel:

1. Go to the Published applications tab.

2. Enter a subdomain and select a Domain from the drop-down menu. Specify any subdomain or path information.

   Note

   If you add a multi-level subdomain (more than one level of subdomain), you must order an Advanced Certificate for the hostname.

3. Under Service, choose a service type and specify its URL. For example,

   • Type: HTTP
   • URL: localhost:8000

4. Under Additional application settings, specify any parameters you would like to add to your tunnel configuration.

   

5. Select Save.

Anyone on the Internet can now access the application at the specified hostname. To allow or block specific users, create an Access application.

2b. Connect a network

To connect a private network through your tunnel:

1. Go to the CIDR tab.
2. In CIDR, enter the private IP address or CIDR range of your service (for example, 10.0.0.1 or 10.0.0.0/24).
3. Select Complete setup.

cloudflared can now route traffic to these destination IPs. To configure Zero Trust policies and connect as a user, refer to Connect an IP/CIDR.

Note

If you would like to route to a private application using its hostname instead of its IP, refer to Connect a private hostname.

3. View your tunnel

After saving the tunnel, you will be redirected to the Networks > Connectors page. Your tunnel should be listed with a Healthy status. If your tunnel status is Inactive, Down, or Degraded, refer to the troubleshooting documentation for recommended next steps.