Skip to content
Cloudflare Docs

Azure

This guide covers how to connect an Azure Virtual Machine to Cloudflare using cloudflared and publish a web application through a Cloudflare Tunnel.

Prerequisites

1. Create a Virtual Machine

  1. In the Azure portal, go to Virtual Machines > Create > Azure virtual machine.

  2. Select a Resource group or create a new one.

    Azure group

  3. Enter a name for the VM and select a region. For Image, select Ubuntu Server 24.04 LTS. For Size, select an appropriate size (for example, Standard_B1s).

  4. Under Administrator account, select SSH public key and enter your key pair.

    Azure keypair

  5. Under Inbound port rules, allow SSH (22). For testing purposes, also allow HTTP (80) and HTTPS (443).

    Azure ports

  6. Select Review + create, then Create.

  7. Once the VM is running, copy its Public IP address from the VM overview page.

  8. SSH into the instance:

    Terminal window
    ssh -i "your-key.pem" azureuser@<PUBLIC_IP>

  9. Run sudo su to gain full admin rights to the VM.

  10. For testing purposes, you can deploy a basic Apache web server on port 80:

    Terminal window
    apt update
    

    apt -y install apache2
    

    cat <<EOF > /var/www/html/index.html
    <html><body><h1>Hello Cloudflare!</h1>
    <p>This page was created for a Cloudflare demo.</p>
    </body></html>
    EOF

  11. To verify that the Apache server is running, open a browser and go to http://<PUBLIC_IP> (make sure to connect over http, not https). You should see the Hello Cloudflare! test page.

2. Create a tunnel

  1. In the Cloudflare dashboard ↗, go to Networking > Tunnels.
  2. Select Create Tunnel and enter a name (for example, azure-tunnel).
  3. Select Create Tunnel.
  4. Under Setup Environment, select Debian 64-bit.
  5. Copy the install commands and run them on your Azure VM.
  6. Once the tunnel connects, select Continue.

3. Publish an application

  1. Under Routes, select Add route > Published application.
  2. Enter a hostname (for example, hellocloudflare.<your-domain>.com).
  3. Under Service, enter http://localhost:80.
  4. Select Add route.

To test, open a browser and go to the hostname you configured. You should see the Hello Cloudflare! test page.

Firewall configuration

To secure your Azure VM, you can configure your Network Security Group (NSG) ↗ to deny all inbound traffic and allow only outbound traffic to the Cloudflare Tunnel IP addresses. All NSG rules are evaluated by priority; traffic that does not match an allow rule is blocked by the default deny rules. Therefore, you can delete all custom inbound rules and leave only the relevant outbound rules.

After configuring your NSG rules, verify that you can still access the service through Cloudflare Tunnel via its public hostname. The service should no longer be accessible from outside Cloudflare Tunnel — for example, direct access to the VM's public IP should no longer work.