Configuration

This page covers the most common configuration options for cloudflared tunnels, including high availability, firewall rules, and runtime parameters.

When you run a tunnel, cloudflared establishes four outbound-only, post-quantum encrypted connections to at least two distinct Cloudflare data centers. If any connection, server, or data center goes offline, your resources remain available.

A replica is an additional cloudflared instance that points to the same tunnel. Each replica creates four new connections, providing additional ingress points to your origin. You can run up to 25 replicas (100 connections) per tunnel. Traffic routes to the geographically closest replica.

graph LR
    C((Cloudflare))
    subgraph E[Your network]
        cf1["cloudflared <br> (Replica for tunnel-01)"]
        cf2["cloudflared <br> (Replica for tunnel-01)"]
        S1[Application]
        cf1-->S1
        cf2-->S1
    end
    C -- "Connections x 4 <br>"--> cf1
    C --> cf1
    C --> cf1
    C --> cf1
    C -- Connections x 4--> cf2
    C --> cf2
    C --> cf2
    C --> cf2

cloudflared connects outbound to Cloudflare on port 7844. Your firewall must allow egress to the following destinations. Block all ingress traffic for a positive security model — only the services in your tunnel configuration will be exposed.

To verify your firewall allows tunnel traffic, refer to Connection errors.

These flags apply to the cloudflared tunnel run command. They control how the tunnel runs on your operating system.

The most commonly used parameters:

The following example shows how to manually run a tunnel with configuration flags:

cloudflared tunnel --loglevel info --logfile /var/log/cloudflared/cloudflared.log run --token <TOKEN VALUE>

For the complete list of run parameters and instructions on how to add them to a tunnel service, refer to Run parameters.

Origin configuration parameters control how cloudflared proxies traffic to your origin server.

The most commonly used parameters:

For the complete list of origin parameters and setup instructions, refer to Origin parameters.

You can scope Cloudflare member permissions to individual Cloudflare Tunnel instances instead of granting account-wide access. This lets you delegate management of specific Tunnels — for example, letting an application team manage one Tunnel without exposing the rest of your account.

Refer to Granular permissions.