Cloudflare Tunnel on Windows: A Practical Step-by-Step Guide

Stop Port-Forwarding Your Dev Box (You’re Not Alone)

A lot of us make the same mistake when we want to show a local project to a client or teammate: we open ports on the router, poke holes in the firewall, and hope nothing bad happens.

It kind of works… until it doesn’t.

You’re stuck messing with NAT, port forwarding, dynamic IPs, and security worries, just to expose something simple like http://localhost:3000 for 10 minutes.

Cloudflare Tunnel solves that problem in a much cleaner way, especially if you’re on Windows and just want something that works without fighting your network.

In this guide, we’ll walk through what Cloudflare Tunnel is (in plain language) and the practical, step-by-step setup on Windows: install, authenticate, create a tunnel, and connect it to your local app.

I’ll keep it focused, so you can get from “I just want to share my localhost” to “here’s a secure URL” as fast and as safely as possible.

What Cloudflare Tunnel Actually Does for You

Imagine you have a local app running on your Windows machine, like:

React app on http://localhost:3000
Laravel/WordPress dev site on http://localhost:8000

Normally, to let the outside world see that, you’d:

Configure port forwarding on your router
Expose your IP address
Deal with firewalls and maybe even DDNS

With Cloudflare Tunnel, instead of opening your house door, you let your PC connect out to Cloudflare.

Then Cloudflare gives you a public hostname (like a subdomain) that forwards traffic through that outgoing connection straight to your local app.

So:

You don’t open ports on your router
Your real IP stays hidden behind Cloudflare
The tunnel is encrypted between your machine and Cloudflare

That’s why this is so handy for developers working on Windows machines: you focus on building, not wrestling with home-network black magic.

Step 1 – Install `cloudflared` on Windows

We’ll use Cloudflare’s small command-line tool called cloudflared. This is what creates and manages the tunnel from your Windows box.

Safety note: Do this on your own machine or a trusted work PC. Avoid installing it on random shared computers.

1.1 Download `cloudflared`

Go to the official Cloudflare Tunnel docs/download page in your browser.
Download the Windows version of cloudflared (it’s usually a .exe file).
Put it somewhere easy, for example: C:\Tools\cloudflared\.

Why it matters: keeping it in a fixed location makes it easier to run from PowerShell or Command Prompt later.

1.2 Add it to PATH (optional but nice)

You can always run it by typing the full path, but adding it to PATH makes your life easier.

Copy the folder path where cloudflared.exe lives.
Open Start > type “environment” > Edit the system environment variables.
Click Environment Variables….
Under User variables or System variables, find Path, then click Edit.
Click New, paste the folder path, and save.

Now you should be able to open PowerShell and run:

cloudflared --version

If you see a version number, you’re good.

Step 2 – Authenticate and Create a Tunnel

Cloudflare Tunnel needs to know which Cloudflare account and domain it belongs to.

So for this part, you’ll need:

A Cloudflare account
At least one domain added to Cloudflare (using their nameservers)

If you’re only testing, you can use a spare domain or subdomain you already control in Cloudflare.

2.1 Login from your Windows machine

Open PowerShell or Command Prompt and run:

cloudflared login

What happens:

Your browser will open a Cloudflare page
You log in (if you aren’t already)
Cloudflare asks which domain you want to use with tunnels

Choose your domain.

After that, cloudflared will save a certificate file locally, so it can create/manage tunnels under your account without re-logging in every time.

2.2 Create a new tunnel

Now we create a named tunnel. The name is just for you, so pick something that makes sense, like dev-tunnel or local-app.

In PowerShell, run:

cloudflared tunnel create dev-tunnel

Cloudflare will:

Create a tunnel in your account with that name
Generate credentials for this tunnel and save them to a file on your machine

Remember the tunnel name. We’ll use it in config.

Step 3 – Configure the Tunnel and Connect Your Local App

Next step: tell Cloudflare what to send through this tunnel.

This is done with a simple configuration file where you map a hostname (e.g. dev.example.com) to a local service (e.g. http://localhost:3000).

3.1 Create the config file

Cloudflare uses a YAML config file, typically named config.yml.

You can create it in a folder like:

C:\Users\YOUR_USER\.cloudflared\config.yml

Open your favorite text editor (Notepad is fine) and create something like this:

tunnel: dev-tunnel
credentials-file: C:\Users\YOUR_USER\.cloudflared\dev-tunnel.json

ingress:
  - hostname: dev.yourdomain.com
    service: http://localhost:3000
  - service: http_status:404

Replace:

dev-tunnel with the exact tunnel name you created earlier
C:\Users\YOUR_USER\.cloudflared\dev-tunnel.json with the real credentials file path
dev.yourdomain.com with the hostname you want to use
http://localhost:3000 with the local URL/port of your app

Why the last line (http_status:404)? It’s a fallback rule: if no other rule matches, send a 404. It keeps the config explicit and clean.

3.2 Create a DNS record for the tunnel

Cloudflare needs to know that dev.yourdomain.com should point to this tunnel.

You can set this up from the command line, linked to the tunnel name.

In PowerShell, run something like:

cloudflared tunnel route dns dev-tunnel dev.yourdomain.com

What this does:

Creates a special DNS record in your Cloudflare DNS
That record tells Cloudflare to forward dev.yourdomain.com traffic into dev-tunnel

You only need to do this once per hostname.

3.3 Run the tunnel

Now for the fun part: starting the tunnel from your Windows machine.

From the same user where you created the config file, run:

cloudflared tunnel run dev-tunnel

cloudflared will:

Read config.yml
Connect securely to Cloudflare
Start forwarding dev.yourdomain.com to http://localhost:3000

Keep this window open while you’re using the tunnel.

Now try opening https://dev.yourdomain.com in a browser (you can even use a phone on mobile data). You should see your local app.

If it doesn’t work, double-check:

The local server is actually running and listening on that port
Hostname in config matches the one in DNS
No typo in tunnel name or credentials path

Safety Notes and Common Gotchas

You’re basically putting your local app on the internet, even if it’s behind Cloudflare, so keep a few things in mind.

Don’t expose admin panels without auth

If you point a tunnel directly at a local admin dashboard (like wp-admin, PHPMyAdmin, or a custom back-office), you’re exposing that to the world.

At minimum:

Use strong passwords
Don’t reuse credentials from other sites
Consider limiting what you expose (e.g. only the frontend)

Keep tunnels temporary for dev

For quick tests or demos, start the tunnel when you need it, stop when you’re done.

This reduces risk and avoids someone hitting your dev site days later when you already forgot it’s online.

Check permissions on shared machines

If you’re using a shared Windows account (e.g. office PC):

Remember that other users could see or use your Cloudflare tunnel config
Use your own account where possible

Why Cloudflare Tunnel Is So Handy for Windows Devs

If you build apps locally on Windows, Cloudflare Tunnel fits nicely into your normal workflow.

Typical use cases:

Show a staging build to a client without deploying
Test webhooks from external services against localhost
Quickly share work-in-progress with a teammate

You avoid:

Fighting with your router and ISP
Exposing your home IP directly
Leaving random ports open on your network

Is it only for HTTP? No, Cloudflare Tunnel can also be used for non-HTTP services like SSH, but that needs a different kind of configuration and care. For most web dev needs, a simple hostname -> http://localhost:PORT mapping is enough.

Pricing-wise, Cloudflare Tunnel has a free usage tier that’s already very useful for individual developers and everyday testing. For bigger or more critical setups, you’d look at their paid plans and limits, but for just exposing localhost during development, the free option is usually fine.

Security-wise, the traffic between your machine and Cloudflare runs over an encrypted connection. That doesn’t magically fix bad app security, but it does mean the tunnel itself isn’t just plain traffic floating around.

Compared to tools like ngrok, Cloudflare Tunnel is tied directly to your Cloudflare account and domain, instead of giving you a random URL from someone else’s domain. That’s nice when you want a stable hostname like dev.mysite.com.

Quick FAQ Recap

Is Cloudflare Tunnel free?
There’s a free option that already works well for individual developers and local testing. You can start with that without paying.

Is Cloudflare Tunnel safe?
The tunnel connection is encrypted, and your IP stays behind Cloudflare. You still need to secure your app (auth, permissions, no hard-coded secrets in public endpoints), but the tunnel itself is built with security in mind.

How is it different from ngrok?
Ngrok gives you a tunnel via ngrok’s domain, usually with random subdomains unless you pay. Cloudflare Tunnel works with your own domain and your DNS in Cloudflare, so you use hostnames you control.

Can I use it for non-HTTP stuff like SSH?
Yes, Cloudflare Tunnel can be configured to handle non-HTTP protocols such as SSH. That needs a slightly different config pattern than the simple HTTP example here.

Wrap-Up and Next Step

To recap the flow on Windows:

Install cloudflared and make sure it runs
Authenticate with cloudflared login
Create a named tunnel
Write a simple config.yml mapping hostname → http://localhost:PORT
Add a DNS route for that hostname
Run the tunnel and share your URL

Once you’ve done it once or twice, it becomes a quick part of your dev toolbox.

If this saved you time, bookmark CrushEdge for more fixes.