Cloudflare Tunnel vs port forwarding: how to expose a home server

Short answer: port forwarding opens a hole in your router so the internet connects to your server directly. A tunnel works the other way: your server makes an outbound connection to a provider, and visitors reach you through that. Use a tunnel if you are behind carrier-grade NAT, cannot open ports, or want to hide your home IP. Use port forwarding with a reverse proxy if you want full control and no third party in the path.

How does port forwarding work?

Your router has one public IP address. A forwarding rule says "send traffic arriving on 443 to 192.168.1.20 port 443". Your DNS record points at your public IP. Visitors connect straight to your server.

• Pros: simple idea, no extra provider, full bandwidth, any protocol, no content inspection by a third party.
• Cons: exposes your home IP, needs a stable or dynamic-DNS address, does not work behind CGNAT, and every open port is attack surface that you must keep patched.

Carrier-grade NAT is common on mobile and some fibre connections. Your router gets a private address and shares a public one with other customers, so there is nothing to forward. Check whether your router's WAN address matches what a "what is my IP" site shows. If they differ, you are likely behind CGNAT.

How does a tunnel work?

A small daemon (cloudflared) on your server opens outbound connections to Cloudflare. Your hostname's DNS points to Cloudflare. A visitor's request reaches Cloudflare, which sends it down the tunnel to your daemon, which forwards it to the local service. No inbound ports are opened.

# config.yml for cloudflared
tunnel: <TUNNEL-ID>
credentials-file: /etc/cloudflared/<TUNNEL-ID>.json
ingress:
  - hostname: app.example.com
    service: http://localhost:3000
  - hostname: git.example.com
    service: http://localhost:3001
  - service: http_status:404

• Pros: works behind CGNAT, no open ports, hides your origin IP, free tier available, includes DDoS protection and optional access policies in front of apps.
• Cons: all traffic passes through a third party that can see it unencrypted at their edge, you depend on their service and terms, some protocols and large file transfers are restricted or against terms, and latency may be higher.

What about a VPN instead?

If the users are you and a few people you trust, you may not need to expose anything publicly. WireGuard, or Tailscale which builds on it, gives you a private network. Your phone and laptop reach http://home-server as if they were at home. This is the safest option for admin tools, and a good default for family services.

How do you choose?

• Public website or app for customers, and you can open ports: a VPS is usually better than a home connection. Or port forwarding plus a hardened reverse proxy.
• Public site from home behind CGNAT: tunnel.
• Only you and a few people: VPN.
• Admin panels in any case: keep them off the public internet.

What should you not do?

• Forward the SSH port or a database port to the internet with a password login.
• Rely on a tunnel as a security plan. The app behind it still needs updates and authentication.
• Run business-critical systems on a home connection with no redundancy and no uptime monitoring.
• Send sensitive data through a third-party tunnel without reading their terms.

Whichever you choose, the rest of the hardening checklist still applies.