Configuration file
The tunnel configuration file allows you to have fine-grained control over how an instance of cloudflared will operate. In your configuration file, you can specify top-level properties for your cloudflared instance as well as configure origin-specific properties. For a full list of configuration options, type cloudflared tunnel help in your terminal.
In the absence of a configuration file, cloudflared will proxy outbound traffic through port 8080.
File structure for private networks
If you are exposing a private network to end users running WARP, you need to add the warp-routing key and set it to true:
File structure for public hostnames
If you are exposing local services to the Internet, you can assign a public hostname to each service:
Configuration files that contain ingress rules must always include a catch-all rule that concludes the file. In this example, cloudflared will respond with a 404 status code when the request does not match any of the previous hostnames.
How traffic is matched
When cloudflared receives an incoming request, it evaluates each ingress rule from top to bottom to find which rule matches the request. Rules can match either the hostname or path of an incoming request, or both.
If a rule does not specify a hostname, all hostnames will be matched. If a rule does not specify a path, all paths will be matched.
The last ingress rule must be a catch-all rule that matches all traffic.
Here is an example configuration file that specifies several rules:
Supported protocols
In addition to HTTP, cloudflared supports protocols like SSH, RDP, arbitrary TCP services, and Unix sockets. You can also route traffic to the built-in Hello World test server or respond to traffic with an HTTP status.
| Service | Description | Example service value |
|---|---|---|
| HTTP/S | Incoming HTTP requests are proxied directly to your local service. | https://localhost:8000 |
| HTTP over Unix socket | Just like HTTP, but using a Unix socket instead. | unix:/home/production/echo.sock |
| HTTPS over Unix socket | Just like HTTPS, but using a Unix socket instead. | unix+tls:/home/production/echo.sock |
| TCP | TCP connections are proxied to your local service. | tcp://localhost:2222 |
| SSH | SSH connections are proxied to your local service. Learn more. | ssh://localhost:22 |
| RDP | RDP connections are proxied to your local service. Learn more. | rdp://localhost:3389 |
| kubectl bastion mode | cloudflared will act like a jumphost, allowing access to any local address. |
bastion |
| Hello World | Test server for validating your Cloudflare Tunnel setup. | hello_world |
| HTTP status | Responds to all requests with the given HTTP status. | http_status:404 |
Origin configuration
If you need to proxy traffic to multiple origins within one instance of cloudflared, you can define the way cloudflared sends requests to each service by specifying configuration options as part of your ingress rules.
In the following example, the top-level configuration connectTimeout: 30s sets a 30-second connection timeout for all services within that instance of cloudflared. The ingress rule for service: localhost:8002 then configures an exception to the top-level configuration by setting connectTimeout for that service at 10s. The 30-second connection timeout still applies to all other services.
Validate ingress rules
To validate the ingress rules in your configuration file, run:
This will ensure that the set of ingress rules specified in your config file is valid.
Test ingress rules
To verify that cloudflared will proxy the right traffic to the right local service, use cloudflared tunnel ingress rule. This checks a URL against every rule, from first to last, and shows the first rule that matches. For example:
Update a configuration file
When making changes to the configuration file for a given tunnel, we suggest relying on cloudflared replicas to propagate the new configuration with minimal downtime.
- Have a
cloudflaredinstance running with the original version of the configuration file. - Start a
cloudflaredreplica running with the updated version of the configuration file. - Wait for the replica to be fully running and usable.
- Stop the first instance of
cloudflared.
Your cloudflared will now be running with the updated version of your configuration file.