Secure Home Network using Cloudflare Tunnel with Hyper-V

Prerequisites and Infrastructure Setup

Before configuring the tunnel, ensure you have a registered domain name managed within your Cloudflare account. You must have administrative access to add DNS records and create access policies. The core requirement is a Hyper-V host running Windows 10 or 11 with Hyper-V enabled. Inside this environment, you will deploy an Ubuntu Server 22.04 instance. This Linux guest serves as the secure bridge between your internal services and the public internet via Cloudflare’s edge network.

The architecture relies on the cloudflared agent running inside the VM. Unlike traditional reverse proxies that require listening on a public IP, this agent initiates an outbound connection to Cloudflare. This means your home router does not need any inbound port rules, significantly reducing the attack surface. For additional context on securing local web interfaces, consider reviewing strategies for removing insecure warnings from browser connections Removing 'Notsecure' Warning from Chrome for Home Network Page Media Server.

Installing Cloudflared on Ubuntu Server

Start by creating a new Virtual Machine in Hyper-V Manager. Assign sufficient memory and disk space to the Ubuntu Server 22.04 installation. Once the OS is installed and updated, connect via SSH or console to begin the software setup. Cloudflare provides official repositories for Debian-based systems, which simplifies the installation process compared to compiling from source.

1. Update System Packages: Run sudo apt update && sudo apt upgrade -y to ensure all base packages are current.
2. Install Dependencies: Install curl and gnupg if they are not already present using sudo apt install curl gnupg -y.
3. Add Cloudflare Repository: Download the Cloudflare GPG key and add the repository list. Use the command: curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null followed by adding the deb line to /etc/apt/sources.list.d/cloudflare-main.list.
4. Install Daemon: Execute sudo apt install cloudflared -y to install the binary.

Verify the installation by checking the version with cloudflared --version. The output should confirm the latest stable release. At this stage, the binary is available but not yet configured to communicate with your specific zone.

Configuring the Tunnel Identity

The next step involves authenticating the cloudflared service with your Cloudflare account. This creates a unique identity file that allows the tunnel to register itself with Cloudflare’s edge nodes. Log into your Cloudflare dashboard, navigate to Zero Trust, and select Networks then Tunnels. Click Create a tunnel and choose "Cloudflared" as the connector type.

Cloudflare will provide a token or instruct you to run a configuration command locally. On your Ubuntu VM, execute the following command:

sudo cloudflared service install
sudo cloudflared tunnel login

The tunnel login command opens a browser window on your host machine, prompting you to authorize the device. Upon successful authentication, a certificate file is saved to ~/.cloudflared/cert.pem. This file is critical; losing it requires re-authentication. Ensure you back up this directory securely. This process establishes the trust relationship necessary for encrypted communication.

Creating and Routing the Tunnel

With the identity established, you can now define what traffic the tunnel handles. Return to the Cloudflare Zero Trust dashboard. Create a new tunnel and assign it a name, such as home-ubuntu-tunnel. Cloudflare will generate a unique Tunnel ID. You must save this ID for the local configuration file.

On the Ubuntu server, create the configuration file at ~/.cloudflared/config.yml. This YAML file dictates how incoming requests are routed. A basic configuration might look like this:

tunnel: <TUNNEL_ID>
credentials-file: /home/<username>/.cloudflared/<TUNNEL_ID>.json

ingress:
  - hostname: example.com
    service: http://localhost:80
  - service: http_status:404

Replace <TUNNEL_ID> with the actual ID provided by Cloudflare. Update the username path accordingly. The ingress rules map a public hostname (e.g., example.com) to a local service running on port 80 of the Ubuntu VM. If your web server runs on a different port, adjust the service line. After saving the file, start the tunnel manually to test connectivity:

sudo cloudflared tunnel run <TUNNEL_ID>

If the logs show successful connections, stop the process and enable the systemd service for automatic startup on boot:

sudo systemctl enable cloudflared
sudo systemctl start cloudflared

Finally, verify the DNS record in your Cloudflare zone points to the tunnel. Cloudflare automatically manages the CNAME record when you create the tunnel via the dashboard, linking your domain directly to the tunnel endpoint. This completes the setup, allowing secure access to your home network services without exposing any local ports.

Frequently Asked Questions

Can I use Cloudflare Tunnel with IPv6 only?

Yes, Cloudflare supports IPv6 natively, and cloudflared can operate over IPv6 connections. However, your local service must also be accessible via IPv6, or you may need to configure dual-stack networking in your Ubuntu VM. Most home routers handle this translation, but verifying local reachability is essential before deploying the tunnel.

What happens if my internet connection drops?

The cloudflared agent is designed to handle transient network failures gracefully. It maintains multiple persistent connections to Cloudflare’s global edge network. If your internet goes down, the tunnel disconnects temporarily. Once connectivity is restored, the agent automatically reconnects and resumes routing traffic without manual intervention.

Is it safe to store the cert.pem file on the VM?

Storing the certificate on the VM is standard practice, but you should restrict file permissions to prevent unauthorized access. Use chmod 600 ~/.cloudflared/cert.pem to ensure only the root user or the designated service account can read it. Compromising this file could allow an attacker to impersonate your tunnel.

How do I add multiple services to one tunnel?

You can add multiple ingress rules in the config.yml file. Each rule maps a different subdomain or path to a different local service. For example, you can route app.example.com to port 3000 and db.example.com to port 5432. Cloudflare routes traffic based on these distinct hostnames efficiently.

Does this setup protect against DDoS attacks?

Yes, because all traffic passes through Cloudflare’s infrastructure, you benefit from their DDoS mitigation capabilities. Your home IP address remains hidden behind Cloudflare’s proxy network. Attackers target Cloudflare’s robust edge network rather than your direct connection, absorbing volumetric attacks before they reach your home router.