Self-hosted business tools on a private VPS
Run your own CRM, ERP, file drive and team apps on a private VPS, and publish them through tunnels.
Read this guide →
Cloud & Infrastructure / Deep Dive
Secure remote access without static IP
Remote access without static IP means reaching your office server, NAS or dashboard from anywhere without opening a router port. A Cloudflare Tunnel makes one outbound connection, and a Zero Trust policy decides who gets in. We set it up and run it.
SCROLL
Reachable from anywhere, exposed nowhere
Most office networks, branch sites and home labs sit behind a router with no static public IP. That used to force a choice. Forward ports, which is cheap and dangerous. Or run a corporate VPN, which is safer but adds friction.
Cloudflare Tunnels with Zero Trust access policies replace both. A small daemon inside your network opens an outbound connection to Cloudflare's edge. Authorised users then reach the internal service through a public hostname they sign in to.
No inbound port is opened and no static IP is needed. Access can be scoped per user, per device and per application. This guide is part of our managed cloud hosting service. It explains how the pattern works and where it fits.
Inbound ports opened
Zero
Static IP required
No
Auth surface
Per app, per user, per device
How a tunnel actually works
A lightweight connector runs on a host inside the network: a NAS, a small VPS, a Raspberry Pi or the server you want to reach. It opens a long-lived outbound TLS connection to Cloudflare's edge. When an authorised user requests the public hostname, Cloudflare proxies the request through that outbound connection to the internal service.
- Outbound TLS only, with no inbound firewall rules
- A public hostname maps to an internal service
- TLS is terminated and re-encrypted at the edge
- It survives ISP IP changes automatically
How access is gated
The tunnel is paired with a Zero Trust policy that decides who can reach which application. Identity comes from the provider you already use: Google Workspace, Microsoft 365, GitHub, an email one-time code or a self-hosted identity provider. There is no separate VPN credential.
- Per-application access rules, not network-wide trust
- Identity provider integration (SSO, email OTP, mTLS)
- Session length and device posture controls
- An audit log of every authenticated request
Outbound tunnel. Inbound access policy.
When to use a tunnel instead of a VPN
A traditional client or site-to-site VPN puts a user on the network. A tunnel with a policy puts a user on a single application. For most modern teams the second model is what they actually want.
One engineer needs the internal Grafana. One finance lead needs the office accounting tool. The on-call engineer needs SSH to a single VM. None of them need full network reachability, and giving it to them is how lateral movement happens during a breach.
A tunnel publishes only the specific service, scopes access by identity and revokes it without touching firewall rules or VPN configuration. It also works better on mobile and on networks that block UDP. The user opens a URL and signs in.
NAS reachable, network not exposed
Identity-based, per-application access
Common scenarios this solves
The pattern fits any case where a network without a static IP needs to publish something internal. Examples we see in practice:
- Reaching a Synology or TrueNAS file server from outside the office
- Exposing a self-hosted ERP or CRM under a custom domain
- Giving a remote contractor temporary access to a single internal app
- Putting SSH behind an SSO login instead of a public IP
- Fronting a home-lab Plex or Home Assistant with an authenticated URL
- Replacing a flaky branch-office VPN with a per-app rule
In each case the network stays unreachable from the public internet. The specific service gets a clean, signed-in URL that works from any device. Running your own apps behind it? See self-hosted business tools on a VPS.
Got a service stuck behind a CGNAT?
If your ISP gives you a shared IP and refuses to forward ports, a tunnel is usually the cleanest fix. Send us the service and we will scope the setup.
Plan a tunnel deploymentSame day
Setup time for one app
Google, Microsoft, GitHub, OTP
Identity providers
Zero ports
Inbound exposure
FAQ
Remote access questions, answered
What teams ask before they put a tunnel in front of an internal service.
A free Cloudflare account covers the tunnel itself. Zero Trust access policies have a free tier that comfortably handles small teams. Paid plans add more identity provider integrations, longer log retention and higher seat counts. Most small businesses start on free and move up only when they pass the free seat limit.
2
What happens if my home or office internet goes down?
The tunnel goes down with the connection. It is a relay through your uplink, not a replacement for it. For high availability, run two connectors on two different links, for example fibre plus LTE. Cloudflare balances between them, so the tunnel stays up if either one fails.
3
Is this safer than port forwarding?
Considerably. Port forwarding exposes a service to every IP on the internet, where it is scanned within minutes. A tunnel never opens an inbound port on your router. The service is reachable only through Cloudflare's edge, and the access policy demands an authenticated identity before a request reaches your network.
4
Can I keep using my existing VPN for some things?
Yes. Tunnels usually run alongside an existing VPN, not instead of it on day one. Most teams settle on a split: the VPN stays for full-network access by trusted admins and tunnels handle per-application access for everyone else. There is no forced migration moment.
5
Will SSH and remote desktop work through a tunnel?
Yes. SSH works through a short client command that wraps the connection in the tunnel. Remote-desktop protocols such as RDP and VNC can be published as authenticated web URLs. Both sit behind the same Zero Trust policy as any other application.
6
Can I revoke access for one person quickly?
Yes, and that is one of the strongest arguments for this pattern. Revocation is a single change in the access policy. It takes effect on the next request and applies to every application the policy covers. There is no certificate to rotate, no shared VPN secret to change and no firewall rule to edit.
One service, one signed-in URL.
Tell us what is stuck behind a router with no static IP: a NAS, a self-hosted app, an internal dashboard or an SSH host. We will publish it through an authenticated URL.
Set up secure remote accessContinue exploring
Each guide stands alone, but the full picture is built from all four. Pair this with the related deep dives or jump back to the Cloud, Hosting & Infrastructure pillar.
Disaster recovery and backup solutions
Pair the access layer with backups, so that even if a host fails the data restores cleanly.
Read this guide →Domain name and professional email setup
Run the tunnels under your own domain, with proper email authentication on the same brand.
Read this guide →