Cloudflare Tunnel Costs for Home Hosting: Free vs Paid

The short answer

The tunnel can be free. Running the website is a separate cost.

Cloudflare offers free tunnels. A temporary Quick Tunnel needs no account or domain. For a fixed public hostname, plan for a Cloudflare account, a domain and a computer that stays online.

Tunnel: Free optionsQuick Tunnels for tests; named tunnels are also available on the free plan.
Domain: For your own addressPay the registrar's registration and renewal fees. A temporary preview needs no domain.
Computer & electricity: While the site is onlineYour app and the connector keep running. Include power, maintenance and backups in the budget.
Optional extras: Only when neededA VPN, paid Access features or a VPS are separate choices, not prerequisites for every tunnel.

Checked 24 September 2026. Cloudflare plans · Quick Tunnel limits

Choose your route

Start with a click or set it up yourself?

The easy way

Your tunnel. One click.

Want a tunnel without typing commands or editing configuration files? GhostlyShare automatically detects running local web apps. Click Go Public and share the HTTPS link.

Begin with GhostlyShare ↓

The manual way

Configure your own tunnel.

Prefer to manage cloudflared yourself? The Windows guide walks you through a named tunnel with your own domain, console commands and a background service.

Follow the Windows setup ↓

GhostlyShare · Windows & Linux

A Cloudflare Tunnel without the console.

GhostlyShare is the easiest way to get started in this guide. The desktop app handles the tunnel setup for you. For a temporary link, you need no console commands, configuration files or Cloudflare account.

Start your appRun your website or API locally. GhostlyShare detects reachable web apps automatically.
Click Go PublicChoose the app you want to share. Add a password or a link expiry when needed.
Send the linkCopy the HTTPS URL or scan the QR code on your phone. Keep your computer and app running.

Free temporary links. No account, email or subscription required.

Download GhostlyShare Explore the features

GhostlyShare showing a shared app with QR code, password and link controls — Choose your app. Start the tunnel. Share the link.

Temporary Quick Tunnels are for development and testing, with no uptime guarantee. Cloudflare currently limits them to 200 concurrent requests and does not support Server-Sent Events (SSE). Read the limits

What a tunnel protects

Visitors connect to Cloudflare instead of your router. With the tunnel configured correctly, your home IP remains hidden from public DNS records.

Keep your home IP private

Your domain points to Cloudflare, so a DNS lookup does not reveal your home IP.

No router port forwarding

The connection starts on your computer and goes out to Cloudflare, so hosting the website does not require port forwarding on your router.

Keep the web server local

Your app can listen on localhost while Cloudflare makes it reachable through the tunnel.

Know the limits

The tunnel conceals your home IP from visitors. Cloudflare and any VPN provider you use still have information about the connection.

Who can see what?

Using a tunnel is not the same as being anonymous. Visitors and the companies handling your connection can still learn the following about your project.

Visitors

Visitors see your public address and the content, headers and cookies your website sends.
Provided your DNS records point only to the tunnel, visitors will normally find Cloudflare's IP addresses rather than the address of your home connection.
Details you publish on the site, such as a name or contact address, can still identify you.

Cloudflare

A named tunnel remains linked to your Cloudflare account. Cloudflare also knows its domain, tunnel ID, configured addresses and whether the connection is active.
The source IP visible to Cloudflare depends on how cloudflared connects: directly, it is your home IP; through a VPN, it is the VPN server's IP.
A VPN changes that IP address. Your Cloudflare account remains associated with the named tunnel.

VPN provider

Your VPN provider can see that your device connects to Cloudflare.
Email and payment details in your VPN account can still link the account to you.
You also need to trust the VPN provider with information about your connection.

Accounts and personal details

Domain registration, payments and reused usernames can link the project to you.
Shared accounts and browser profiles can connect your admin activity with other services you use.
Check which personal details you share across the services you use. A tunnel does not remove them.

What can a visitor find out about you?

With a correctly configured tunnel, visitors connect to Cloudflare in both cases. Adding a VPN mainly changes what Cloudflare sees about the connection from your computer.

Tunnel without a VPN

Visitors normally see Cloudflare IP addresses, your public web address and what your site publishes. They do not receive your home IP simply by opening the page. Cloudflare sees your public connection IP.

Tunnel with a VPN

The visitor sees essentially the same thing. If the tunnel connection uses the VPN, Cloudflare sees the VPN exit IP. The VPN does not hide names, contact details or other clues published on your site.

Cloudflare explains how Tunnel protects the origin

How could someone connect the site to your identity?

Public clues: the same with or without a VPN: A name in your legal notice, linked profiles, reused usernames or identifying details in downloads can connect the site to you. Public domain registration data may also provide clues; personal details are often redacted. A VPN does not remove any of these traces.
ICANN: public and nonpublic domain data
An exposed IP: a clue, not a person's name: Old DNS records, other services on the same connection or information returned by your app may expose your home IP. A VPN used by cloudflared does not automatically fix those leaks. An IP alone does not reliably identify a person or an exact home address.
Provider records: not publicly accessible: Without public clues, identifying you may require nonpublic records from Cloudflare, your registrar or internet provider. With a VPN, the VPN provider may also be relevant. Access depends on the applicable disclosure process and available records; it is not a public lookup. Account or domain details may identify you without following the IP trail at all.
Cloudflare: requests for customer information

A tunnel protects your server's address. A VPN can additionally protect it from Cloudflare. Neither makes an identifiable website anonymous.

How a request reaches your website

Cloudflare receives the public request and forwards it through cloudflared to your local web server.

01 Visitor

Opens your website address and connects to Cloudflare.

02 Cloudflare

Handles HTTPS and forwards the request through the tunnel.

03 cloudflared.exe

Keeps the connection from your Windows computer to Cloudflare open.

04 Local website

Answers the request locally, without an open router port.

The same connection, with a VPN in between

The VPN sits between cloudflared on your computer and Cloudflare.

Visitor
Opens your website.
Cloudflare
Sees the VPN server IP.
VPN server
Forwards the tunnel connection.
Your home IP stays behind the VPN.
cloudflared.exe
Runs on your computer.
Local website
Answers the request.

What Cloudflare still knows when you use a VPN

A VPN can hide your public home IP if the entire tunnel connection uses it. It does not hide the following information from Cloudflare:

Connection and account: Cloudflare sees the VPN exit IP, connection times and connector ID. A named tunnel remains linked to your Cloudflare account. Cloudflare API reference
Software and system: cloudflared sends its version, operating system and CPU architecture, supported features and client ID. Registration protocol
Local network address: The protocol includes an originLocalIp field. For HTTP/2, cloudflared fills it from the local connection address. This may be a LAN or VPN adapter address; a private address such as 192.168.1.20 is not your public home IP. Local address in the source code
Tunnel configuration: For locally managed tunnels, cloudflared also sends the local forwarding configuration to Cloudflare. A VPN does not prevent this. Configuration transfer in the source code

These points are documented in Cloudflare's API and public source code. They do not prove that cloudflared bypasses a VPN to discover your public home IP. The exact behavior depends on the version and network setup.

Raspberry Pi board used as a small home hosting device

Optional hardware

A small computer for an always-on website

A Raspberry Pi or mini PC can keep your website online while your laptop is off. Plan for updates, backups and a reliable network connection.

Show on Amazon

As an Amazon Associate I earn from qualifying purchases.

What is cloudflared.exe on Windows?

On Windows, cloudflared.exe runs the tunnel between your computer and Cloudflare, passing incoming requests to your local app. A VPN is a separate service and is not replaced by this connector.

Create a reusable tunnel

Sign in to Cloudflare, create a named tunnel and assign your own address.

Keep multiple connections open

Several connections are kept open by the connector. If one fails, the others may allow the tunnel to keep working without interruption.

Connect an address to your app

Use the configuration file to forward app.example.com to http://localhost:3000.

Start manually or as a Windows service

Test in PowerShell first. Set up a Windows service if the tunnel should continue running after you sign out.

Other supported services

Cloudflare Tunnel also supports services such as SSH and RDP. This guide covers websites.

Official instructions: Cloudflare local tunnel guide and the Windows service guide.

Windows setup: cloudflared.exe step by step

Before you begin, check that your website works locally and that Cloudflare manages your domain's DNS. The instructions below connect app.example.com to a local service running on port 3000.

Use PowerShell 7 for every command below. Replace the sample hostname, tunnel name, and local service before you copy anything.

01

Step 1: define the values you will reuse

Start in PowerShell 7 and replace the sample hostname, tunnel name, and local service with your own values before you continue.

$TunnelName = "ghostly-home-site"
$PublicHostname = "app.example.com"
$LocalService = "http://localhost:3000"
$CloudflaredHome = "C:\Cloudflared\bin"
$ConfigPath = "$env:USERPROFILE\.cloudflared\config.yml"

02

Step 2: prepare cloudflared.exe

Rename the downloaded binary, create a dedicated folder for it, and copy the executable into that folder.

Rename-Item "$env:USERPROFILE\Downloads\cloudflared-windows-amd64.exe" "cloudflared.exe"
New-Item -ItemType Directory -Force $CloudflaredHome
Copy-Item "$env:USERPROFILE\Downloads\cloudflared.exe" "$CloudflaredHome\cloudflared.exe"

03

Step 3: check the installation

Move into the folder and confirm that cloudflared.exe starts cleanly before you authenticate anything.

Set-Location $CloudflaredHome
.\cloudflared.exe --version

04

Step 4: sign in and select your domain

This opens the browser so you can approve the zone. The account certificate is written into your default .cloudflared directory.

.\cloudflared.exe tunnel login

05

Step 5: create the tunnel

Create the tunnel, then paste the UUID from the command output into the variable below so the next commands can reuse it.

.\cloudflared.exe tunnel create $TunnelName
$TunnelId = "<paste-the-tunnel-uuid-from-the-create-output>"

06

Step 6: write the configuration

These commands build the local config.yml in your Windows profile so the tunnel knows which public hostname should forward to which local service.

Set-Content $ConfigPath "tunnel: $TunnelId"
Add-Content $ConfigPath "credentials-file: $env:USERPROFILE\.cloudflared\$TunnelId.json"
Add-Content $ConfigPath ""
Add-Content $ConfigPath "ingress:"
Add-Content $ConfigPath "  - hostname: $PublicHostname"
Add-Content $ConfigPath "    service: $LocalService"
Add-Content $ConfigPath "  - service: http_status:404"

07

Step 7: validate the configuration

Print the file once so you can check it, then let cloudflared validate the ingress rules before you publish DNS.

Get-Content $ConfigPath
.\cloudflared.exe tunnel ingress validate

08

Step 8: connect your domain

This tells Cloudflare which hostname should target the named tunnel before you start serving live traffic.

.\cloudflared.exe tunnel route dns $TunnelName $PublicHostname
.\cloudflared.exe tunnel info $TunnelName

09

Step 9: start and test the tunnel

Keep this PowerShell 7 window open while you test the site from another network. Stop it with Ctrl+C when you are done.

.\cloudflared.exe tunnel run $TunnelName

Optional: run the tunnel as a Windows service

First check that the tunnel works in PowerShell. Then open PowerShell 7 as administrator to install and configure the service.

01

Service step 1: install the Windows service

Open PowerShell 7 as administrator and install the Cloudflared service.

Set-Location $CloudflaredHome
.\cloudflared.exe service install

02

Service step 2: copy credentials and configuration

The Windows service runs under the system profile, so it needs its own .cloudflared folder with the certificate, tunnel credentials, and config.yml.

$SystemCloudflaredHome = "C:\Windows\System32\config\systemprofile\.cloudflared"
New-Item -ItemType Directory -Force $SystemCloudflaredHome
Copy-Item "$env:USERPROFILE\.cloudflared\cert.pem" "$SystemCloudflaredHome\cert.pem"
Copy-Item "$env:USERPROFILE\.cloudflared\$TunnelId.json" "$SystemCloudflaredHome\$TunnelId.json"
Set-Content "$SystemCloudflaredHome\config.yml" "tunnel: $TunnelId"
Add-Content "$SystemCloudflaredHome\config.yml" "credentials-file: $SystemCloudflaredHome\$TunnelId.json"
Add-Content "$SystemCloudflaredHome\config.yml" ""
Add-Content "$SystemCloudflaredHome\config.yml" "ingress:"
Add-Content "$SystemCloudflaredHome\config.yml" "  - hostname: $PublicHostname"
Add-Content "$SystemCloudflaredHome\config.yml" "    service: $LocalService"
Add-Content "$SystemCloudflaredHome\config.yml" "  - service: http_status:404"

03

Service step 3: set the configuration path and start

Set ImagePath to use the configuration in the Windows system profile, then start the service.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Cloudflared" -Name ImagePath -Value "C:\Cloudflared\bin\cloudflared.exe --config=C:\Windows\System32\config\systemprofile\.cloudflared\config.yml tunnel run"
sc.exe start cloudflared

The Windows service needs its own certificate, tunnel credentials and config.yml in the system profile. ImagePath tells it which configuration to load.

Use a VPN with your tunnel

You can run the tunnel without a VPN. If you use one to keep your home IP from Cloudflare, make sure cloudflared uses that connection and test what happens when the VPN drops.

Start the VPN before cloudflared

Check the computer's public IP before starting the tunnel. It should be the VPN server IP.

Block connections if the VPN fails

Switch on the VPN's kill switch and test it. Otherwise, a VPN outage may allow cloudflared to reconnect over your normal internet connection.

Keep the app on localhost

Bind the app to localhost where possible. Avoid opening an additional public route to the web server.

Keep connection logs private

Debug logs can contain URLs and request headers. Use them only for troubleshooting and check them before sharing.

Choose a VPN

Find a VPN that fits your setup

Compare supported devices, connection stability and kill-switch features. The direct link below is an affiliate link; the directory lists more providers.

Featured provider: Proton VPN

View provider Browse all VPN providers

If the tunnel stops, visitors normally see a Cloudflare error. Do not replace the tunnel DNS record with your home IP to work around the outage.

Check your setup

Test access from outside your network and check that the connection behaves as intended during an outage.

Check the DNS records

Look up the public DNS records. They should point to Cloudflare, not your home IP.

If using a VPN: check the IP

Check the machine's public IP first so you know what Cloudflare will see on the connector side.

Test from a different network

Test from mobile data or another external network so you are not fooled by a local routing shortcut.

If using a VPN: test a disconnect

Disconnect the VPN during a test. The kill switch should prevent cloudflared from connecting through your home IP.

Author transparency

Who writes this?

Ghostly Pseudonymous software engineer More than 15 years as a professional software engineer

GhostlyInc is written under the Ghostly pseudonym by a software engineer with completed studies in electrical engineering and computer science, plus more than 15 years of professional software engineering experience.

Background: Completed studies in electrical engineering and computer science
Method: Hands-on testing, source checks, maintainable code and clear limits before recommendations.

The real name stays private. The technical background, project work, sources, affiliate disclosures and update notes stay visible so readers can judge the content.

View author profile

FAQ

Is Cloudflare Tunnel free for home hosting?

Yes, free tunnel options are available. For a fixed hostname, budget separately for your domain, electricity and host maintenance. Paid Access features or a VPN are optional.

Do I need an account to share a preview?

Temporary GhostlyShare links require no account, email or subscription. Using your own domain is a separate setup that requires a Cloudflare account and a domain managed there.

Does a preview link stay online when I close my computer?

No. Your computer, local app and GhostlyShare must keep running. Use a named tunnel on an always-on host for an ongoing service with a fixed address.

Can visitors see my home IP?

Normally they should not if your DNS only points to Cloudflare and you have not exposed the origin in another way. Visitors reach the Cloudflare edge and the public hostname, not the residential IP behind the tunnel.

Do I need to forward a router port?

No. Your computer initiates the connection to Cloudflare. The website does not need an incoming router port.

What does Cloudflare know about me?

For a named tunnel, Cloudflare knows your account, domain and connection IP. A VPN can replace your home IP with the VPN server IP, but the account remains associated with the tunnel. Account-free Quick Tunnels still expose the connection IP to Cloudflare.

GuideCloudflare Tunnel + VPN: privacy limits clearly explained

See what Cloudflare Tunnel hides, what Cloudflare and a VPN provider can still see, and why Tunnel plus VPN improves routing privacy, not full anonymity.

GuideCloudflare Tunnel Raspberry Pi Home Server Configuration

Build a steady Raspberry Pi home server with Cloudflare Tunnel, cloudflared and systemd, then decide when GhostlyShare is the simpler route for publishing.

GuideWhat is a VPN? privacy, security, and anonymity explained

Read the network layer basics before you depend on a VPN to hide the source IP that Cloudflare sees.

GuideCheck your online fingerprint and tracking exposure

Use the fingerprint page to reduce browser-side clues that can still correlate your admin sessions.

ToolGhostlyShare: share localhost on Windows and Linux

Use the simpler desktop route when you want a public preview link without manually building the full Cloudflare workflow.

ToolGhostlyDDns: keep Cloudflare DNS records in sync

Use dynamic DNS when you choose a DNS-based self-hosting path instead of a tunnel-only setup.

ToolGhostlyHosting: deploy Blazor on an Ubuntu VPS

Use the VPS route when you prefer a public server over always-on hardware at home.

ToolGhostlyBridge: manage servers and tunnel workflows

Use the desktop server workflow when a VPS, SSH, uploads, or tunnel management fits better than home hosting.

DirectoryVPN providers worldwide: compare audits, privacy, and fit

Use the full VPN directory if you want to compare many providers before choosing one for the tunnel route.