Tunnel with firewall
You can implement a positive security model with Cloudflare Tunnel by blocking all ingress traffic and allowing only egress traffic from cloudflared. Only the services specified in your tunnel configuration will be exposed to the outside world.
Ports
The parameters below can be configured for egress traffic inside of a firewall.
Required for tunnel operation
cloudflared connects to Cloudflare’s global network on port 7844. To use Cloudflare Tunnel, your firewall must allow outbound connections to the following destinations on port 7844 (via UDP if using the quic protocol or TCP if using the http2 protocol).
| Destination | Port | Protocols | Notes |
|---|---|---|---|
region1.v2.argotunnel.com | 7844 | TCP/UDP (http2/quic) | |
region2.v2.argotunnel.com | 7844 | TCP/UDP (http2/quic) | |
cftunnel.com | 7844 | TCP/UDP (http2/quic) | Only required for firewalls that enforce SNI. |
h2.cftunnel.com | 7844 | TCP (http2) | Only required for firewalls that enforce SNI. |
quic.cftunnel.com | 7844 | UDP (quic) | Only required for firewalls that enforce SNI. |
Optional
Opening port 443 enables some optional features. Failure to allow these connections may prompt a log error, but cloudflared will still run correctly.
| Destination | Port | Protocol | Description |
|---|---|---|---|
api.cloudflare.com | 443 | TCP (HTTPS) | Allows cloudflared to query if software updates are available. |
update.argotunnel.com | 443 | TCP (HTTPS) | Allows cloudflared to query if software updates are available. |
<your-team-name>.cloudflareaccess.com | 443 | TCP (HTTPS) | Allows cloudflared to validate the Access JWT. Only required if the access setting is enabled. |
pqtunnels.cloudflareresearch.com | 443 | TCP (HTTPS) | Allows cloudflared to report post-quantum key exchange errors to Cloudflare. |
Firewall configuration
Cloud VM firewall
If you host your services on a Virtual Machine (VM) instance by a Cloud provider such as Google Cloud Platform (GCP), you may set up instance-level firewall rules to disallow all ingress traffic and allow only egress traffic. For example, on GCP, you may delete all ingress rules, leaving only the relevant egress rules. This is because GCP’s firewall defaults to “Block” unless a rule explicitly allows certain traffic.
OS firewall
Alternatively, you may also use operating system (OS)-level firewall rules to disallow all ingress traffic and allow only egress traffic. For example, if your server runs on Linux, you may use iptables to set up firewall rules. Most Linux distributions are pre-installed with iptables. Note that in the example below, not all ingress traffic is blocked, just in case that the server is hosted on the Cloud and there would be no way to SSH back into the system again if the settings were configured wrongly.
Check your current firewall rules.
$ sudo iptables -LAllow
localhostto communicate with itself.$ sudo iptables -A INPUT -i lo -j ACCEPTAllow already established connection and related traffic.
$ sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTAllow new SSH connections.
$ sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPTDrop all other ingress traffic.
$ sudo iptables -A INPUT -j DROPAfter setting the firewall rules, use this command to check the current
iptablessettings:$ sudo iptables -L
Run your tunnel and check that all configured services are still accessible to the outside world via the tunnel, but not via the external IP address of the server.
You can also:
Test connectivity
Test with dig
To test your connectivity to Cloudflare, you can use the dig command to query the hostnames listed above. Note that cloudflared defaults to connecting with IPv4.
$ dig A region1.v2.argotunnel.com...;; ANSWER SECTION:region1.v2.argotunnel.com. 86400 IN A 198.41.192.167region1.v2.argotunnel.com. 86400 IN A 198.41.192.67region1.v2.argotunnel.com. 86400 IN A 198.41.192.57region1.v2.argotunnel.com. 86400 IN A 198.41.192.107region1.v2.argotunnel.com. 86400 IN A 198.41.192.27region1.v2.argotunnel.com. 86400 IN A 198.41.192.7region1.v2.argotunnel.com. 86400 IN A 198.41.192.227region1.v2.argotunnel.com. 86400 IN A 198.41.192.47region1.v2.argotunnel.com. 86400 IN A 198.41.192.37region1.v2.argotunnel.com. 86400 IN A 198.41.192.77...$ dig AAAA region1.v2.argotunnel.com...;; ANSWER SECTION:region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::1region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::2region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::3region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::4region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::5region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::6region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::7region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::8region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::9region1.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a0::10...$ dig A region2.v2.argotunnel.com...;; ANSWER SECTION:region2.v2.argotunnel.com. 86400 IN A 198.41.200.13region2.v2.argotunnel.com. 86400 IN A 198.41.200.193region2.v2.argotunnel.com. 86400 IN A 198.41.200.33region2.v2.argotunnel.com. 86400 IN A 198.41.200.233region2.v2.argotunnel.com. 86400 IN A 198.41.200.53region2.v2.argotunnel.com. 86400 IN A 198.41.200.63region2.v2.argotunnel.com. 86400 IN A 198.41.200.113region2.v2.argotunnel.com. 86400 IN A 198.41.200.73region2.v2.argotunnel.com. 86400 IN A 198.41.200.43region2.v2.argotunnel.com. 86400 IN A 198.41.200.23...$ dig AAAA region2.v2.argotunnel.com...;; ANSWER SECTION:region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::1region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::2region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::3region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::4region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::5region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::6region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::7region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::8region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::9region2.v2.argotunnel.com. 86400 IN AAAA 2606:4700:a8::10...$ dig api.cloudflare.com...;; ANSWER SECTION:api.cloudflare.com. 41 IN A 104.19.193.29api.cloudflare.com. 41 IN A 104.19.192.29...$ dig update.argotunnel.com...;; ANSWER SECTION:update.argotunnel.com. 190 IN A 104.18.32.167update.argotunnel.com. 190 IN A 172.64.155.89... Test with PowerShell
On Windows, you can use PowerShell commands if dig is not available.
To test DNS:
PS C:\Windows\system32> Resolve-DnsName -Name _v2-origintunneld._tcp.argotunnel.com SRV
Name Type TTL Section NameTarget Priority Weight Port---- ---- --- ------- ---------- -------- ------ ----_v2-origintunneld._tcp.argotunnel.com SRV 112 Answer region2.v2.argotunnel.com 2 1 7844_v2-origintunneld._tcp.argotunnel.com SRV 112 Answer region1.v2.argotunnel.com 1 1 7844To test ports:
PS C:\Cloudflared\bin> tnc region1.v2.argotunnel.com -port 443
ComputerName : region1.v2.argotunnel.comRemoteAddress : 198.41.192.227RemotePort : 443InterfaceAlias : EthernetSourceAddress : 10.0.2.15TcpTestSucceeded : TruePS C:\Cloudflared\bin> tnc region1.v2.argotunnel.com -port 7844
ComputerName : region1.v2.argotunnel.comRemoteAddress : 198.41.192.227RemotePort : 7844InterfaceAlias : EthernetSourceAddress : 10.0.2.15TcpTestSucceeded : True