Preface

The free CDN solution provided by Cloudflare for individuals works very well everywhere except in China. However, because Cloudflare normally only accepts second-level domains via NS access, and requires specifying a public IP address when setting up DNS (dynamic public IP does not affect this, as the A record of Cloudflare DNS settings can be updated in real-time via API; whether ports 80 and 443 are available is also not important, as non-standard origin ports can be set via Origin Rules), this is very unfriendly to friends without a public IP (which is the case for most home broadband).

But does having no public IP and no HTTPS port 443 mean you can't get Cloudflare for free?

Of course not. As mentioned, that's under normal circumstances. So how do you get Cloudflare for free under abnormal circumstances? This relies on Cloudflare's Tunnel technology. In fact, the so-called tunnel is to install a ”connector” in your site's ”local” network, thereby logically connecting your local network and Cloudflare ”directly”, which is the same principle as the old VPN. In this way, Cloudflare can directly access the sites in your local network, thereby avoiding the various unfavorable network conditions mentioned above: regardless of whether there is a public IP, whether there is port 443, or which domestic operator's home broadband or cloud provider's cloud host you use, you can directly use Cloudflare to build a website.

Deployment

(Optional) Activate the Free plan of Zero Trust

If you have not used the Zero Trust feature before, you need to initialize it for the first use. Click on Zero Trust in the red box in the figure below:

You can fill in the Team name in the red box in the figure below as you like:

Select the Free plan:

Add a payment method, dual-currency credit card is recommended:

Fill in credit card information (verification only, no charge) to complete the configuration

Create a tunnel

Click the Create a tunnel button in the red box in the figure below:

I plan to deploy this tunnel on a Tencent Cloud Lighthouse server, so I named the tunnel tencentcloud, and then click the save tunnel button in the red box in the bottom right corner:

Choose deployment method

Cloudflare's tunnel supports multiple environments: Windows, Mac, Debian, Red Hat, and Docker. You can choose according to your actual situation. I chose the Docker method. Actually, the Debian method also works, as my Tencent Cloud Lighthouse server is Debian, but the Docker method is cleaner and easier to maintain, which is my preferred method:

Copy the command in the red box in the figure above first. This command is incomplete and needs content added. The complete one is in the next section.

Create the Docker version of Cloudflare Connector on Tencent Cloud Lighthouse server

As a convention, first create the directory on the Tencent Cloud Lighthouse server that needs to be mapped into the container

mkdir -p /docker/cloudflare/data

Create the Docker version of the connector:

docker run --name cloudflare -d --restart=always \
-v /docker/cloudflare/data:/etc/cloudflared \
cloudflare/cloudflared:latest tunnel --no-autoupdate run --token xxxxxx

-v /docker/cloudflare/data:/etc/cloudflared \

Configure domain name and application URL

cloudflare/cloudflared:latest tunnel --no-autoupdate run --token xxxxxx

Please note that compared to the one copied from Cloudflare, the above command mainly adds the content of the first and second lines. If the -v parameter in the second line is not added, the status of my Cloudflare connector will be abnormal. The normal status of the connector is as follows:

On the Tunnel interface, select configure in the rightmost red box of the tencentcloud you just created:

Select in sequence: "Public Hostname" - "Public hostnames":
The following interface appears:
The 4 red boxes are the content we need to fill in. Assuming our domain name on Cloudflare is example.com, and the host we want to add is www, and the corresponding intranet IP address of the Tencent Cloud server is 10.0.0.3 (do not directly use the public IP of the cloud server, because the public IP of the cloud server is implemented through mapping, the server itself is a private address, and do not use 127.0.0.1, so you can only use the intranet IP address of the server), and the site port is 80, the information filled in is as follows:
Subdomain:www
Domain:example.com

Type :http

URL:10.0.0.3:80

Type uses the HTTP protocol, because Cloudflare will automatically provide HTTPS access to the outside.

If the Docker version of the connector is installed in the home broadband intranet, the URL can directly use the intranet address and port of the intranet site.
In fact, the result of this configuration is that an additional CNAME record with the host name www is added to the DNS of this domain name, and its record value is the tunnel ID of the tunnel:

Access

Similarly, multiple applications can be added.https://www.example.comNote: If the application specified by the URL above binds a host name, for example, if the application is Nginx and the site specifies server_name, then you need to add the corresponding domain name in Nginx's server_name according to the domain name configured earlier, which is www.example.com in the above example, otherwise it cannot be accessed normally.