One thing to keep in mind when using CF tunnels is that Cloudflare can see all of your server’s traffic. If your goal is privacy I recommend staying away

I admit there is a level of trust needed in cloudflare, but I also need to trust the container makers, and the hardware manufacturers as well. I use cloudflare with O365 and jumpcloud for my auth sources and I’ve been thrilled. Different policies by subdomain, works great.

Cloudflare tunnels being unsafe for exposing your locally hosted services to the web

That’s the pout of Cloudflare Tunnels. It’s a reverse proxy.

Cloudflare Auth (zero trust) can lock down the tunnel so only certain people can access it.

I want to clarify something though. Cloudflare Tunnels IS SAFE. But if you choose to use it in a not safe way that’s not the fault of the tunnel.

It’s like putting on a bicycle helmet and then running on the freeway and wondering why your leg gets broken after getting hit by a car.

“but I was wearing my helmet” great, but that wasn’t the point of the helmet.

We use cloudflare tunnels in production for massive workloads at FiveM/Cfx.re, I can with 100% confidence say that I trust in it.

Only caveat is that if you have rapid scaling, CF might accidentally route to a non existent tunnel, and if that doesn’t resolve itself you will have to recreate it.

But this has only been an issue if you force shutdown some of the cloudflared instances. And only very intermittently, reproducing it has been difficult.

Cloudflare is as safe as you design it to be. Once you’re tunnel is set up, you configure and access app and set up whatever rules you want. For me personally, for ultra protected stuff like my proxmox management I require warp to be in use and then an email MFA code. Along of course with my proxmox login.

How exactly are Cloudflare tunnels “unsafe”? And what makes you think VPNs are a better option?

I’ve used CF quite a lot and the major downside is that you have to have decent authn/authz on at least one end of your tunnel but CF does not necessarily provide this. VPNs provide authn but not necessarily authz depending on the setup. In either case, how you set up and manage identities and credentials is key.

The best way to achieve this depends entirely on what applications you are exposing and what options they give you for identity management.

This is basically my config:

wireguard:
    container_name: wireguard
    image: weejewel/wg-easy
    volumes:
      - ./data/wiregaurd:/etc/wireguard
    environment:
      - WG_DEFAULT_DNS=192.168.10.3
      - WG_HOST=public.example.com
    env_file:
      - ./env/wg-easy.secrets
    ports:
      - 51820:51820/udp
      - 51820:51820/tcp
    expose:
      - 51821
    restart: always
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    depends_on:
      - pihole
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

In my case, I reverse proxy port 51821 through caddy to configure clients (with Authelia in front of it), but you could expose it interally only if you want to prevent that interface from being publicly accessible.

Note that public.example.com needs to be replaced with your connection’s public dns hostname (you can use something like duckdns for this if you want), and that you need to expose 51820 on your firewall/router. In my example above, 192.168.10.3 is the IP for pihole, and resolves some internal hostnames. You should look over the config provided once you set up a client and make sure it uses accessible hostnames, etc.

I don’t think there’s any specific reason to worry about using cloudflare tunnels over any other VPN solution, and if your connection uses NATCG, you might actually need something that tunnels out to a central hub.