A complete, production-ready guide for setting up Cloudflare Tunnel (Argo Tunnel) to expose local services — no port forwarding, no static IP needed.
- Cloudflare Tunnel setup on Linux (Ubuntu 24.04 optimized, but works on any distro)
- Full systemd user service with auto-start
- Support for multiple hostnames in one tunnel (e.g.
panel.mydomain.com,service.mydomain.com) - TCP fallback when QUIC/UDP is blocked by your ISP
- Domain registrar (DigitalPlat, Cloudflare) integration
- Persian-friendly troubleshooting guide
# 1. Install cloudflared
wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -O ~/cloudflared
chmod +x ~/cloudflared
mkdir -p ~/.local/bin && mv ~/cloudflared ~/.local/bin/cloudflared
# 2. Login (opens browser for authorization)
cloudflared tunnel login
# 3. Create tunnel
cloudflared tunnel create my-tunnel
# 4. Write config
cat > ~/.cloudflared/config.yml <<'EOF'
tunnel: <TUNNEL-UUID>
credentials-file: /home/user/.cloudflared/<TUNNEL-UUID>.json
ingress:
- hostname: myhost.mydomain.com
service: http://127.0.0.1:8080
- service: http_status:404
EOF
# 5. Route DNS
cloudflared tunnel route dns my-tunnel myhost.mydomain.com
# 6. Test
cloudflared tunnel run my-tunnelcloudflare-tunnel/
├── SKILL.md # Full setup guide + pitfalls
└── references/
└── panel-proxy-routes.md # Routing multiple services through one tunnel
- TCP-only fallback when QUIC is blocked by ISP
- Multiple hostnames per tunnel (ordered ingress rules)
- systemd user service — no root required
- Linger enabled — survives logout/reboot
- DigitalPlat FreeDomain nameserver configuration included
| Error | Fix |
|---|---|
| Error 1033 | Force TCP mode in config.yml |
| CNAME already exists (1003) | Delete stale tunnel, recreate with new name |
| Tunnel login fails | Keep browser open until cert.pem downloads |
| ISP blocks port 443 | Use protocol: tcp in config.yml |
MIT — free to use, modify, and distribute.