EXPOSE your home network to the INTERNET!! (it's safe)

Exposing a home network to the public internet can be done without opening firewall ports or punching holes through the router. The approach uses Cloudflare Tunnel to create an outbound, secure tunnel from a device inside the home network to Cloudflare, then maps public subdomains to internal services—each with HTTPS and its own SSL certificate. The result is remote access to things like a website, Proxmox, or a NAS from anywhere, even when the home connection uses restrictive setups such as CGNAT.

Instead of configuring a reverse proxy like Nginx or forwarding ports 80/443 to internal IPs, the setup relies on Cloudflare’s Zero Trust “tunnels” feature. Every exposed service gets a dedicated subdomain under the user’s domain, and Cloudflare handles encryption so the home device doesn’t need to manage public-facing certificates. Even if the internal service uses self-signed certificates, Cloudflare can be configured to skip TLS verification for that upstream, allowing internal apps to work without reissuing certificates.

The setup requires only a domain name, plus a computer or server already running inside the home network. The domain can be purchased from any registrar; the walkthrough uses Google Domains as an example, costing roughly $12 per year. On the internal server, Cloudflare Tunnel is installed using the appropriate package for the environment—Docker is highlighted as a convenient option. After installation, the tunnel connects outward to Cloudflare, meaning the home firewall typically doesn’t need inbound rules.

A Cloudflare account is then created, the domain is added as a site, and Cloudflare name servers are configured at the registrar so DNS points to Cloudflare. From there, the Zero Trust dashboard is used to create a tunnel on a free plan (the interface still prompts for a $0 payment step). Once the tunnel is active, the user routes public hostnames to internal services by specifying the service type (for example, HTTPS for Proxmox) and the internal private IP and port.

In the example, Proxmox is mapped to a subdomain like proxmox.<domain>, pointing to an internal address such as 10.77.73.8 on port 8006. For Proxmox instances using self-signed certs, the configuration can disable TLS verification so the tunnel still connects cleanly. Testing from outside the home network confirms that the Proxmox web interface loads properly and that remote clients can access the same services without any direct exposure of the home network.

The same tunnel can route additional services. A NAS is added by creating another hostname (for example, nas.<domain>) mapped to the NAS’s internal IP and port (such as 5001) with TLS verification disabled if needed. With multiple services attached to one tunnel, Cloudflare provides the “public” layer—subdomains, HTTPS, and certificate handling—while the home network stays insulated from direct inbound traffic. The overall takeaway is a streamlined, certificate-friendly, firewall-light method for publishing home-hosted services securely to the internet.