The Most Elegant Homelab Remote Access Solution: Cloudflare Tunnel Zero Trust in Practice

Securely access your home ESXi and vCenter from the external network, without needing a public IP, without opening ports, and with just a domain name.

Why is such a solution necessary?

In Homelab practice, a very practical need is:How can you securely access your home server when you are not at home?

Traditional approaches usually involve:

• DDNS + Port Forwarding: Ports need to be opened on the router, which carries certain security risks.

• VPN server: Requires configuring WireGuard/OpenVPN, which has certain requirements for the network environment.

• Intranet penetration service: Usually requires installing a client and depends on third-party services.

What I want to share this time is a solution that is more elegant, safer, and more aligned with modern web security principles—Cloudflare Tunnel.

What can this solution do?

• Secure access to ESXi:https://esxi.your-domain.com Home ESXi management interface

• Secure access to vCenter:https://vcenter.your-domain.com The vCenter interface at home

• Scalable: To add services such as GitLab and K8s Dashboard in the future, you only need to add one rule line in the configuration file.

Brief Analysis of the Solution Principle

Cloudflare Tunnel will establish a connection between your home server and Cloudflare edge nodes.Encrypted, persistent tunnel When external users access via the domain name, requests first reach Cloudflare edge nodes and are then securely forwarded to your internal network service through this tunnel.

The overall architecture is as follows:

• Run a lightweight daemon on the Homelab at home (cloudflared), actively connect to Cloudflare edge nodes.

• External users access your domain (e.g.esxi.your-domain.com), DNS resolution points to Cloudflare.

• Cloudflare edge nodes forward requests through an encrypted tunnel to the internal network's cloudflared.

• cloudflared Forward the request to the corresponding intranet service (such as ESXi's 192.168.0.201:443).

• The response data is returned along the original path and is encrypted end to end.

Preparations

Before you begin, make sure you have the following:

Condition	Explanation
Cloudflare account	The domain you own is already hosted on Cloudflare.
A Linux virtual machine	Used for running cloudflared Daemon (e.g., Ubuntu 22.04 LTS)
Intranet service information	IP addresses and ports for services such as ESXi and vCenter

Deployment steps

Step 1: Install on the Linux virtual machine cloudflared

Log in to your Linux virtual machine (e.g.k8s-infra-224), execute the following command:

# Download and install cloudflared
wget -q https://github.com/cloudflare/cloudflared/releases/download/2026.7.2/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

# Verify installation
cloudflared --version

Step 2: Authenticate and bind the domain name

cloudflared tunnel login

After the command is executed, an authorization link will be returned. Open the link in your browser, select your Cloudflare domain, and complete the authorization.

Prompt: After successful authorization,cloudflared will generate one in your virtual machine cert.pem Certificate file, used for subsequent identity verification.

Step 3: Create a tunnel and configure access rules

3.1 Create a Tunnel

# Create a tunnel named homelab
cloudflared tunnel create homelab

After execution, one will be generated.Tunnel UUID and a credentials file (such as <Tunnel UUID>.json), please keep it safe.

3.2 Configure Tunnel Routing Rules

Create a configuration file in the virtual machine ~/.cloudflared/config.yml:

tunnel: <你的 Tunnel UUID>   # Replace with the UUID just generated
credentials-file: /root/.cloudflared/<Tunnel UUID>.json

ingress:
  # Point esxi.your-domain.com to the ESXi management interface
  - hostname: esxi.your-domain.com
    service: https://192.168.0.201:443
    originRequest:
      noTLSVerify: true       # ESXi uses a self-signed certificate; verification must be skipped.

  # Point vcenter.your-domain.com to the vCenter management interface
  - hostname: vcenter.your-domain.com
    service: https://192.168.0.202:443
    originRequest:
      noTLSVerify: true

  # Default rule: other requests return 404
  - service: http_status:404

3.3 Configure DNS Records

Run the following command to point the domain to your tunnel:

cloudflared tunnel route dns homelab esxi.your-domain.com
cloudflared tunnel route dns homelab vcenter.your-domain.com

This step will automatically add a CNAME record in Cloudflare DNS pointing to your tunnel. After configuration is complete, you need to wait 1-2 minutes for DNS to take effect.

3.4 Running tunnel

cloudflared tunnel run homelab

If everything is normal, you can access it in your browser https://esxi.your-domain.com, see the ESXi login screen.

3.5 Configure as a system service (persistent operation)

If you want the tunnel to keep running persistently in the background, you can cloudflared Install as a system service:

sudo cloudflared service install

Access Process Instructions

• You access it in an external network browser https://esxi.your-domain.com.

• DNS resolution points to Cloudflare edge nodes.

• Cloudflare edge nodes forward requests to your home's through an established encrypted tunnel.cloudflared Daemon process.

• cloudflared Forward the request to the ESXi IP on the internal network (192.168.0.201).

• The response data returns along the original path, and the entire transmission process is accelerated through Cloudflare's global network.

The advantages of this plan

Characteristic	Description
No ports need to be opened.	No need to configure any port forwarding on the router, reducing the risk of being scanned and attacked.
Automatic HTTPS	Cloudflare automatically provides SSL certificates and supports forcing HTTPS access.
Zero Trust Architecture	Combined with Cloudflare Zero Trust, you can add access policies (such as email verification codes).
Extensible	To add a new service, you only need to config.yml of ingress Add a new line in
Stable and reliable	Even if your public IP changes, the tunnel will automatically rebuild.
Free quota	Cloudflare Tunnel is completely free for Homelab users.

Some points to note

• TLS verification:noTLSVerify: true It is necessary because ESXi and vCenter use self-signed certificates. This does not reduce security because the tunnel itself is already encrypted.

• Delay: All traffic passes through Cloudflare edge nodes, adding tens to one hundred milliseconds of latency, which is acceptable for administrative access.

• Free traffic Cloudflare Tunnel itself is free, but it has reasonable traffic limits. For Homelab management access, it is almost impossible to hit them.

Extension: Add more services

Assuming you subsequently deployed GitLab (http://172.16.0.10:80), simply in config.yml of ingress Add to:

  - hostname: gitlab.your-domain.com
    service: http://172.16.0.10:80

Then execute cloudflared tunnel route dns homelab gitlab.your-domain.com, just restart the tunnel.

Testing and Validation

• Local test: Execute within the virtual machine curl https://esxi.your-domain.com -k, confirm that a response can be returned.

• External network test: Turn on the 5G network on the phone, turn off WiFi, and access https://esxi.your-domain.com, verify whether the ESXi login page can be opened normally.

• View logs:cloudflared tunnel run homelab It outputs request logs in real time, making it easier to troubleshoot problems.

Conclusion

Now, your domain has become a private dedicated channel to your Homelab. Wherever you are, as long as the network is reachable, you can securely access ESXi, vCenter, and any services you want to expose at home.

The core value of this solution lies in:It transforms the question of how to securely expose internal services from an operations mindset of opening ports and configuring firewalls into a modern security mindset of identity- and domain-based zero-trust access. I hope this practice record can provide you with some reference.

Appendix: Reference for Related IP Addresses

• ESXi management address:https://192.168.0.201

• vCenter management address:https://192.168.0.202

• Linux virtual machine (running cloudflared):172.16.0.224