Cloudflare Drops the Price of Tunnel Connections to Zero

Cloudflare is making its secure tunnel technology free for any organization. The product previously required a paid Argo Smart Routing subscription, priced by bandwidth consumption. The connection feature itself now costs nothing, though the traffic acceleration capabilities of Argo Smart Routing remain available as a paid add-on.

Along with the pricing change, Cloudflare is renaming Argo Tunnel to Cloudflare Tunnel. The rename is partly intended to reduce confusion between the two product names going forward.

Why Tunnels Exist

The core problem Cloudflare set out to solve with Tunnels was the difficulty of connecting a server to the public Internet without exposing it directly. Traditional reverse proxy setups require an origin server to accept inbound connections, which means firewall rules, access control lists and exposure to attack vectors. If an attacker discovers a real origin IP address behind a proxy, they can bypass the proxy entirely.

Cloudflare Tunnel inverts that model. A lightweight daemon called cloudflared runs on the origin server and establishes an outbound-only connection to Cloudflare's network. Because no inbound connection is opened on the origin, there is no need to poke holes in a firewall or maintain a list of Cloudflare IP addresses for validation. Only traffic routed through Cloudflare can reach the origin, which also makes it possible to enforce Zero Trust policies per-request before traffic reaches the resource.

What Changed Under the Hood

Alongside the pricing announcement, Cloudflare has been working on stability and persistence improvements to the underlying tunnel infrastructure. Earlier versions of the tunnel required both Cloudflare's control plane and data plane to be online simultaneously for reconnects to succeed. That dependency has been removed, allowing tunnels to reinitiate connections gracefully without requiring both services to be available at the same moment.

The tunnel infrastructure also migrated to Cloudflare's edge load balancer, Unimog. The migration increased the average uptime of any given tunnel connection from minutes to days.

On the persistence front, Cloudflare introduced Named Tunnels, a concept announced previously. Previously, if cloudflared restarted for any reason, the restart was treated as a brand new tunnel. That meant generating a new DNS record and establishing a fresh connection from scratch. Named Tunnels assign a permanent name to a tunnel, creating a stable relationship with its UUID. When a Named Tunnel restarts, the cloudflared instance can reference that UUID to reconnect without redoing the whole setup.

Getting Started

To put Cloudflare Tunnel to work, the workflow is relatively short:

  1. Install cloudflared on the origin machine.
  2. Create a tunnel and generate a hostname in the Cloudflare dashboard using the tunnel UUID, so users can reach the resource.
  3. Optionally, apply a Zero Trust policy with Cloudflare Access to the DNS record to restrict who can view the resource.

Cloudflare points to two primary use cases in its documentation: connecting an origin server to Cloudflare via a public hostname, and building a private network for remote access to internal applications.