Expose Local Services to the Public Internet via Cloudflare Tunnel

Recently I suddenly wanted to be able to view the files on my computer from my phone. After searching around, everything said you need a public IP address, which is definitely not acceptable for a free-rider like me. In the end I successfully found a tool provided by the cyber-Buddha Cloudflare.

Thanks to xiaoyuboi/cloudflare-tunnel-skill↗ for providing the approach and direction — you can directly import this skill into Claude to help you complete it. The following is just a write-up of my own notes.

I. Overall Architecture

Traffic Flow

1
External user → https://your-domain
2
  → Cloudflare edge node (HTTPS termination, CDN caching)
3
    → Cloudflared encrypted tunnel (QUIC / HTTP2)
4
      → Local 127.0.0.1:port (any local HTTP service)

Core idea: Run a local HTTP service (file browsing, API, website, anything), expose it to the public internet through a Cloudflared tunnel, and let Cloudflare handle HTTPS, CDN, and DDoS protection.

Example in This Article

For ease of demonstration, I wrote a file manager in Python that supports directory navigation and previous/next switching. Readers can replace it with any HTTP service (Node.js, Nginx, a cloud-drive app, etc.).

Tip: In the AI era, if there’s something you don’t know, just ask AI to help you complete it or assist you.

Here I use the fixed-domain approach (named tunnel cloudflared tunnel run <name>), which differs from the temporary domain (quick tunnel trycloudflare.com): a named tunnel requires completing the initialization in Section III first (tunnel create + route dns), and then every startup uses the same domain. If you want a temporary domain automatically assigned on each startup, you can use the tunnel_helper.py quick subcommand in the same directory. The VBS script in this article is designed for the fixed-domain approach. For Cloudflare DNS resolution and similar topics, you can refer to the earlier blog creation article. You can skip the parts about DNS configuration (like the one Vercel provides) directly — no problem.

II. Prerequisites

• Python 3: For running the local service
• Cloudflared↗: Download and install, no UI. Verify with cloudflared --version in the command line
• Domain DNS already hosted on Cloudflare and active
• Recommended: In the Cloudflare panel, SSL/TLS → Full, enable “Always Use HTTPS”

III. Tunnel Initialization (First Time Only)

Use CMD and run the following in order:

1
:: Log in to Cloudflare to authorize (opens a browser)
2
cloudflared tunnel login
3

4
:: Create a tunnel, name it as you like (here called pictures)
5
cloudflared tunnel create pictures
6

7
:: Bind a subdomain to the tunnel
8
cloudflared tunnel route dns pictures your-subdomain.your-domain

After completion, a tunnel credential JSON will be generated under %USERPROFILE%\.cloudflared\, which will be used automatically on subsequent tunnel startups — no need to upload it to the Cloudflare console.

IV. Local Service

You need to run an HTTP service locally listening on 127.0.0.1; it can be any program:

1
:: Simplest static file server
2
py -m http.server 3000 --bind 127.0.0.1 --directory F:\share
3

4
:: Or any local HTTP service
5
node server.js
6
nginx -c ...

In practice, it is recommended to write your own service program, since this lets you add:

• Range request support (video scrubbing / fast-forward)
• ETag / cache headers (reduce redundant transfers)
• Streaming (large files won’t blow up memory)

The gallery_server.py included with this article implements the optimizations above, and also provides a file manager interface with directory navigation.

V. Configuration File

Centralize the mutable parameters into config.json, so you don’t need to touch the script code when changing the port, directory, or domain:

1
{
2
  "root_dir": "F:\\share",
3
  "port": 3000,
4
  "bind": "127.0.0.1",
5
  "public_url": "https://your-subdomain.your-domain"
6
}

The Python server exposes config values through the --get <key> subcommand, and the VBS script reads them dynamically via WshShell.Exec:

1
py gallery_server.py --get port
2
:: Output: 3000
3

4
py gallery_server.py --get running
5
:: Output: 1 (running) or 0 (not running)
6

7
py gallery_server.py --kill
8
:: Precisely terminate the process via PID file

After the service starts, it writes server.pid under .cloudflare-tunnel\ for status detection and precise termination, avoiding the uncertainty of relying solely on port-based killing.

VI. Startup Script StartAll.vbs

This is the fixed-domain (named tunnel) approach. The script starts the pre-created named tunnel via cloudflared tunnel run pictures, using --config to specify the in-project pictures.yml config file, with the domain fixed and unchanged. If you want a trycloudflare.com temporary domain assigned automatically on each startup, please use the tunnel_helper.py quick subcommand.

When saving, choose ANSI (GBK) encoding, otherwise Chinese popups will be garbled.

1
Option Explicit
2
Dim WshShell, fso
3
Set WshShell = CreateObject("WScript.Shell")
4
Set fso = CreateObject("Scripting.FileSystemObject")
5
Dim BasePath, port, publicUrl, configPath, cloudflaredExe
6
BasePath = fso.GetParentFolderName(WScript.ScriptFullName)
7
configPath = BasePath & "\.cloudflare-tunnel\pictures.yml"
8

9
' Read parameters from the config file
10
Function GetConfig(key)
11
    Dim ex, val
12
    Set ex = WshShell.Exec("py """ & BasePath & "\gallery_server.py"" --get " & key)
13
    val = ex.StdOut.ReadLine()
14
    Set ex = Nothing
15
    GetConfig = val
16
End Function
17

18
port = GetConfig("port")
19
publicUrl = GetConfig("public_url")
20
cloudflaredExe = GetConfig("cloudflared_path")
21
If cloudflaredExe = "" Then cloudflaredExe = "cloudflared"
22

23
' Step 1: Kill leftover processes
24
WshShell.Run "cmd /c for /f ""tokens=5"" %a in ('netstat -ano ^| findstr /R ""TCP.*:" & port & "[ ].*LISTENING""') do taskkill /f /pid %a /t >nul 2>&1", 0, True
25
WshShell.Run "taskkill /f /im cloudflared.exe /t >nul 2>&1", 0, True
26
WScript.Sleep 1200
27

28
' Step 2: Start the local service (background, silent, no window)
29
WshShell.Run "py """ & BasePath & "\gallery_server.py""", 0, False
30

31
' Step 3: Wait for the service to be ready (poll PID file + process liveness check, max 15 seconds)
32
Dim maxWait, waited, running
33
maxWait = 15
34
waited = 0
35
Do While waited < maxWait
36
    WScript.Sleep 1000
37
    waited = waited + 1
38
    running = GetConfig("running")
39
    If running = "1" Then Exit Do
40
Loop
41

42
If running <> "1" Then
43
    WshShell.Popup "Gallery server startup timed out (" & maxWait & " sec)", 10, "Startup failed", 16
44
    WScript.Quit 1
45
End If
46

47
' Step 4: Start the named tunnel (fixed domain, read the in-project pictures.yml config)
48
WshShell.Run """" & cloudflaredExe & """ --config """ & configPath & """ --no-autoupdate --protocol quic tunnel run pictures", 0, False
49

50
' Step 5: Popup notification
51
Dim msgText
52
msgText = "Local service & Cloudflare tunnel running in background" & vbCrLf & _
53
          "Access URL: " & publicUrl & vbCrLf & _
54
          "Run StopAll.vbs to stop"
55
WshShell.Popup msgText, 8, "Startup successful", 64
56

57
Set WshShell = Nothing
58
Set fso = Nothing

Startup Flow

Key Parameter Explanation

VII. Stop Script StopAll.vbs

1
Option Explicit
2
Dim WshShell, fso
3
Set WshShell = CreateObject("WScript.Shell")
4
Set fso = CreateObject("Scripting.FileSystemObject")
5
Dim BasePath, port, exec
6
BasePath = fso.GetParentFolderName(WScript.ScriptFullName)
7

8
' Read the port from the config file
9
Set exec = WshShell.Exec("py """ & BasePath & "\gallery_server.py"" --get port")
10
port = exec.StdOut.ReadLine()
11
Set exec = Nothing
12

13
' Step 1: Precisely terminate gallery_server via PID file (preferred, no accidental kills)
14
WshShell.Run "py """ & BasePath & "\gallery_server.py"" --kill", 0, True
15

16
' Step 2: Fallback — kill leftovers by port (in case the PID file was accidentally deleted)
17
WshShell.Run "cmd /c for /f ""tokens=5"" %a in ('netstat -ano ^| findstr /R ""TCP.*:" & port & "[ ].*LISTENING""') do taskkill /f /pid %a /t >nul 2>&1", 0, True
18

19
' Step 3: Close all Cloudflared tunnel processes
20
WshShell.Run "taskkill /f /im cloudflared.exe /t >nul 2>&1", 0, True
21

22
WScript.Sleep 400
23
WshShell.Popup "All services have been stopped", 3, "Stop successful", 64
24

25
Set WshShell = Nothing
26
Set fso = Nothing

The stop uses a three-layer safeguard:

Files in the folder after running theoretically

VIII. Tunnel Config File pictures.yml

A named tunnel needs a config file specifying the ingress rules (which domain → which local address):

1
tunnel: pictures
2
credentials-file: C:\Users\your-username\.cloudflared\<tunnel-id>.json
3

4
ingress:
5
  - hostname: your-subdomain.your-domain
6
    service: http://127.0.0.1:3000
7
  - service: http_status:404

credentials-file is the path to the credential file generated by cloudflared tunnel create in Section III. If not specified, Cloudflared will try to find it automatically, but specifying it explicitly is more reliable.

IX. Appendix: File Manager gallery_server.py

This article includes a Python file manager that can serve as a starting point for your local service or be used directly:

Features:

• Directory navigation (breadcrumb path + ”..” to go up one level)
• Display all file types (folders, images, videos, documents, etc.)
• Folders sorted first; click to enter a subdirectory
• Media files (images/videos) click to enter a fullscreen viewer, support previous/next switching, X in the top-right to close
• Non-media files click to download directly; Content-Disposition header ensures the browser saves with the correct filename and extension
• Keyboard ← → to switch, Esc to return to the list
• Mobile swipe to switch
• Adjacent files auto-preload (prefetch), switching is virtually instant

Operations features:

• PID file: Written to .cloudflare-tunnel\server.pid on startup, automatically cleaned up on shutdown
• --get running: Detect whether the process is alive (on Windows, query the handle via OpenProcess)
• --kill: Precisely terminate the process via PID file; StopAll.vbs prefers this method
• Port-in-use protection: On bind failure, print a clear error message and suggest the --kill command

Performance optimizations:

• HTTP Range request (206 Partial Content): video can be scrubbed / fast-forwarded
• ETag + Last-Modified: Browser cache validation; unchanged files return 304
• Streaming: Read in 64KB chunks, never load the whole file into memory
• Cache-Control: Media files cached for 1 hour

Custom favicon: Place favicon.ico in the same directory as the script; it takes effect automatically, no code change needed.

Generality: gallery_server.py is just a sample local service. Replace it with any HTTP program listening on 127.0.0.1:port, and the VBS scripts and tunnel config don’t need to change.

X. FAQ

1. StopAll.vbs can’t close the process

Symptom: After running StopAll.vbs, the Python process and Cloudflared are still running.

Root cause: The widely-circulated tokens=-1 is invalid for /f syntax (CMD doesn’t support negative indices to take the last column); it silently falls back to tokens=1, extracting TCP instead of the PID. Also, %%a is only valid in .bat files; in cmd /c command-line mode you must use %a.

Fix: tokens=5 + %a. (The script above already uses the correct syntax)

2. VBS Chinese popup shows garbled text

Root cause: The file is encoded as UTF-8, but the VBScript engine reads it according to the system ANSI code page (GBK on Chinese Windows).

Fix: Use Notepad to save as ANSI encoding, or transcode with Python:

1
with open('xxx.vbs', 'r', encoding='utf-8') as f:
2
    content = f.read()
3
with open('xxx.vbs', 'w', encoding='gbk') as f:
4
    f.write(content)

3. Cloudflared reports “failed to request quick Tunnel”

Usually a network issue or an outdated Cloudflared version; upgrade to the latest version.

4. How to replace the local service program

Modify the line in StartAll.vbs that starts the local service, replacing py gallery_server.py with your startup command. The port and domain are managed centrally in config.json.

5. How to add other ports / multiple services

Add fields in config.json, read them via GetConfig() in StartAll.vbs, and duplicate the two blocks of port-killing and service-startup code. Cloudflared supports exposing multiple services simultaneously through the config file.

XI. Security Notes

• --bind 127.0.0.1 ensures the local service is accessible only from the machine itself; other devices on the LAN can’t connect directly
• Python http.server has no upload interface; PUT/DELETE and other methods are unavailable, read-only and safe
• --directory locks the root directory, preventing cross-directory reading via ../
• Cloudflare provides free DDoS protection and SSL certificates
• For finer-grained control (IP whitelist, rate limiting), configure it in the Cloudflare panel WAF

Thanks for reading! Follow me if you'd like~

Expose Local Services to the Public Internet via Cloudflare Tunnel

Sun Jul 05 2026

1992 words · 13 minutes

NotesServertunnelcloudflare

---

© MuxiaoWF | CC BY-NC-SA 4.0

Share

Share this article

X (Twitter)TelegramRedditFacebookEmailQQ

Close

Close