Skip to content
NetherNode obsidian and lava server logoNetherNode

Cloudflare Tunnel

A Cloudflare Tunnel publishes the web panel on a hostname such as panel.example.com with no port forward. It carries HTTP, so it can’t carry Minecraft: players still connect to the Smart Proxy directly (see DNS and ports).

Set it up

Section titled “Set it up”
Terminal window
cloudflared tunnel login
cloudflared tunnel create nethernode
cloudflared tunnel route dns nethernode panel.example.com

Then run it with a config like this one:

tunnel: nethernode
credentials-file: /etc/cloudflared/nethernode.json
ingress:
  - hostname: panel.example.com
    service: http://127.0.0.1:8080
  - service: http_status:404

Tell NetherNode it’s behind a proxy, so it records visitors’ real addresses (cookies are marked secure either way, since Cloudflare says the visit was over HTTPS):

environment:
  NETHERNODE_HTTP__TRUST_PROXY_HEADERS: "true"

Put Cloudflare Access in front

Section titled “Put Cloudflare Access in front”

Strongly recommended: in Cloudflare Zero Trust, add an Access application for panel.example.com that only lets in the people you choose (by email, for example). Strangers then never reach NetherNode’s sign-in page at all, which also keeps password guessing away from it. Two-factor sign-in in NetherNode is still worth turning on.

Large uploads work through the tunnel: they’re sent in pieces small enough for Cloudflare’s limits and resume if the connection drops.