cloudflared is the command-line client for Cloudflare Tunnel: a tunneling daemon that relays traffic from the Cloudflare network to your origin servers. Its principle reverses traditional network exposure: instead of opening ports on your firewall or publishing a public IP, the daemon establishes an encrypted and persistent outbound connection to Cloudflare's global network. Your origin can thus remain "as closed as possible".

In practice, cloudflared allows you to securely publish an internally hosted service (website, API, application) on the Internet, without touching the router configuration or exposing the server directly. This eliminates a whole class of risks — port scanning, direct attacks on the origin IP — and integrates natively with Cloudflare's WAF, anti-DDoS, and TLS protections.

The tool goes beyond simple HTTP proxying: via cloudflared access, it reaches origins protected by layer 4 traffic (SSH, RDP, and other TCP streams), in a Zero Trust logic. It is a cornerstone of the Cloudflare One offering for connecting private infrastructure without a traditional VPN.

On the technical side, cloudflared is written in Go and distributed as a standalone binary, Docker image, and packages. Its memory footprint is very low and it requires no database. DINAO deploys it as a container on your French infrastructure, configures the ingress rules, and monitors the tunnel continuously.