Cloudflare Tunnel to Traefik Setup Assistance reddit / selfhosted ---------------------------------------------------------------------- _The_Judge_ · 2023-11-18 21:54 I'm trying to setup a single cloudflare tunnel to access my services through Traefik. I'm currently able to connect to services via subdomains using Traefik, but my current setup requires ports to be forwarded. I'm trying to get away from that by using cf tunnels. All of the guides I've seen to do this require creating a tunnel per service. Has anybody been able to do this successfully using one tunnel? ---------------------------------------------------------------------- Sheiwn · 2023-11-18 22:30 I am currently doing this. I use 1 tunnel for all services. Under the Public Hostname tab in CF tunnels is where you create the hostname and where to forward. If you need more specifics let me know. ---------------------------------------------------------------------- _The_Judge_ · 2023-11-18 22:44 Great! So I have the current configuration on the tunnel. I'm trying to use the \* wildcard for my subdomain. Is there anything I'm missing? [https://imgur.com/a/1VHc8LE](https://imgur.com/a/1VHc8LE) When I disable the forwarded Traefik ports in my router, all my services become unavailable. ---------------------------------------------------------------------- clintkev251 · 2023-11-19 01:36 Do you have a DNS record that points to your tunnel? ---------------------------------------------------------------------- _The_Judge_ · 2023-11-19 01:39 I don't think so? I have the tunnel configured to point to the IP and Port that traefik is running on in docker. The tunnel is connected according to the CF dashboard, I wouldn't think I would need a separate DNS record for the tunnel itself. ---------------------------------------------------------------------- clintkev251 · 2023-11-19 01:41 If you don’t have a DNS record, how are you expecting traffic to reach the tunnel? ---------------------------------------------------------------------- _The_Judge_ · 2023-11-19 01:43 I assumed because of the wildcard and the fact that I'm pointing to my traefik instance that is on the same network as my tunnel then that would be all I'd need. Are you saying I need a separate subdomain for the tunnel itself? ---------------------------------------------------------------------- clintkev251 · 2023-11-19 01:45 You just need to create an actual wildcard CNAME record that points to the tunnel endpoint ---------------------------------------------------------------------- _The_Judge_ · 2023-11-19 02:09 So I need a new wildcard DNS record, then what do I point the service entry in the tunnel dashboard public hostname page to? To traefik? ---------------------------------------------------------------------- _The_Judge_ · 2023-11-19 02:18 So create a *.mydomain.com CNAME record. Configure the tunnel to use that wildcard CNAME. Set the service IP in the tunnel Public Hostname to my Traefik service? ---------------------------------------------------------------------- clintkev251 · 2023-11-19 02:23 The configuration of your tunnel is fine the way it is in your screenshot, all you need to do is create a wildcard CNAME that points to the endpoint of your tunnel, which should be provided for you somewhere in the Cloudflare console ---------------------------------------------------------------------- Sheiwn · 2023-11-19 12:26 IIRC CF does this for you. You just need to specify each service as a subdomain or a path to the traefik host with port 443. ---------------------------------------------------------------------- _The_Judge_ · 2023-11-19 13:40 I have subdomains with CNAME records for all the services I was wanting to expose. Is the only way to access them through a tunnel by using one tunnel per service? ---------------------------------------------------------------------- Sheiwn · 2023-11-19 13:45 I guess I forgot to ask, is CF your domain and dns provider too? I ask because when I create a public hostname for my tunnel, it creates the dns record too. Looks like this: ---------------------------------------------------------------------- _The_Judge_ · 2023-11-19 14:15 My DNS provider is actually NameCheap, but cloudflare will do this if I create an individual tunnel per hostname. I was just hoping to use a wildcard to setup a single tunnel hostname and then any traffic routed to my Traefik instance via the tunnel would go to the correct services. ---------------------------------------------------------------------- Sheiwn · 2023-11-19 14:28 I have never tried that but it makes sense if you are having trouble getting that working since CF Tunnels are "zero trust" by design. ---------------------------------------------------------------------- clintkev251 · 2023-11-19 14:50 It doesn't in this case. It literally says in OPs screenshot that it's not going to create the records for him because he's using a wildcard. ---------------------------------------------------------------------- Sheiwn · 2023-11-19 14:51 Yeah I’m not blind I can see that. I’m talking about not using a wildcard. But it’s irrelevant because cf isn’t his domain provider. ---------------------------------------------------------------------- _The_Judge_ · 2023-11-20 22:44 I have this setup correctly now! The wildcard is routing to an nginx test service on my server for all addresses where I don't currently have a CNAME defined. Part of the problem I was having previously was that I was testing on a service that already had a subdomain defined so the tunnel routing wasn't kicking in. Now that I can get traffic to Traefik, I just need to figure out how to have Traefik pick up the subdomain and route to the correct service. ---------------------------------------------------------------------- Sheiwn · 2023-11-21 02:30 Nice! Glad you figured it out. I personally use consul and Traefiks consul plugin to perform the routing. You just put some tags on the service and Traefik takes care of the rest. Don’t have to worry about IPs and ports. ---------------------------------------------------------------------- _The_Judge_ · 2023-11-21 16:57 I'll have to look into consul, never used it before! Part of my problem seems to be that the Traefik dashboard isn't accessible via the IP:Port that it's currently running on. I can only access it through the subdomain. Any idea why that might be?