---
id: "cloudflare-tunnel"
type: "component"
kind: "private-link"
provider: "cloudflare"
category: "edge"
aliases: "Argo Tunnel"
docs: "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/"
url: "https://localhost:3000/catalogue/components/cloudflare-tunnel"
---

# Cloudflare Tunnel

Outbound-only cloudflared connector that publishes a private origin without inbound ports.

| | |
|---|---|
| Provider | [cloudflare](https://localhost:3000/catalogue?provider=cloudflare) |
| Kind | [Private endpoint](https://localhost:3000/catalogue/kinds/private-link) |
| Category | Edge |
| Official docs | [https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) |
| Also known as | Argo Tunnel |

## Properties

| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| `approvalRequired` | boolean | — | no | — | inherited |
| `crossRegion` | boolean | — | no | false | inherited |
| `endpointCount` | integer | — | no | — | inherited |
| `managed` | boolean | — | no | false | **true** |
| `managementMode` | enum | `remotely-managed`, `locally-managed` | no | "remotely-managed" | inherited |
| `outboundOnly` | boolean | — | no | true | inherited |
| `privateDnsIntegration` | boolean | — | no | — | inherited |
| `publicAccessDisabled` | boolean | — | no | — | **true** |

Bold values are the ones this component pins.

## Rules that apply · 0

No rule selects this kind or its category.

## Other products of the same kind · 13

- [PrivateLink](https://localhost:3000/catalogue/components/alibaba-privatelink.md) `alibaba-privatelink` — alibabacloud
- [PrivateLink endpoint service](https://localhost:3000/catalogue/components/aws-privatelink-service.md) `aws-privatelink-service` — aws
- [AWS RTB Fabric gateway](https://localhost:3000/catalogue/components/aws-rtb-fabric.md) `aws-rtb-fabric` — aws
- [AWS PrivateLink VPC endpoint](https://localhost:3000/catalogue/components/aws-vpc-endpoint.md) `aws-vpc-endpoint` — aws
- [Azure Private Link](https://localhost:3000/catalogue/components/azure-private-link.md) `azure-private-link` — azure
- [Workers VPC](https://localhost:3000/catalogue/components/cloudflare-workers-vpc.md) `cloudflare-workers-vpc` — cloudflare
- [Generic private endpoint](https://localhost:3000/catalogue/components/private-link.md) `private-link` — default
- [Private Service Connect](https://localhost:3000/catalogue/components/google-private-service-connect.md) `google-private-service-connect` — gcp
- [Serverless VPC Access connector](https://localhost:3000/catalogue/components/google-serverless-vpc-access-connector.md) `google-serverless-vpc-access-connector` — gcp
- [Virtual Private Endpoint Gateway](https://localhost:3000/catalogue/components/ibm-virtual-endpoint-gateway.md) `ibm-virtual-endpoint-gateway` — ibm
- [Private Endpoint](https://localhost:3000/catalogue/components/oci-private-endpoint.md) `oci-private-endpoint` — oci
- [Service Gateway](https://localhost:3000/catalogue/components/oci-service-gateway.md) `oci-service-gateway` — oci
- [OUTSCALE Net access point](https://localhost:3000/catalogue/components/outscale-net-access-point.md) `outscale-net-access-point` — outscale

## Use it in a design

```yaml
nodes:
  - { id: "cloudflare-tunnel", component: "cloudflare-tunnel" }
```

## Source (`component` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../../schema/component.schema.json
# Cloudflare Tunnel: the cloudflared connector dials out to the Cloudflare network, so the origin
# needs no inbound listener. "Cloudflare Tunnel" states you can block all inbound traffic; the
# dashboard flow creates a remotely-managed tunnel.
schemaVersion: "1"
type: "component"
id: "cloudflare-tunnel"
kind: "private-link"
provider: "cloudflare"
docs: "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/"
aliases: ["Argo Tunnel"]
defaults:
  managed: true
  publicAccessDisabled: true
properties:
  managementMode:
    type: "enum"
    values: ["remotely-managed", "locally-managed"]
    default: "remotely-managed"
  outboundOnly:
    type: "boolean"
    default: true
```

Human page: https://localhost:3000/catalogue/components/cloudflare-tunnel