My family cloud is reachable from anywhere on the internet, and I never opened a single firewall port to do it.
The hole I did not want
For years the default answer to "how do I reach my home server from outside" was port forwarding: poke a hole in your router, expose a service to the whole internet, and hope your patching keeps up with the people scanning for it. I did not want that hole. So there is not one.
How the tunnel replaces it
Instead I run cloudflared, Cloudflare's tunnel agent, in a small container on an isolated DMZ segment. It makes an outbound TLS connection to Cloudflare's edge and holds it open. When someone requests cloud.iamkay.eu, the request arrives at Cloudflare, travels back down that already-open tunnel to cloudflared, and cloudflared hands it to my internal reverse proxy, which routes it to Nextcloud. The connection is always outbound from my side. My router's inbound rules never change, because the answer to "who is allowed in" stays nobody.
The full path is worth spelling out: phone on mobile data, to Cloudflare's edge, down the tunnel to cloudflared, to the Traefik virtual IP, to Nextcloud, to the NAS behind it. No port forward anywhere in that chain.
The blast radius is one line
The part I like most is how small the exposure is. cloudflared lives on its own DMZ VLAN, and the firewall rule letting it reach the internal network is exactly one line: source 203.0.113.10, destination the proxy virtual IP at 10.99.99.29, port 443, nothing else. If cloudflared were ever compromised, it cannot SSH anywhere, cannot reach the vault, cannot touch Nextcloud's storage directly. It has one job and the firewall enforces exactly that job.
It is free for personal use, and you get Cloudflare's DDoS protection and WAF in front of your services as a bonus. If you are still port forwarding self-hosted services in 2026, this is the switch to make.
A note on the addresses
The IP addresses and hostnames in this post are documentation placeholders on reserved ranges, not my real ones. The public route cloud.iamkay.eu is real because it is a destination I want people to reach; the internal IPs are stand-ins on purpose. The architecture is exactly how I run it. Nothing here points at a live target.
