From 94d35645cf04e533650b4286d497391f0c9cac92 Mon Sep 17 00:00:00 2001 From: Hugo Vicente Date: Fri, 28 Aug 2026 16:27:37 +0100 Subject: [PATCH] Tunnel: Clarify path forwarding and reverse proxy boundary --- .../local-management/configuration-file.mdx | 8 ++++++++ .../cloudflare-tunnel/get-started/tunnel-useful-terms.mdx | 2 ++ .../advanced/local-management/configuration-file.mdx | 8 ++++++++ .../cloudflare-one/tunnel/add-published-application.mdx | 4 ++++ .../tunnel/locally-managed/local-tunnel-terms.mdx | 2 +- 5 files changed, 23 insertions(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file.mdx index 69c94d0a076..b6287373c6b 100644 --- a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file.mdx @@ -86,6 +86,14 @@ You can use wildcards to match traffic to multiple subdomains. For example, if y You can also enter regular expressions for the `path` key. For example, if `hostname` is `static.example.com` and `path` is `\.(jpg|png|css|js)$`, matching URLs could include `https://static.example.com/data.js`, `http://static.example.com/images/photo.jpg`, and so on. Cloudflare parses the path regex using the [Go `syntax` package](https://pkg.go.dev/regexp/syntax). +:::note[Path forwarding] +`cloudflared` matches request paths to evaluate rules, but it forwards the full request path to your service without modifying or stripping it. + +For example, if an ingress rule matches `path: /api`, a request to `https://example.com/api/users` is sent to your service as `http://localhost:8000/api/users`. + +If your application requires path stripping or URL rewriting, you can rewrite the URL at the Cloudflare edge using [URL Rewrite Rules](/rules/transform/url-rewrite/), or forward traffic from `cloudflared` to a local reverse proxy (such as Nginx or Traefik) configured to strip path prefixes before reaching your application. +::: + ### Services In addition to HTTP, `cloudflared` supports protocols like SSH, RDP, arbitrary TCP services, and Unix sockets. You can also route traffic to the built-in `hello_world` test server or respond to traffic with an HTTP status. For a full list of supported service types, refer to Protocols for published applications. diff --git a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms.mdx b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms.mdx index c5189742352..5816130b61d 100644 --- a/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms.mdx +++ b/src/content/docs/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms.mdx @@ -28,6 +28,8 @@ A tunnel name is a unique, user-friendly identifier that you choose for a tunnel The connector, referred to as `cloudflared`, establishes connectivity from your origin server to the Cloudflare global network. Each `cloudflared` instance creates four long-lived connections to at least two distinct data centers within Cloudflare's global network. This built-in redundancy means that if an individual connection, server, or data center goes down, your origin remains available. +`cloudflared` operates as a secure connector daemon rather than a local reverse proxy. It forwards requests directly to the configured local service without altering request URI paths or performing local load balancing. + ## Replica A replica is an additional instance of `cloudflared` running the same tunnel on a different host. You can create and configure a tunnel once, then run it through multiple replicas for redundancy. DNS records and Cloudflare Load Balancers continue to point to the tunnel (`UUID.cfargotunnel.com`), while Cloudflare distributes traffic across the available replicas. There is no guarantee about which replica will be chosen — Cloudflare routes to the geographically closest one. Replicas are typically deployed to keep a tunnel available if a host running `cloudflared` goes offline. diff --git a/src/content/docs/tunnel/advanced/local-management/configuration-file.mdx b/src/content/docs/tunnel/advanced/local-management/configuration-file.mdx index 69b792bcb2e..e2f08931ca0 100644 --- a/src/content/docs/tunnel/advanced/local-management/configuration-file.mdx +++ b/src/content/docs/tunnel/advanced/local-management/configuration-file.mdx @@ -74,6 +74,14 @@ You can use wildcards to match traffic to multiple subdomains. For example, if y You can also enter regular expressions for the `path` key. For example, if `hostname` is `static.example.com` and `path` is `\.(jpg|png|css|js)$`, matching URLs could include `https://static.example.com/data.js`, `http://static.example.com/images/photo.jpg`, and so on. Cloudflare parses the path regex using the [Go `syntax` package](https://pkg.go.dev/regexp/syntax). +:::note[Path forwarding] +`cloudflared` matches request paths to evaluate rules, but it forwards the full request path to your service without modifying or stripping it. + +For example, if an ingress rule matches `path: /api`, a request to `https://example.com/api/users` is sent to your service as `http://localhost:8000/api/users`. + +If your application requires path stripping or URL rewriting, you can rewrite the URL at the Cloudflare edge using [URL Rewrite Rules](/rules/transform/url-rewrite/), or forward traffic from `cloudflared` to a local reverse proxy (such as Nginx or Traefik) configured to strip path prefixes before reaching your application. +::: + ### Services In addition to HTTP, `cloudflared` supports protocols like SSH, RDP, arbitrary TCP services, and Unix sockets. You can also route traffic to the built-in `hello_world` test server or respond to traffic with an HTTP status. For a full list of supported service types, refer to Protocols for published applications. diff --git a/src/content/partials/cloudflare-one/tunnel/add-published-application.mdx b/src/content/partials/cloudflare-one/tunnel/add-published-application.mdx index 5299698b577..5b0e2406546 100644 --- a/src/content/partials/cloudflare-one/tunnel/add-published-application.mdx +++ b/src/content/partials/cloudflare-one/tunnel/add-published-application.mdx @@ -18,6 +18,10 @@ After creating your tunnel, add a published application route: If you add a multi-level subdomain (more than one level of subdomain), you must [order an Advanced Certificate for the hostname](/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors/#i-see-this-site-cant-provide-a-secure-connection). ::: + :::note[Path routing] + Specifying a path routes matching requests to the service URL, but does not strip or rewrite the path. The service receives the complete request path. To strip or rewrite paths, configure [URL Rewrite Rules](/rules/transform/url-rewrite/) at the Cloudflare edge or use a local reverse proxy. + ::: + 4. In **Service URL**, enter the protocol and address of your application (for example, `http://localhost:8000`). Refer to [supported protocols](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols/) for available options. 5. Select **Save**. diff --git a/src/content/partials/cloudflare-one/tunnel/locally-managed/local-tunnel-terms.mdx b/src/content/partials/cloudflare-one/tunnel/locally-managed/local-tunnel-terms.mdx index e65c27d54d9..131d659fd0f 100644 --- a/src/content/partials/cloudflare-one/tunnel/locally-managed/local-tunnel-terms.mdx +++ b/src/content/partials/cloudflare-one/tunnel/locally-managed/local-tunnel-terms.mdx @@ -32,4 +32,4 @@ This file is created when you run `cloudflared tunnel create `. It stores ## Ingress rule -Ingress rules let you specify which local services traffic should be proxied to. If a rule does not specify a path, all paths will be matched. Ingress rules can be listed in your configuration file or when running `cloudflared tunnel ingress`. +Ingress rules let you specify which local services traffic should be proxied to. If a rule does not specify a path, all paths will be matched. `cloudflared` forwards the full request path to the service without stripping or rewriting it. Ingress rules can be listed in your configuration file or when running `cloudflared tunnel ingress`.