Jellyfin Cloudflare Tunnel Setup Guide (2026): Free Remote Access Without Port Forwarding

Jellyfin Cloudflare Tunnel Setup Guide (2026)

Cloudflare Tunnel is the most popular free method for remote Jellyfin access in 2026. It creates an outbound-only connection from your server to Cloudflare edge network - no open ports, no dynamic DNS, automatic SSL, and free DDoS protection.

How Cloudflare Tunnel Works

User (internet) → Cloudflare Edge → Encrypted Tunnel → Your Server → Jellyfin

The cloudflared daemon on your server establishes an outbound connection to Cloudflare. Your home IP is never exposed.

Advantages over port forwarding

Prerequisites

• A domain name (any registrar)
• Domain DNS managed by Cloudflare (free plan)
• Docker installed on your Jellyfin server
• A Cloudflare account (free)

Step 1: Add Your Domain to Cloudflare

1. Log in to dash.cloudflare.com
2. Click Add a Site, enter your domain
3. Select the Free plan
4. Update your domain nameservers at your registrar to Cloudflare nameservers
5. Wait for propagation (usually 5-30 minutes)

Step 2: Create a Cloudflare Tunnel

Via Cloudflare Dashboard (Easiest)

1. Go to Zero Trust, Networks, Tunnels
2. Click Create a tunnel
3. Name it: jellyfin
4. Choose Cloudflared as the connector
5. Cloudflare gives you a token - copy it

Via CLI

curl -fsSL https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared
chmod +x /usr/local/bin/cloudflared
cloudflared tunnel login
cloudflared tunnel create jellyfin

Step 3: Run cloudflared with Docker

Add to your docker-compose.yml:

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    command: tunnel --no-autoupdate run --token YOUR_TUNNEL_TOKEN
    restart: unless-stopped
    depends_on:
      - jellyfin

  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    volumes:
      - ./config:/config
      - ./cache:/cache
      - /mnt/media:/media:ro
    restart: unless-stopped

Replace YOUR_TUNNEL_TOKEN with the token from Step 2.

docker compose up -d

Step 4: Configure DNS Routing

In Cloudflare Dashboard, Zero Trust, Tunnels, your tunnel, Public Hostname:

1. Click Add a public hostname
2. Subdomain: jellyfin
3. Domain: yourdomain.com
4. Service type: HTTP
5. URL: jellyfin:8096 (Docker service name) or localhost:8096
6. Save

Your Jellyfin server is now accessible at https://jellyfin.yourdomain.com.

Step 5: Configure Jellyfin for Tunnel Access

Dashboard, Networking, Published server URL: https://jellyfin.yourdomain.com

Add Cloudflare as a trusted proxy

Dashboard, Networking, Known Proxies - add Cloudflare IP ranges:

173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

The Cloudflare ToS Question

Cloudflare ToS Section 2.8 historically prohibited using their free CDN for serving large amounts of non-HTML content. The 2026 reality:

• Cloudflare Tunnel traffic is not cached by default
• Many thousands of Jellyfin users run Cloudflare Tunnels without issues
• Cloudflare has not enforced Section 2.8 against tunnel users streaming personal media

Recommendation: Use Cloudflare Tunnel for remote access. Do not enable CDN caching for video content.

Cloudflare Tunnel vs Tailscale vs WireGuard

Troubleshooting

Remote access configured? Monitor every session from your phone. Download JellyWatch on Google Play - works over Cloudflare Tunnel to monitor your Jellyfin server in real time.