Cloudflare Tunnel is a secure reverse tunnel that creates a persistent outbound connection from a host to Cloudflare’s network. Instead of opening an inbound port to the internet, the connector on the endpoint initiates the session and keeps it alive for remote access until the connector is stopped, disabled, or removed.
In cyber security, this matters because outbound-only connectivity can bypass traditional perimeter controls and make access harder to notice. Defenders use tunnels for legitimate administration and service publishing, but attackers can abuse the same design to maintain covert access, expose internal services, or preserve a foothold after credentials are revoked. During incident response, teams should look for the tunnel client, associated services, config files, and outbound connections, then remove the connector and rotate any credentials or tokens tied to it.