free · why the cloudflare trick disappoints
Cloudflare Tunnel and Minecraft: what actually happens
Cloudflare Tunnel is an excellent piece of infrastructure. It runs a small daemon on your machine, dials out to Cloudflare, and lets you publish a service on the internet without opening a port or revealing your address. If you have used it for a website, you already know why people reach for it when they want to host Minecraft.
It usually disappoints, and the reason is structural rather than a misconfiguration you can fix. Cloudflare's free plan will not proxy raw TCP. Minecraft Java is not HTTP; it is a bespoke protocol over raw TCP, normally on port 25565. The product that does carry arbitrary TCP is Spectrum, which is sold to enterprise customers.
Where Cloudflare Tunnel is strong
- For web services it is close to unbeatable: free, robust, no port forwarding, no exposed home address, and DDoS protection in front of it.
- The outbound-only model works from behind CGNAT, on Starlink and on restrictive networks, exactly as any good tunnel should.
- Cloudflare Access puts real authentication in front of a private service, which is hard to match for tools you do not want public.
- If you also run a website or a panel at home, it is the right tool for that part of the job.
Why Minecraft needs a different route
Raw TCP is the whole problem
The free Cloudflare proxy handles HTTP and HTTPS. Proxying arbitrary TCP is Spectrum, an enterprise product, so the free path does not carry port 25565 traffic for the public no matter how the tunnel is configured.
The workaround puts you back at square one
You can make it work by having every player install and run Cloudflare's WARP client, or by putting a WebSocket proxy in front of the server so the traffic looks like something Cloudflare will carry. Both mean asking everyone to install or run something, which is the thing a tunnel was supposed to avoid.
Built for game traffic
Our relay exists to carry Minecraft connections, so there is no protocol mismatch to work around and no per-player client to distribute.
It knows what a Minecraft server is
Cloudflare moves packets for a living and is not interested in what they contain. Our launcher sizes RAM, applies sensible Java flags, restarts crashed servers and explains crashes in plain English.
The rest of the toolkit
Live console in the browser, control from Discord, and off-site backups twice a week, on the free tier.
Side by side
| Cloudflare Tunnel (free) | Self Hostd (free) | |
|---|---|---|
| Designed for | HTTP and HTTPS services | Minecraft servers |
| Carries raw TCP on 25565 | Not on the free plan; that is Spectrum | Yes |
| Players install software | Yes, the WARP client, or a WebSocket proxy workaround | No |
| Works behind CGNAT | Yes | Yes |
| Hides your home address | Yes | Yes |
| Minecraft awareness | None | RAM guidance, Java flags, crash diagnosis, auto-restart |
| Backups | Not applicable | Twice-weekly, off-site, one-click restore |
Based on each product's published free tier as of 11 August 2026. If something here has changed, tell us and we will correct it.
From a half-working Cloudflare setup to a working address
- 1Keep cloudflared if you use it elsewhereIf you publish a website or a panel from the same machine, leave that tunnel alone. The two do not interfere with each other.
- 2Create a server and pairMake a free account, press Create your server, copy the 6-digit pairing code, drop the Self Hostd launcher into your server folder, open it, paste the code and press Start.
- 3Share the addressFriends connect with a plain Minecraft client and no cloudflared install, which is the part that was not working before.
Full step-by-step instructions, including the modpack path, live in the Self Hostd setup guide.
Questions you'd be right to ask
Can I use Cloudflare Tunnel for a Minecraft server?
Not as a plain public address. Minecraft Java uses raw TCP rather than HTTP, and Cloudflare's free plan will not proxy raw TCP; that capability is Spectrum, an enterprise product. The free workarounds are having every player install Cloudflare's WARP client, or running a WebSocket proxy to disguise the traffic.
Why does my Cloudflare Tunnel Minecraft server refuse connections?
Because the hostname is served through the HTTP proxy, which cannot carry the Minecraft protocol. The client opens a TCP connection and finds something that is not a Minecraft server answering. No amount of DNS or ingress configuration changes that on the free plan.
What about Cloudflare Spectrum?
Spectrum is the product that does proxy arbitrary TCP, and it would carry Minecraft. It is aimed at enterprise customers and priced accordingly, which puts it well outside what someone hosting a server for friends is likely to want.
Is there a free tunnel that does carry Minecraft?
Yes. Tunnels built for game traffic carry raw TCP because that is what they exist to do. Self Hostd is one of them, and playit.gg is another well-regarded option if you only want the tunnel part.
A tunnel that speaks Minecraft
Coming from somewhere else?