Tunnel ManagerA web control panel for Cloudflare Tunnel

Manage tunnels, bind domains, configure DNS with optimized CNAMEs and fallback origins, probe your services and publish a shareable status page — with Telegram bot remote control and administrator two-factor authentication.

Quick start

API reference

GitHub

Install wizard & two databases

The first visit to the panel runs an install wizard — pick a single-file SQLite store or a PostgreSQL server, test the connection, then choose the administrator account; the password never reaches the logs. Environment variables can own the storage instead, so containers need no changes.

Start deploying

Tunnel management

Create, delete and list Cloudflare Tunnels, review and edit application routes; a freshly created tunnel shows its cloudflared token and run command right away.

Manage tunnels & routes

Two domain-binding modes

Direct mode only configures the tunnel route and a proxied CNAME; optimized mode runs the full optimized-CNAME and SaaS custom hostname flow, and supports batch binding.

Compare the modes

DNS management

Manage A, AAAA, CNAME, TXT, MX, NS, SRV, CAA and PTR records per zone, with structured editing, batch creation and per-record results.

Open DNS management

AI assistant

Responses and Chat Completions connections, streaming replies and reasoning summaries; edit generated tasks, review their arguments and explicitly approve execution.

Configure the assistant

Multi-user & OIDC sign-in

Web supports multiple standard OIDC providers and identity linking, with email ownership checks, local two-factor authentication, account restrictions and group permissions.

Configure accounts & sign-in

Service monitoring

HTTP (GET/POST), TCP and ICMP probes, several targets per monitor, and a dashboard with seven days of latency bars.

Set up monitoring

Public status page

Share results without a login — short paths, custom domains, direct-tunnel or optimized CNAME access; a custom domain only ever exposes its own status page.

Publish a status page

Security & remote control

Argon2id password hashing, standard TOTP two-factor auth and one-time recovery codes; run tunnel, binding and DNS operations from a Telegram bot.

Security settings

Android app

A native client for the same API — overview, monitoring, tunnels and DNS are native screens, the login page embeds human verification, and monitor changes arrive as system notifications.

Install & use