Skip to main content
The Access application is yours to create, in the Cloudflare dashboard. This pane takes the hostname of one that already fronts the database, and runs cloudflared against it for the life of the connection.
Cloudflare Tunnel pane

The Cloudflare Tunnel pane in the connection form

​
Before you start

Create a self-hosted application in the Zero Trust dashboard routed to the database, with a policy that admits you. Its public hostname is the only Cloudflare value this pane needs.
The pane looks on your PATH and in /opt/homebrew/bin and /usr/local/bin, and shows what it found. Installed elsewhere, set Path by hand: a GUI app never sees the PATH your shell profile exports.

​
Setting up

1

Enable the pane

Select Cloudflare Tunnel and turn Enable Cloudflare Tunnel on. One method per connection: any other tunnel or proxy already enabled gets a button to disable it.
2

Enter the hostname and sign in

Hostname is the Access application’s public hostname, db.example.com in the example. With Browser Sign-In chosen, click Sign In with Browser… so the first connect does not stop to ask.
3

Test it

On General, click Test Connection. Host and Port there are never dialed while the tunnel is on: the Access application decides where it lands.

​
How it works

A free port is picked, cloudflared starts listening on it, and the driver gets it once it accepts. Run the same command yourself to see the client’s own output:
Disconnecting or quitting stops the process. One orphaned by a crash is reaped at the next launch.

​
Options

With Expose to local network on, anything that reaches the port is past Cloudflare Access on your session and faces only the database’s own login.

​
Authentication

Sign In with Browser… runs cloudflared access login and caches the token under ~/.cloudflared; later connects reuse it silently. A connect with no cached token asks you to sign in rather than appearing to hang.
TablePro polls that port and gives 30 seconds to answer on it. Past that the connect fails and the error carries the last lines printed, which is where the real reason usually is.

​
Troubleshooting

​
cloudflared was not found

Install it with brew install cloudflared, or set Path to the binary.

​
A browser opens every time you connect

The cached Access token expired, or a service token is running against a policy that is not Service Auth. Sign in again, or change the policy.

​
The tunnel did not become ready in time

An unknown hostname, a policy that is not Service Auth, or a fixed port already taken.