PWNMI

Guides

Give Your Home Lab a Real Domain (Without Opening Any Ports)

Updated July 23, 2026 · Written by PWNMI — see About.

Once a home lab grows past one box, remembering IP addresses gets old fast. A domain fixes that — lab.yourdomain.com instead of an IP you have to look up every time — and it's what makes hosting other useful services (a notes wiki, a git server, a monitoring dashboard) actually pleasant to use from outside your network.

Getting the domain

I register through Cloudflare — domains are sold close to wholesale cost with no markup at renewal, and having the domain, DNS, and everything below (Tunnels, Zero Trust) in one account keeps the whole setup simpler.

If you don't need the rest of what Cloudflare provides and just want a cheap domain, I've also used gen.xyz — registration for as little as $6 for 3 years, especially for .xyz-style TLDs. Disclosure: that's an affiliate link.

Cloudflare Tunnels

The problem a domain alone doesn't solve: getting traffic to a home lab usually means forwarding a port on your router, which puts an open port on the public internet pointed at your network. Tunnels remove that requirement entirely.

A small daemon (cloudflared) runs on your box and makes an outbound connection to Cloudflare's edge. Traffic to your domain routes through that connection back to your service — nothing needs to be port-forwarded, and your home IP is never exposed. Install cloudflared for your OS from Cloudflare's docs, then:

cloudflared tunnel login                              # authorizes the CLI against your Cloudflare account
cloudflared tunnel create homelab                      # creates the tunnel, writes a credentials file
cloudflared tunnel route dns homelab lab.yourdomain.com

A config file maps hostnames to whatever's actually running locally:

tunnel: <tunnel-UUID>
credentials-file: /root/.cloudflared/<tunnel-UUID>.json

ingress:
  - hostname: lab.yourdomain.com
    service: http://localhost:8080
  - hostname: git.yourdomain.com
    service: http://localhost:3000
  - service: http_status:404

Run it as a service so it survives a reboot:

sudo cloudflared service install
sudo systemctl start cloudflared

Zero Trust: gating who can actually get in

A tunnel alone hides your IP — it doesn't decide who's allowed to connect. That's what Zero Trust Access policies are for, sitting in front of the tunnel: create an Access application for a hostname in the Zero Trust dashboard, then attach a policy (allow specific email addresses, require a one-time email PIN, whatever fits). Nothing reaches the actual service until that policy is satisfied.

The combination is the point: the tunnel gets traffic to Cloudflare's edge without exposing anything, and Access decides who gets past the edge at all.

What this is actually good for

  • A dashboard for lab infrastructure you check from outside your network
  • A personal notes wiki or git server
  • Monitoring (Grafana, uptime dashboards) you want to glance at from a phone

What not to do with it

Don't point a tunnel at a deliberately vulnerable CTF or practice target. Those boxes exist to be attacked from inside a controlled lab network — exposing one to the internet, even behind a domain, turns a training target into a real liability if it gets found.

Common mistakes

  • No Access policy in front of a tunneled service. A hostname that isn't port-forwarded still isn't the same as private — anyone who finds the URL can reach it unless a policy gates it.
  • Forgetting the DNS record needs to be proxied (the orange cloud in Cloudflare's dashboard, not grey) — Tunnels route through Cloudflare's proxy, so an unproxied record won't work.
  • Treating a tunnel as a substitute for patching the service itself. It hides your IP, not bugs in whatever you're running behind it.

Lessons worth keeping

  • A domain turns "remember an IP and hope it doesn't change" into "just go to the URL."
  • Tunnels remove the single biggest home-lab foot-gun: an open inbound port on your home router.
  • The Access policy is what actually makes something safe to expose — the tunnel by itself only hides the IP.

Next step

This is the natural extension of building a home lab in the first place — see Step 7 of the Roadmap if you haven't set one up yet, or the Hosting toolkit page if you'd rather run this on a VPS than off your home connection.