Connect to private databases with Cloudflare Tunnel

How it works

When you run cloudflared on a machine in your network, it opens an outbound connection to Cloudflare, and Scandock reaches your database through it. You do not need to expose the database to the internet or open inbound firewall ports.

What you need

• A machine that can reach the database: Linux, Windows, or any machine that runs Docker. It can be the database server itself.
• cloudflared: Version 2025.7.0 or later.
• Outbound access: The machine must be able to connect out to Cloudflare. See Cloudflare's cloudflared documentation for the required destinations and ports.

Steps

1. 1

   Under "Connections" in the console, click "Create tunnel" and enter a display name and the database's host name or IP address as seen from cloudflared. You can use an internal address (10.x, 192.168.x and so on), a name from your internal DNS, or the host name of an Amazon RDS, Aurora, Cloud SQL or Azure database, or 127.0.0.1 if cloudflared runs on the database server, together with the port the database listens on.

2. 2

   Run the displayed command on that machine (Docker, Linux or Windows). On Linux and Windows it is installed as a service and keeps running after restarts.

3. 3

   When the tunnel shows "Connected", click "Add connection", choose this tunnel as the route, and register the connection string. Scandock ignores the host and port in the connection string and connects to the tunnel's target, using the user, password and database name from the connection string.

Security

• Token: Anyone with the token in the command can act as this tunnel's endpoint. Do not share it, and if it leaks, delete the tunnel and create a new one.
• Network restrictions: We recommend restricting the machine running cloudflared so it can reach only the databases you monitor.
• From cloudflared to the database: The tunnel is encrypted, but cloudflared talks to the database in plaintext. Run cloudflared on the database server or within the same trusted network. If the database requires TLS, it cannot be reached through the tunnel.

Running in Docker

The container must be able to reach the database. If the database runs on the Docker host itself, create the tunnel with the host's LAN IP address instead of 127.0.0.1, or on Linux start the container with --network host.