Tunnel
Tunnel connects Loombre to the internet through Cloudflare, using an API token you create and paste in yourself. No port on your router ever needs to be opened — the connection to Cloudflare is entirely outbound — but Cloudflare is a real third party in the path for every single connection, stated plainly rather than glossed over: your traffic reaches Cloudflare's network before it reaches your server.
Creating a scoped Cloudflare API token
Loombre never asks for your Cloudflare account password or your Global API Key — only a scoped API token, created from your own Cloudflare dashboard, that can do exactly the three things Tunnel setup needs and nothing else. Create one with these permission groups (Loombre checks for all three by name when you paste the token in, and tells you exactly which one is missing if any aren't there):
| Permission group | What it lets Loombre do |
|---|---|
| Account Settings: Read | Confirm which Cloudflare account the token belongs to. |
| Cloudflare Tunnel: Edit | Create the tunnel itself and configure where it routes to. |
| Zone: DNS Edit | Create the DNS record that points your chosen hostname at the tunnel. |
Walkthrough, from your own Cloudflare dashboard:
Sign in to Cloudflare and open My Profile → API Tokens.
(screenshot coming soon)
Choose Create Token, then Custom token (not one of the built-in templates — this walkthrough's three permissions aren't a single template).
(screenshot coming soon)
Add all three permission groups from the table above.
(screenshot coming soon)
Under Zone Resources, include the zone (domain) you'll route Loombre through — or "All zones" if you're not sure yet, which you can narrow down later.
(screenshot coming soon)
Create the token and copy it — Cloudflare shows it exactly once.
(screenshot coming soon)
Paste it into Loombre's setup wizard (Settings → Remote access → Tunnel). Loombre checks it immediately and tells you plainly if a permission is missing, rather than failing later at tunnel creation.
(screenshot coming soon)
The token itself is stored write-only in Loombre's secure local keyring — no endpoint or screen in Loombre ever displays it again once you've pasted it in, the same posture the mail transport's own credentials already have.
What happens after the token is accepted
Loombre creates the tunnel and its DNS route in your Cloudflare account for you, then runs cloudflared — Cloudflare's own small connector program — as a supervised background process: Loombre watches its health, restarts it automatically with increasing backoff if it fails, and shows its recent logs on the admin Remote access screen. Loombre does not download this program for you; install it once yourself (Cloudflare's own installer for your platform) and Loombre finds it on your system automatically, or you can point Loombre at its exact location if auto-detection doesn't find it.
Enabling Tunnel also writes two settings for you. The tunnel hostname setting is auto-managed: written when Tunnel is enabled, cleared when it's disabled — you can still edit it afterward. And if the public web address setting (the one every emailed link — invitations, password resets — is built from) was empty, it's filled in with your tunnel hostname at the same time; a value you'd already set yourself is never overwritten, and disabling Tunnel never clears it (other things may still depend on it).
(screenshot coming soon)
Proving it actually reaches you
The same reachability proof every path ends with: the wizard mints a one-time code, and you scan it with a phone on cellular data, not your home Wi-Fi — the phone is the genuine outside test, not a third-party checking service. A plain, minimal success page confirms arrival; the wizard watches for it and turns green the moment it does.
Because Tunnel never depends on an inbound port on your router at all, a failed proof on this path almost always means the connector itself, not your network: check whether it's reporting healthy on the admin screen above before anything else. A connector that's still starting, or that's lost its connection to Cloudflare, is the most common reason nothing arrives.
See also
- Remote access — the decision tree and comparison table, if you haven't picked a path yet.
- Loombre Remote and Direct — the other two paths.