Skip to content
Book a Demo
software
Cybersecurity, Operations
use cases
Cybersecurity, Network & Device Management
Licensing
3rd party

Cloudflare Daemon

Cloudflare Daemon (Cloudflared) establishes outbound connections (tunnels) between your resources and Cloudflare’s global network. Tunnels are persistent objects that route traffic to DNS records. This establishes connections to Cloudflare and routes traffic to the nearest Cloudflare data center. Cloudflare Tunnel uses an outbound-only connection model to enable bidirectional communication. This setup ensures that all traffic to your origin is securely routed through the tunnel.
Contact us to add to Neeve
Benefits of Cloudflare Containers on Neeve
Through this integration, Cloudflare’s cloudflared daemon runs within the container environment on Neeve Secure Edge, providing a hardened gateway for all OT and automation traffic. By leveraging the Neeve platform, these tunnels become managed infrastructure components that benefit from edge-level orchestration.
Secure Outbound Connectivity: Eliminate the need for public IPs and inbound firewall rules, significantly reducing the local attack surface.
Zero Trust Integration: Seamlessly layer SSO and identity-based access (via Cloudflare Access) before traffic ever reaches the internal Neeve network.
Simplified Networking: Connect disparate local services to the Cloudflare global network using a single, lightweight daemon.
High Availability: Scale connectors across Neeve edge clusters to ensure persistent reachability even during localized hardware maintenance.
Traffic Optimization: Leverage Cloudflare’s global routing (Argo) for reduced latency and improved reliability for remote users accessing edge UIs.
Architecture
Deployment Architecture on Neeve
Deployment model: Sidecar or Singleton (usually one per namespace or site).
Workload: High-availability connector; maintains multiple persistent TCP/QUIC connections to Cloudflare.
Components: cloudflared binary, local configuration file (config.yml).
Data flows: * Egress (Outbound): TCP/UDP 7844 (QUIC) or 443 to Cloudflare edge.
Ingress (Internal): Proxies traffic to local services (e.g., http://niagara-n4:443).
Failure domains: If the daemon drops, the public URL becomes unreachable. Use at least 2 replicas for production high availability.