Cloudflare
Tunnel.

Create a tunnel via the dashboard or CLI. Configure which internal services to expose via a config file.

# Create tunnel
cloudflared tunnel create erp-connector

# config.yml
tunnel: abc-123-def
credentials-file: /etc/cloudflared/abc-123-def.json

ingress:
  - hostname: erp.company.com
    service: http://localhost:8080
  - hostname: db-admin.company.com
    service: http://localhost:5432
  - service: http_status:404

Run cloudflared as a systemd service. It maintains persistent outbound connections to Cloudflare and routes incoming requests to your local services.

# Install and run as service
cloudflared service install
systemctl start cloudflared

# Or run directly
cloudflared tunnel run erp-connector

# Quick expose (no config file needed)
cloudflared tunnel --url http://localhost:3000

Once the tunnel is running and the hostname is configured in DNS, Workers can fetch from the tunnelled service like any other origin.

// Worker fetches from on-premise ERP via tunnel
export default {
  async fetch(req, env) {
    const erpResponse = await fetch(
      "https://erp.company.com/api/v1/orders",
      { headers: { "Authorization": `Bearer ${env.ERP_TOKEN}` } }
    );
    return erpResponse;
  }
};