Reach your home computers from anywhere with Cloudflare

Reachbeam connects over your local network, so out of the box it works on Wi-Fi at home. To use it from anywhere — a coffee shop, another city — you need a secure path back to your network. This guide sets one up with Cloudflare's free Zero Trust plan: a private VPN to your home, with no ports opened on your router and no exposed IP.

A community how-to from the Reachbeam team. Cloudflare's dashboard labels shift occasionally; the CLI commands are stable.

How it works

Two pieces do the work. A small connector (cloudflared) runs on a machine that stays on at home and makes an outbound-only connection to Cloudflare's edge — nothing listens for inbound traffic, so there's no port to forward or firewall hole to open. On your phone, the Cloudflare WARP client acts as the VPN. Cloudflare routes your home network's private IP range through the tunnel, so when WARP is on, your phone can reach your LAN addresses as if it were sitting on the couch.

Reachbeam doesn't need to know any of this — you still connect to the same LAN IP you'd use at home. This is the DIY approach today; native over-the-internet access is on Reachbeam's roadmap.

What you'll need

• A machine at home that stays powered on to run the connector — a Raspberry Pi, NAS, mini-PC, or even the computer you plan to control.
• A free Cloudflare account (the Zero Trust free plan covers up to 50 users).
• Your home network's IP range (its CIDR), e.g. 192.168.1.0/24. Check your router or run ip route / ipconfig.
• The Reachbeam app, and a VNC or SSH server already reachable on your LAN.

Step 1 — Create a Zero Trust organization

Sign in at one.dash.cloudflare.com and choose a team name (this becomes your-team.cloudflareaccess.com). Pick the free plan. You'll enroll your phone into this org later.

Step 2 — Create a tunnel and run the connector at home

In the dashboard go to Networks → Tunnels → Create a tunnel, choose Cloudflared, name it (e.g. home), and Cloudflare gives you an install command with a token. On your always-on home machine:

Docker:

docker run -d --name cloudflared --restart unless-stopped \
  --network host \
  cloudflare/cloudflared:latest tunnel run --token <YOUR_TOKEN>

Or the CLI (Linux/macOS), if you prefer named tunnels:

cloudflared tunnel login
cloudflared tunnel create home
cloudflared tunnel run home

Step 3 — Route your home network through the tunnel

Tell Cloudflare which private range lives behind this connector. In the dashboard: your tunnel → Private Network → Add a private network, and enter your CIDR (192.168.1.0/24). Or from the CLI:

cloudflared tunnel route ip add 192.168.1.0/24 home

Step 4 — Include that range in WARP's tunnel

This is the step people miss. By default WARP excludes private IP ranges so your local traffic stays local — which means it won't send your home CIDR through the tunnel unless you tell it to.

In Zero Trust go to Settings → WARP Client → Device settings → your profile → Split Tunnels. If it's set to Exclude mode, remove your home range (e.g. 192.168.1.0/24) from the exclude list so it routes through WARP instead.

Step 5 — Enroll your phone with the Cloudflare One app

1. In Zero Trust, under Settings → WARP Client → Device enrollment, add a policy that permits your email (or your identity provider).
2. On your Android phone, install Cloudflare One Agent (formerly the 1.1.1.1 / WARP app) from Google Play.
3. Open it → Account → Login with Cloudflare Zero Trust → enter your team name → sign in.
4. Toggle WARP on. Your phone now has a private route to your home network.

Step 6 — Connect in Reachbeam

With WARP connected, open Reachbeam and add (or open) a connection to your machine's LAN IP — the same address you use at home, e.g. 192.168.1.50 on port 5900 for VNC or 22 for SSH. It works from anywhere WARP is on. For an extra layer, point Reachbeam at your SSH host and tunnel VNC through it (VNC-over-SSH) so the desktop session is encrypted end to end even before Cloudflare.

Locking it down

• No open ports. The connector is outbound-only; your router stays closed. Nothing about your home is exposed to the public internet.
• Only your devices get in. Access to the private network requires an enrolled device that passes your enrollment policy — not just anyone with your IP.
• Add device posture / session limits in Zero Trust to require a screen lock, a re-auth interval, or a specific device.
• Keep credentials on-device. Reachbeam stores VNC/SSH passwords and keys in the Android Keystore and never sends them anywhere but the target machine.

Prefer a different tool?

The Cloudflare route is free and needs no port forwarding, which is why it's a great default. If you'd rather a pure device-to-LAN mesh, Tailscale (WireGuard, very little config) or a self-hosted WireGuard server are excellent alternatives — in every case Reachbeam just connects to the LAN IP that the VPN makes reachable.

FAQ