Cloudflare Tunnel creates a secure, outbound-only connection from your device to Cloudflare’s global network. No port forwarding, no public IP, no router changes needed.

But many users hit this error:

dial tcp 198.41.128.100:7844: i/o timeout
failed to dial a quic connection
connection timeout

This happens because many networks block port 7844. Here’s the fix.

What Is Cloudflare Tunnel?

Cloudflared (the client) creates a secure connection from your machine to Cloudflare’s edge, then Cloudflare routes outside traffic to your local application.

You DO NOT need:

  • Port forwarding
  • Public IP
  • Router changes
  • Firewall modifications

You get:

  • Encrypted traffic
  • Zero-trust access
  • DDoS protection
  • Global load balancing

Step 1: Install Cloudflared

On Arch Linux:

bash 
sudo pacman -S cloudflared

On other distros:

bash 
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o cloudflared
sudo install cloudflared /usr/local/bin/

Verify:

bash 
cloudflared --version

Step 2: Login to Cloudflare

bash 
cloudflared tunnel login

A browser opens — choose your domain and authorize. This creates ~/.cloudflared/cert.pem.

Step 3: Create Your Tunnel

bash 
cloudflared tunnel create my-tunnel

You get a UUID stored at ~/.cloudflared/<UUID>.json.

Step 4: Configure the Tunnel

bash 
nano ~/.cloudflared/config.yml
yaml 
tunnel: <TUNNEL-UUID>
credentials-file: /home/<user>/.cloudflared/<TUNNEL-UUID>.json

protocol: http2
quic: off

ingress:
  - hostname: app.example.com
    service: http://localhost:8080

  - hostname: app2.example.com
    service: http://localhost:8081

  - service: http_status:404

Step 5: Route Your Domain

bash 
cloudflared tunnel route dns my-tunnel app.example.com
cloudflared tunnel route dns my-tunnel app2.example.com

Step 6: Start the Tunnel

bash 
cloudflared tunnel run my-tunnel

If logs show Registered tunnel connection, you’re live.

Step 7: Run as a Systemd Service

bash 
sudo cloudflared service install
sudo systemctl enable --now cloudflared

Or create a custom per-tunnel service:

bash 
sudo nano /etc/systemd/system/cf-tunnel.service
ini 
[Unit]
Description=Cloudflare Tunnel
After=network.target

[Service]
User=<user>
ExecStart=/usr/bin/cloudflared tunnel run my-tunnel
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target
bash 
sudo systemctl enable --now cf-tunnel

Why Tunnel Fails on Some Wi-Fi

Cloudflare Tunnel normally connects via:

Protocol Port Purpose
QUIC UDP/7844 Primary tunnel transport
HTTP/2 TCP/7844 Fallback if UDP is blocked

Many public or corporate networks block all UDP, all non-standard ports, or ALL traffic on port 7844. Even when you force HTTP/2, cloudflared still uses 7844 over TCP.

If 7844 is blocked entirely, Tunnel always fails.

The Fix: Use Cloudflare WARP

Cloudflare WARP sends Cloudflare traffic through an encrypted WireGuard tunnel using standard HTTPS port 443.

  • Works on any network
  • No need to modify Wi-Fi or firewall
  • Official Cloudflare-supported workaround
  • 100% safe for legitimate Tunnel use

Install WARP on Arch Linux

bash 
yay -S cloudflare-warp-bin

Enable the daemon:

bash 
sudo systemctl enable --now warp-svc.service

Register WARP

bash 
warp-cli registration new

Verify:

bash 
warp-cli registration show

Enable WARP Mode

bash 
warp-cli mode set warp
warp-cli connect

Check status:

bash 
warp-cli status

You want:

Status: Connected
Network: healthy

Run Tunnel With WARP Enabled

bash 
cloudflared tunnel run my-tunnel

Now you’ll see successful logs — no more 7844 errors.

Testing and Troubleshooting

Check logs:

bash 
journalctl -u cloudflared -f

Check WARP status:

bash 
warp-cli status

Check DNS record:

bash 
dig app.example.com

Use Tunnel diagnostics:

bash 
cloudflared tunnel info my-tunnel
cloudflared tunnel list

Best Practices

  • Use WARP on restrictive networks
  • Use systemd for 24/7 tunnels
  • Keep your tunnel UUID and credentials secure
  • Use Access Policies if exposing admin systems
  • Use HTTP/2 or WebSockets for better reliability

Summary

Scenario Solution
Port 7844 blocked Enable WARP
UDP blocked Force protocol: http2 in config
Corporate firewall WARP tunnels over port 443
Always-on tunnel Use systemd service

Cloudflare WARP + Tunnel is the official workaround for restricted networks. It’s safe, supported, and works everywhere.