Cloudflare VPS: There Is No Such Product, and Here Is What People Searching for It Actually Need

Cloudflare does not sell a VPS. What the phrase Cloudflare VPS means, whether it appears on a hosting company’s plan page or in a search box, is a virtual private server from some other provider with Cloudflare’s proxy in front of it, so that DNS, TLS termination, caching, the web application firewall and DDoS absorption happen on Cloudflare’s network before a request ever reaches the server. That is a good setup and it has four steps that people routinely skip: proxy the records, set the encryption mode to Full (strict) with a certificate on the origin, firewall the server so only Cloudflare’s ranges can reach it, and, if the server should not have a public address at all, replace the inbound port with a tunnel. The only compute Cloudflare itself runs is Workers, which are short functions at the edge and not a server you can SSH into.

Hosting companies have noticed the search volume and named plans after it, which makes the phrase look like a product category. It is a configuration. This post covers what the configuration buys you, how to do it without leaving the origin exposed, and the point at which a managed platform gives you the same result with fewer parts to maintain.

Table of contents

• What Cloudflare is, and what it is not, in this picture
• Step one: point the domain, proxy the records
• Step two: Full (strict), and a real certificate on the origin
• Step three: firewall the origin so only Cloudflare can reach it
• Step four, optional: no inbound ports at all with a tunnel
• What this setup does not do
• When a platform replaces the whole checklist
• How this fits the rest of the stack
• FAQ

What Cloudflare is, and what it is not, in this picture

Cloudflare operates a global network that sits between visitors and your server. When a DNS record is proxied, the address the world sees is Cloudflare’s, and each request is handled at the nearest edge location before being forwarded, or not, to your origin. That gives a server several things it did not have on its own:

• TLS at the edge. A certificate for your domain, issued and renewed by Cloudflare, terminating HTTPS close to the visitor.
• Caching. Static assets served from the edge, so the origin sees a fraction of the requests.
• Filtering. Managed WAF rules, bot detection, rate limiting and country or ASN blocks, applied before the request reaches you.
• Absorption. Volumetric attacks land on a network built to take them rather than on a single virtual machine’s network port.
• A hidden address. With the proxy on, the origin’s IP is not in public DNS.

What Cloudflare is not is the place your application runs. Workers and Pages Functions execute small pieces of code at the edge with strict CPU and memory limits and no persistent process. They are not a substitute for a server, a database or a long-running worker. If the search was for somewhere to host an application, the answer is a VPS or a platform, and Cloudflare is the optional layer in front.

Step one: point the domain, proxy the records

Add the domain to Cloudflare, change the nameservers at the registrar to the pair Cloudflare assigns, and create an A record for the apex and a CNAME for www pointing at the VPS’s IP address with the proxy toggle on. Anything that must not go through the proxy, such as a mail server or an SSH hostname, stays DNS-only. Within a few minutes the site is answering from Cloudflare’s edge and the origin is doing less work.

Type   Name   Content          Proxy
A      @      203.0.113.10     Proxied
CNAME  www    example.com      Proxied
A      mail   203.0.113.10     DNS only

Step two: Full (strict), and a real certificate on the origin

The encryption mode decides whether the hop from Cloudflare to your VPS is encrypted. Flexible encrypts only the visitor-to-Cloudflare leg and sends plain HTTP to the origin, which is the setting that produces both a security hole and, if the origin redirects HTTP to HTTPS, an infinite redirect loop. Full accepts any certificate on the origin, including a self-signed one it does not verify. Full (strict) verifies the origin’s certificate, which is the only setting that makes the second leg genuinely secure.

To satisfy Full (strict) the VPS needs a certificate Cloudflare will trust. The simplest is a Cloudflare Origin CA certificate, issued from the dashboard, valid for up to fifteen years, and trusted only by Cloudflare’s proxy, which is fine because nothing else should be connecting to the origin directly. Install it in nginx or Caddy on port 443 and set the mode to Full (strict). A public certificate from an ACME client also works, if you leave the challenge path reachable.

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate     /etc/ssl/cloudflare/origin.pem;
    ssl_certificate_key /etc/ssl/cloudflare/origin.key;
    # ...
}

Step three: firewall the origin so only Cloudflare can reach it

With the proxy on, the VPS’s IP is out of public DNS, but it is not secret. Certificate transparency logs, old records, and scanners that walk address ranges will find it, and a request straight to the IP bypasses every rule Cloudflare applies. The fix is at the server’s firewall: allow ports 80 and 443 only from Cloudflare’s published IP ranges and deny them from everywhere else. SSH stays open to your own addresses only.

for ip in $(curl -fsS https://www.cloudflare.com/ips-v4) $(curl -fsS https://www.cloudflare.com/ips-v6); do
  ufw allow proto tcp from "$ip" to any port 80,443 comment cloudflare
done
ufw deny proto tcp from any to any port 80,443
ufw allow from YOUR.OFFICE.IP.ADDR to any port 22
ufw enable

Refresh the list on a schedule, because the ranges change occasionally. And because every Cloudflare customer’s traffic egresses from those same ranges, add Authenticated Origin Pulls so the origin also requires Cloudflare’s client certificate on the connection. Together, the allowlist and the client certificate mean only Cloudflare, acting for your zone, can talk to the server.

Step four, optional: no inbound ports at all with a tunnel

The alternative to a firewall allowlist is to close inbound web ports entirely and run a small connector on the VPS that opens an outbound connection to Cloudflare’s network. Requests for your hostname arrive through that connection instead of through an open port. The server has no public web listener, the IP could be printed on a billboard and nothing would reach it, and the allowlist maintenance goes away.

cloudflared tunnel login
cloudflared tunnel create vps-web
cloudflared tunnel route dns vps-web www.example.com
# config: map the hostname to the local service
# ingress:
#   - hostname: www.example.com
#     service: http://localhost:8080
#   - service: http_status:404
cloudflared tunnel run vps-web

This is also the answer for a server behind NAT or a home connection with no fixed address. The connector runs as a service, reconnects on its own, and the DNS record it creates is a CNAME to the tunnel rather than an A record to an IP. The trade is that Cloudflare is now in the path for every request, including ones you might have wanted to serve directly.

What this setup does not do

• It does not patch the server. Kernel updates, the web server, the language runtime and the database are still yours, and a VPS that is perfectly proxied and six months behind on updates is still a compromised VPS waiting to happen.
• It does not restart the application. A crashed process behind a healthy proxy is a 502 page with Cloudflare’s branding on it.
• It does not back anything up. The database on the VPS’s disk is one failed disk from gone.
• It does not scale. More traffic than one VPS can serve is still more traffic than one VPS can serve; the cache helps with static assets and does nothing for dynamic requests.
• It does not make the origin fast. The first byte from an unoptimised application is the same first byte, plus one hop.

The proxy is a good outer layer. It is not a hosting strategy, and the plan pages that sell it as one are selling a VPS with a checkbox.

When a platform replaces the whole checklist

Every step above exists because a VPS is a bare machine with a public address, and each step is a way of making that address safer to have. A managed platform starts from the other end: the service is deployed from a repository, the platform terminates TLS and issues the certificate, the process is restarted when it dies, the database is on a private network with backups, and the plan can scale up when traffic arrives. Cloudflare can still sit in front of it if the firewall rules or the cache are wanted, with the records set to proxied and the mode on Full (strict), and there is no origin firewall to maintain because there is no origin IP to expose.

For someone whose search began with wanting a server that is safe to put on the internet, that is usually the shorter path. The VPS-plus-proxy recipe is right when the software genuinely needs a whole machine; otherwise it is a lot of configuration to arrive where a platform starts.

How this fits the rest of the stack

The honest comparison is between the VPS bill plus the hours the checklist costs, and a platform plan with the checklist already done. The RunxBuild hosting calculator shows the service, the managed database and the bandwidth as separate lines with the plan prices printed, and custom domains document what to set when Cloudflare stays in front: the records proxied, the mode on Full (strict), and the certificate handled on the platform side.

Useful related references:

• VPS Price: What Drives It, and the Line Items That Are Not On It
• High Performance VPS: What the Phrase Means and How to Verify It
• 16GB VPS: How to Tell Whether You Actually Need One
• Services on RunxBuild

FAQ

Does Cloudflare offer VPS hosting?

No. Cloudflare is a network and security layer that sits in front of a server, not a hosting provider. The phrase Cloudflare VPS refers to a virtual private server from another host with Cloudflare’s proxy configured in front of it. Cloudflare’s own compute is Workers, which runs short edge functions, not servers.

How do I connect a VPS to Cloudflare?

Add the domain to Cloudflare, switch the nameservers at the registrar, create proxied A and CNAME records pointing at the VPS IP, set the SSL mode to Full (strict) with a Cloudflare Origin CA certificate installed on the server, and firewall ports 80 and 443 so only Cloudflare’s published IP ranges can reach them.

Which Cloudflare SSL mode should I use with a VPS?

Full (strict). Flexible sends plain HTTP to the origin and causes redirect loops if the server forces HTTPS. Full does not verify the origin certificate. Full (strict) verifies it, and a free Cloudflare Origin CA certificate on the server satisfies that check.

Is my VPS hidden once it is behind Cloudflare?

Its IP is removed from public DNS, but it can still be found through certificate logs, old records or scanning, and a direct request bypasses every Cloudflare rule. Allow web ports only from Cloudflare’s IP ranges and enable Authenticated Origin Pulls, or use a Cloudflare Tunnel so the server has no inbound web ports at all.

What is the difference between Cloudflare Tunnel and an origin firewall allowlist?

An allowlist keeps ports 80 and 443 open but restricts them to Cloudflare’s ranges, which you must keep updated. A tunnel closes inbound ports entirely and has a connector on the server open an outbound connection to Cloudflare, through which requests arrive. The tunnel also works behind NAT or without a fixed IP.