Caught between Cloudflare’s public DNS and your private internal services? This guide breaks down why this common conflict happens and provides three practical solutions, from a quick bypass to a robust, permanent fix using Cloudflare Tunnels.

So, You’re Thinking About Ditching Cloudflare? Let’s Talk.

I remember it clear as day. 2 AM, the office smelling of stale coffee and desperation. We’d just rolled out a new internal dashboard, `status.corp.techresolve.com`, and everything looked green. Then the alerts started firing. Our own CI/CD runners, sitting in the same VPC, couldn’t reach the new service. They were going out to the internet, asking Cloudflare’s 1.1.1.1 for directions to a server that was metaphorically sitting in the next room, and coming up empty. It’s a frustrating, face-palm moment we’ve all had, and it’s a core reason why I see engineers on Reddit threatening to burn it all down and look for Cloudflare alternatives. But hold on. Let’s not throw the baby out with the bathwater.

The “Why”: Public Address Books vs. Private Phone Numbers

Before we dive into fixes, you need to understand the root of the problem. Think of it this way: Cloudflare’s public DNS (like 1.1.1.1 or 1.0.0.1) is like the world’s public phone book. Your internal network, with its private IP addresses (like 10.0.1.50), is like your personal contact list on your cell phone.

When a server inside your network tries to resolve `internal-grafana.corp.techresolve.com` and it asks the public phone book, Cloudflare rightly says, “I have no public listing for that name.” It has absolutely no visibility into your private network’s contact list. It’s not a bug; it’s a fundamental feature of how network segregation and public DNS works. Your server is asking a public directory for a private number. It’s never going to work.

The Solutions: From Quick Fix to Full Architecture

Okay, enough theory. You’re here because something is broken and you need to get it working. Here are three ways to tackle this, from the “I need this working five minutes ago” hack to the “Let’s do this right” architectural solution.

Solution 1: The Quick Fix – The “Grey Cloud” Bypass

This is the fastest way to get a single service working. You’re essentially telling Cloudflare, “Hey, for this specific record, just act as a plain old DNS server. Don’t proxy it, don’t protect it, just resolve the name to the IP address I gave you.”

In your Cloudflare DNS settings, you find the record for your internal service (e.g., `internal-grafana`) and you click the orange cloud icon to turn it grey. This disables the proxy.

Warning: This is a band-aid, not a cure. When you “grey cloud” a record, you lose all of Cloudflare’s security and performance features for that subdomain (WAF, DDoS protection, CDN, etc.). If you publicly expose the IP, you’re on your own. This is best used for internal-only services where you’re just using Cloudflare for name resolution convenience.

Solution 2: The Permanent Fix – Cloudflare Tunnel (My Preferred Method)

Honestly, this is the way to go for 90% of use cases in 2024. Cloudflare Tunnel (formerly Argo Tunnel) is a piece of software you run on a server inside your network (or as a container) called cloudflared. It creates a secure, outbound-only connection to Cloudflare’s edge.

You no longer need to expose any ports on your firewall. You point your DNS record in Cloudflare to the tunnel, and the tunnel software securely funnels the traffic directly to your internal service (e.g., `http://10.0.1.50:3000`). It solves the DNS problem and dramatically improves your security posture at the same time.

A basic tunnel configuration in your config.yml might look like this:

tunnel: your-tunnel-uuid-here
credentials-file: /root/.cloudflared/your-tunnel-uuid-here.json

ingress:
  - hostname: internal-grafana.corp.techresolve.com
    service: http://10.0.1.50:3000
  - hostname: prometheus-internal.corp.techresolve.com
    service: http://10.0.1.51:9090
  # Catch-all, must be the last rule
  - service: http_status:404

Pro Tip: You can lock this down even further with Cloudflare Access, creating a Zero Trust policy so that only authenticated and authorized employees can even reach the login page of your internal tool. No VPN required. It’s a game-changer.

Solution 3: The ‘Nuclear’ Option – True Split-Horizon DNS

This is the old-school, heavyweight solution. A Split-Horizon (or Split-View) DNS setup means you run your own internal DNS server (like BIND, Unbound, or even Windows DNS). This server is configured to be the primary DNS resolver for all your internal machines.

Here’s how it works:

1. Your internal DNS server holds a “zone file” for corp.techresolve.com.
2. When a machine asks for internal-grafana.corp.techresolve.com, the internal DNS server responds directly with the private IP: 10.0.1.50.
3. When a machine asks for www.google.com, your internal DNS server doesn’t know the answer, so it forwards the request upstream to a public resolver (like 1.1.1.1) and caches the result.

This gives you complete control, but it also means you now own and are responsible for a critical piece of core network infrastructure. If your internal DNS server goes down, your whole network is blind.

This is a valid approach for large enterprises with dedicated network teams, but for most teams, the operational overhead is not worth it when Cloudflare Tunnels exist.

My Take? Stop Fighting The Network, Embrace The Tunnel.

Look, I get the frustration. Network issues, especially DNS, feel like black magic sometimes. But leaving a powerful platform like Cloudflare because of a fundamental (and solvable) architecture issue is a mistake. Before you start shopping for alternatives, give Cloudflare Tunnel a serious look. It aligns with modern Zero Trust security principles, it’s incredibly powerful, and it will solve this specific “internal vs. public” headache for good.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions