Private Origin Tunnel
Serve your site through the CDN without exposing your server. A small connector dials out to CDNShark over an encrypted tunnel — no public IP, no port forwarding, no inbound firewall rules.
Your origin address is never published, so it cannot be scanned or attacked directly.
Why a Private Origin Tunnel
A CDN normally needs an origin it can reach — which means a public IP, an open port, and a server that anyone on the internet can find. This removes that requirement entirely.
Nothing connects to your server. The connector dials out and keeps the tunnel open, so there is no listening service to find and no port to forward.
Your server's real address is never published in DNS. Attackers cannot bypass the CDN to hit your origin directly, because there is nothing to hit.
Home connections, office LANs, private VPCs, a machine with only a dynamic IP — if it can reach the internet outbound, it can serve your site.
Traffic between our edge and your origin runs inside a WireGuard tunnel. The key that identifies your machine is generated locally and never leaves it.
A single line installs the connector, verifies its checksum and registers it. No configuration files to write — everything is managed from your dashboard.
Caching, WAF, rate limiting, geo-blocking and free TLS all still apply. The tunnel changes how we reach your origin, not what we do for your visitors.
How It Works
Create a tunnel
Add a tunnel in your dashboard. You get a one-time install command.
Run one command
The connector installs on your server and dials out to us — nothing dials in.
Point a domain at it
Choose Private Tunnel as the origin on any domain or pull zone.
We deliver your site
Visitors hit the nearest edge; cache misses travel back through the tunnel.
Installed in Under a Minute
curl -fsSL https://cdnshark.com/install/tunnel.sh \
| sudo bash -s -- --token=YOUR_TOKEN
Downloads the connector, verifies its SHA-256 checksum, registers it and starts it as a
service. Removing it later is --uninstall.
Invoke-WebRequest $url -OutFile cdnshark-tunnel.exe
.\cdnshark-tunnel.exe enroll --token=YOUR_TOKEN
# then register it as a startup taskThe full PowerShell block — download, checksum verification and startup task — is shown on your tunnel page after you create it.
Runs on Linux, macOS and Windows, on both x86-64 and ARM. No root-level network changes: it creates no virtual adapter and never routes your LAN.
A Good Fit For
Serve a real site from a machine on a residential or office connection, without exposing it or asking your ISP for a static IP.
Publish an application that lives inside a private VPC or on an internal subnet, with no load balancer and no public ingress.
Put a real domain and real TLS in front of a build server without opening it to the internet.
When an origin has ever been hit by a direct-to-IP attack, removing the public address removes the attack surface.
A tunnel publishes one HTTP or HTTPS service per tunnel, on any port you choose. That covers websites, APIs and web applications. Create additional tunnels to publish more services.
The connector needs outbound UDP to reach us. Most networks allow this, but some strict corporate firewalls do not — a TCP fallback is in development. Publishing raw TCP services such as SSH or a database, and browser-based access controls for private admin tools, are on the roadmap and not available today. This is a private-origin tunnel, not a VPN: it never gives anyone access to the rest of your network.
Included With Your Plan
Every plan includes private tunnels — two on the free plan, more on paid plans. Need extras? They are $1.99 per tunnel per month, added from Resource Add-ons whenever you need them.
Put your origin behind the CDN — without exposing it.
Create a tunnel and install the connector in about a minute.
Get Started Free Read the Guide