Make your UniFi console reachable (Cloudflare Tunnel)

Expose your UniFi Access console to OpenCourt securely with a Cloudflare Tunnel — no open firewall ports — so OpenCourt can issue door codes and unlock doors.

UniFi Access runs entirely on your own console — there is no UniFi cloud for door control — so OpenCourt needs a way to reach that console over the internet. There are two supported ways to provide it, and this guide covers one of them. A Cloudflare Tunnel works like this: a small helper makes an outbound-only connection to Cloudflare, and Cloudflare gives OpenCourt a normal https://… address that points back to your console — no ports opened on your firewall, no static IP needed, and it works behind CGNAT. (About 30 minutes, one time.)

A port-forward is the way we recommend, and it's simpler — read How OpenCourt reaches your console before following this guide. A port-forward takes about 10 minutes, adds no extra equipment, and has nothing that can silently stop running. This guide is the right one only in specific cases.

Use the tunnel if: your ISP uses CGNAT (a port-forward is then impossible), you can't get a static IP and don't want to rely on DDNS, your security policy forbids an open inbound port, or you already run an always-on NAS or server and are happy maintaining it.

⚠️ The main trade-off: a tunnel needs a computer that is always on running the helper program. If that machine reboots without restarting it, or its drive fails, door codes stop working and nothing looks like it changed. A port-forward has no such component. Only choose this path if someone will notice when that box goes down.

Before you begin

A Cloudflare account (the free plan is fine) with a domain managed in Cloudflare. If you don't have a domain on Cloudflare yet, add one — a cheap domain works; you point its nameservers at Cloudflare. Without a domain in Cloudflare there's nothing to attach the tunnel to.
One always-on device on the same network as the console to run the tunnel helper (cloudflared) — a NAS that runs Docker, a small always-on mini-PC, or a Raspberry Pi. Don't install it on the UniFi console itself — that setup gets wiped by firmware updates. Use a separate little box.
Your console's local IP address (for example 192.168.1.10), from your UniFi network settings.

Steps

In the Cloudflare dashboard, go to Networking → Tunnels and select Create Tunnel. Choose Cloudflared, and give it a name that says what it's for — opencourt-access works.
Cloudflare shows a one-line install command with a token. Run it on your always-on device — pick your operating system and it generates the exact command; the Docker one is usually easiest. Within a few seconds the tunnel appears on the Tunnels page with a Healthy status.

Open the tunnel, go to its Routes tab, and select Add route → Published application. Fill it in like this:

Field	Value
Hostname	a subdomain plus your Cloudflare domain — for example `access` + `yourclub.com`, giving you `access.yourclub.com`
Service URL	your console's local address with port 12445 — for example `https://192.168.1.10:12445` (use your real IP)
TLS → No TLS Verify	On, in the route's additional/origin settings

No TLS Verify matters and it's the step people skip. The UniFi console presents a self-signed certificate, so without it Cloudflare refuses that last hop and the connection fails. It only affects the hop inside your own network — the tunnel → Cloudflare → OpenCourt path stays fully encrypted, and OpenCourt verifies the certificate on its end.

Save. Your console is now reachable at https://access.yourclub.com. That hostname is what you paste into OpenCourt's Console address field — choose Cloudflare Tunnel as the connection type. Continue with Connect UniFi Access to your club.

Keep it running

The little box running the tunnel must stay powered on. If it sleeps or loses power, the tunnel drops and OpenCourt can't sync door codes until it's back — so use an always-on NAS or mini-PC, not a laptop that sleeps. (A UPS on that device and the console keeps everything online through short power blips.)

The port-forward alternative

If you'd rather not run a tunnel, you can instead forward the console's port 12445 to the internet and give OpenCourt that address (for example https://your-public-host:12445), choosing Direct / port-forward when you connect. This needs a static (or otherwise stable) public IP so the address OpenCourt connects to doesn't change. OpenCourt pins the console's certificate on first connect. This works, but it opens a port on your firewall, so a tunnel is the recommended, safer option.

If something goes wrong

The tunnel shows "Down" or "Degraded" in Cloudflare — the cloudflared helper isn't running. Make sure the device it's installed on is powered on and the container/service is up, then re-check.
OpenCourt says it can't reach the console — check the route's three settings: the Service URL starts with https://, it ends with :12445, and No TLS Verify is on. Those are the usual culprits, and a missing No TLS Verify is the most common of the three. Also confirm the console itself is online on the local network.
Everything's connected but connect still fails — double-check the console isn't on UniFi Identity Enterprise (it disables the local API), and that your API token has all the required scopes. See Connect UniFi Access to your club.

Connect UniFi Access to your club — the next step, once the console is reachable.
How access controls work in OpenCourt