Feature request: native Cloudflare Tunnel (cloudflared) on USG FLEX H

rainpwn

Hello everyone,
I would like to open a discussion: would native Cloudflare Tunnel support be useful in uOS for the USG FLEX H series? I can show that it works on the hardware.

Why. Publishing an internal service today means a port forward and an open WAN port. With Cloudflare Tunnel the firewall only opens outbound connections to Cloudflare, and the public hostnames are managed in the Zero Trust dashboard. It works behind CGNAT and dynamic IPs, and Cloudflare Access can require a login before any request reaches the LAN. uOS already has a Cloudflare DDNS integration, so this feels like the natural next step.

Proof that it works. On my own FLEX 100H I run a custom firmware I have been developing as a personal project for a long time. I added Cloudflare Tunnel to it as a regular uOS feature:- a page under VPN > Cloudflare Tunnel with an enable switch and the tunnel token- the token stored encrypted, like the DDNS API token- the official cloudflared connector, running as an unprivileged service- status in the GUI and in the CLI (`show state vrf main cftunneld`)

Result: Cloudflare reports the tunnel Healthy, the firewall holds four QUIC connections to the edge, and a published hostname answered from the Internet with no inbound port open.
The custom firmware is not available to anyone: nobody else can run or test it, and I am not sharing how to modify it. This is only a use case to show what the feature looks like and that it is easy to integrate.

Screenshots, the test results and the implementation notes for Zyxel are here: https://rainpwn.blog/blog/zyxel-flex-h-cloudflare-tunnel/

Do you think this would be useful? I would like to hear opinions, use cases and concerns, from other users and from Zyxel.
Thanks!