Make your UniFi console reachable (Cloudflare Tunnel)

Expose your UniFi Access console to OpenCourt securely with a Cloudflare Tunnel — no open firewall ports — so OpenCourt can issue door codes and unlock doors.

This is the prerequisite for Connect UniFi Access to your club. UniFi Access runs entirely on your own console — there is no UniFi cloud for door control — so OpenCourt needs a way to reach that console over the internet. The safest way is a Cloudflare Tunnel: a small helper makes an outbound-only connection to Cloudflare, and Cloudflare gives OpenCourt a normal https://… address that points back to your console — no ports opened on your firewall, and no static IP needed. (About 30 minutes, one time.)

This is a networking task, not an everyday admin task, and OpenCourt doesn't do the install — if your club has a UniFi installer or IT person, hand it to them; it's quick for anyone who works with UniFi gear. You're welcome to share this guide with them.

Before you start, make sure the console is not enrolled in UniFi Identity Enterprise — that mode turns off the local API OpenCourt connects to, and no amount of tunnelling will get around it. Use standard UniFi Access. (If it's already on Identity Enterprise, move it back to standalone UniFi Access first.)

Before you begin

  • A Cloudflare account (the free plan is fine) with a domain managed in Cloudflare. If you don't have a domain on Cloudflare yet, add one — a cheap domain works; you point its nameservers at Cloudflare. Without a domain in Cloudflare there's nothing to attach the tunnel to.

  • One always-on device on the same network as the console to run the tunnel helper (cloudflared) — a NAS that runs Docker, a small always-on mini-PC, or a Raspberry Pi. Don't install it on the UniFi console itself — that setup gets wiped by firmware updates. Use a separate little box.

  • Your console's local IP address (for example 192.168.1.10), from your UniFi network settings.

Steps

  1. In the Cloudflare dashboard, go to Networking → Tunnels and select Create Tunnel. Choose Cloudflared, and give it a name that says what it's for — opencourt-access works.

  2. Cloudflare shows a one-line install command with a token. Run it on your always-on device — pick your operating system and it generates the exact command; the Docker one is usually easiest. Within a few seconds the tunnel appears on the Tunnels page with a Healthy status.

  3. Open the tunnel, go to its Routes tab, and select Add route → Published application. Fill it in like this:

    Field

    Value

    Hostname

    a subdomain plus your Cloudflare domain — for example access + yourclub.com, giving you access.yourclub.com

    Service URL

    your console's local address with port 12445 — for example https://192.168.1.10:12445 (use your real IP)

    TLS → No TLS Verify

    On, in the route's additional/origin settings

    No TLS Verify matters and it's the step people skip. The UniFi console presents a self-signed certificate, so without it Cloudflare refuses that last hop and the connection fails. It only affects the hop inside your own network — the tunnel → Cloudflare → OpenCourt path stays fully encrypted, and OpenCourt verifies the certificate on its end.

  4. Save. Your console is now reachable at https://access.yourclub.com. That hostname is what you paste into OpenCourt's Console address field — choose Cloudflare Tunnel as the connection type. Continue with Connect UniFi Access to your club.

Cloudflare reorganized this part of its dashboard, and older guides you'll find online say Zero Trust → Networks → Tunnels with a separate Public Hostnames tab. If your account still shows that layout, the settings are identical — it's the same tunnel, just reached a different way.

Keep it running

The little box running the tunnel must stay powered on. If it sleeps or loses power, the tunnel drops and OpenCourt can't sync door codes until it's back — so use an always-on NAS or mini-PC, not a laptop that sleeps. (A UPS on that device and the console keeps everything online through short power blips.)

The port-forward alternative

If you'd rather not run a tunnel, you can instead forward the console's port 12445 to the internet and give OpenCourt that address (for example https://your-public-host:12445), choosing Direct / port-forward when you connect. This needs a static (or otherwise stable) public IP so the address OpenCourt connects to doesn't change. OpenCourt pins the console's certificate on first connect. This works, but it opens a port on your firewall, so a tunnel is the recommended, safer option.

If something goes wrong

  • The tunnel shows "Down" or "Degraded" in Cloudflare — the cloudflared helper isn't running. Make sure the device it's installed on is powered on and the container/service is up, then re-check.

  • OpenCourt says it can't reach the console — check the route's three settings: the Service URL starts with https://, it ends with :12445, and No TLS Verify is on. Those are the usual culprits, and a missing No TLS Verify is the most common of the three. Also confirm the console itself is online on the local network.

  • Everything's connected but connect still fails — double-check the console isn't on UniFi Identity Enterprise (it disables the local API), and that your API token has all the required scopes. See Connect UniFi Access to your club.