For folks that are unable to port forward on the local router (eg CGNAT) I made this post on doing it via a VPS. I’ve scoured the internet and didn’t find a complete guide.
Just remember that Cloudflare decrypts and re-encrypts all your data, so they can read absolutely everything that passes through those tunnels.