Basically you have to run a mini server (I use a docker container) called a cloudflare endpoint. From there you just enter the IPs and keys that your cloudflare account tells you to in the tunnel creation menu, and it all pretty much connects from there.

Then, on the cloudflare side, you make different subdomains point to local ports. So, for example, for connecting to qbittorrent web client, in the cloudflare menus I can make qbit.domain.example point to localhost:8080. In this case, it means "localhost" relative to the cloudflare access point you've made (which in my case can use localhost because its hosted on the same machine as my other docker containers, but if they are on different machines you can use local IP addresses).

I use their free plan, which is all you need if you're just serving web content to a small number of users. You might need a domain to do this, but I don't recall.

My layman's understanding is you basically make cloudflare be the router, so their server/ports are what is exposed to the open internet rather than your local router.