Make sure to create CF tunnel to your server and to reject all traffic frin other sources, or to accept traffic only from known CF ips. Otherwise, you're still exposed, even if CF WAF works.