cloudflared or ssh tunnel for reverse-proxying on-premise servers

Exploring what we can do with cloudflare - 

1. If we want to run a server on another port, cloudflare does support ports other than 80 and 443 - via origin rules
https://developers.cloudflare.com/rules/origin-rules/features/#destination-port
via
https://old.reddit.com/r/CloudFlare/comments/12km27p/using_non_http_https_ports/
dynamic dns with
https://developers.cloudflare.com/dns/manage-dns-records/how-to/managing-dynamic-ip-addresses/#ddclient
https://dnsomatic.com/docs/software

Also, a list of supported ports?

https://developers.cloudflare.com/fundamentals/reference/network-ports/

2. But BSNL, Airtel etc would block ports. So, it would be far easier to use a tunnel with an outgoing ssh connection to a VM or something like that. That way, we don't have to depend on port-forwarding and availability of unblocked ports. We can use -R in the ssh tunnel for reverse-proxying.

3. But then, we may not even need a VM - currently Cloudflare Zero Trust Web access supports private apps, which would ask clients for authentication, and then allow them to connect to our private server via cloudflared tunnels.
https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/

and give it a public hostname with

https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/remote-management/

Starting from the page below, we can go "next, next" to finish all the steps to achieve ZT web access.

https://developers.cloudflare.com/learning-paths/zero-trust-web-access/connect-private-applications/