You should be able to assign that vlan to a port (ex. eth0, eth1)

Just wanted to add this link explaining how to use tunnels in a more privacy respecting way

https://help.nextcloud.com/t/is-cloudflare-tunnel-safe-privacy-focused/150268/2

Problems with TLS (free option of routing on cloudlfare tunnels)

interception (or HTTPS interception if applied particularly to that protocol) is the practice of intercepting an encrypted data stream in order to decrypt it, read and possibly manipulate it, and then re-encrypt it and send the data on its way again. This is done by way of a “transparent proxy”: the interception software terminates the incoming TLS connection, inspects the HTTP plaintext, and then creates a new TLS connection to the destination.