Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.
Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.
When replacing VPN infrastructure with identity-aware application access using Cloudflare One
When exposing self-hosted internal applications through Cloudflare Tunnel without opening inbound ports
When implementing ZTNA for a distributed workforce accessing web applications, SSH, and RDP services
When needing a cost-effective zero trust solution with integrated DLP, CASB, and SWG capabilities
When securing contractor and third-party access to specific applications without full network access
Do not use for applications requiring persistent UDP connections not supported by Cloudflare Tunnel, for environments requiring air-gapped or fully on-premises access control, or when regulatory requirements prohibit routing traffic through third-party cloud infrastructure.
Prerequisites
Cloudflare account with Zero Trust subscription (Free for up to 50 users, paid plans for larger teams)
Domain name managed by Cloudflare DNS (or ability to add CNAME records)
Linux, Windows, or macOS server to run cloudflared tunnel daemon
Identity provider: Okta, Microsoft Entra ID, Google Workspace, GitHub, or any SAML/OIDC provider
Cloudflare WARP client for device-level enrollment (optional but recommended)
Workflow
Step 1: Create a Cloudflare Tunnel to Internal Applications
Install cloudflared and create a persistent tunnel to expose internal services.
# Install cloudflared on Ubuntu/Debian
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb \
-o cloudflared.deb
sudo dpkg -i cloudflared.deb
# Authenticate cloudflared with your Cloudflare account
cloudflared tunnel login
# Create a named tunnel
cloudflared tunnel create internal-apps
# Output: Created tunnel internal-apps with id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx# Configure tunnel routes to internal applicationscat > ~/.cloudflared/config.yml << 'EOF'
tunnel: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
credentials-file: /home/admin/.cloudflared/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json
ingress:
- hostname: wiki.company.com
service: http://localhost:8080
- hostname: git.company.com
service: http://10.1.1.50:3000
- hostname: grafana.company.com
service: http://10.1.1.60:3000
- hostname: ssh.company.com
service: ssh://localhost:22
- hostname: rdp.company.com
service: rdp://10.1.1.100:3389
- service: http_status:404
EOF
cloudflared tunnel route dns internal-apps wiki.company.com
cloudflared tunnel route dns internal-apps git.company.com
cloudflared tunnel route dns internal-apps grafana.company.com
cloudflared service install
systemctl cloudflared
systemctl start cloudflared
cloudflared tunnel info internal-apps
# Catch-all rule (required)
# Route DNS to the tunnel
# Run tunnel as a systemd service
sudo
sudo
enable
sudo
# Verify tunnel status
Step 2: Configure Identity Provider Integration
Set up authentication with your organization's identity provider.
Cloudflare Tunnel (cloudflared): Daemon creating encrypted tunnels from internal networks to Cloudflare edge
WARP Client: Cross-platform endpoint agent for device enrollment, DNS filtering, and private network routing
Cloudflare Gateway: Secure Web Gateway providing DNS/HTTP filtering and DLP inspection
Cloudflare Logpush: Real-time log streaming to external SIEM and storage destinations
Access for Infrastructure: SSH and RDP access with short-lived certificates and session recording
Common Scenarios
Scenario: Startup with 200 Employees Deploying Zero Trust from Scratch
Context: A SaaS startup with 200 employees and no existing VPN wants to provide secure access to internal tools (Grafana, internal APIs, staging environments) running on AWS. Budget is limited, and the team has no dedicated security staff.
Approach:
Start with Cloudflare Zero Trust free tier (up to 50 users) for proof of concept
Deploy one cloudflared tunnel on an EC2 instance in the production VPC
Expose Grafana, internal wiki, and staging apps through tunnel with DNS routing
Configure Google Workspace as IdP for SSO authentication
Create Access policies requiring @company.com email domain for all applications
Add device posture checks for disk encryption and OS version
Upgrade to paid plan and deploy WARP client to all employee laptops via MDM
Enable Gateway DNS filtering and HTTP inspection for malware protection
Configure Logpush to send access logs to Datadog for monitoring
Pitfalls: Cloudflare root certificate must be installed on all devices for TLS inspection to work; some applications may break with TLS interception. Tunnel failover requires running multiple cloudflared instances or using Cloudflare's replicas feature. Access policies should always include a default deny rule. WebSocket applications may require specific tunnel configuration.
