Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.
Instrucciones de origen · Vista previa de solo lectura
name
deploying-cloudflare-access-for-zero-trust
description
Deploying Cloudflare Access with Cloudflare Tunnel to provide zero trust access to self-hosted and private applications, configuring identity-aware access policies, device posture checks, and WARP client enrollment for VPN replacement.
When replacing VPN infrastructure with identity-aware application access using Cloudflare One
When exposing self-hosted internal applications through Cloudflare Tunnel without opening inbound ports
When implementing ZTNA for a distributed workforce accessing web applications, SSH, and RDP services
When needing a cost-effective zero trust solution with integrated DLP, CASB, and SWG capabilities
When securing contractor and third-party access to specific applications without full network access
Do not use for applications requiring persistent UDP connections not supported by Cloudflare Tunnel, for environments requiring air-gapped or fully on-premises access control, or when regulatory requirements prohibit routing traffic through third-party cloud infrastructure.
Common Misconfigurations & Verification
Origin reachable bypassing Access: Access only enforces on the hostname proxied through Cloudflare. If the origin has a public IP, or the tunnel-backed service can be hit at its raw server IP, an attacker skips the policy. Use Cloudflare Tunnel (no inbound ports), lock the origin firewall to Cloudflare IP ranges, and enable Authenticated Origin Pulls.
No default-deny / Bypass policy too broad: a leftover bypass policy or an include of everyone makes the app public. Every Access app must end with an explicit deny and scope include to specific groups/emails.
require block omitted: a policy that only sets include for an IdP group verifies identity but never checks the device. Add a require with the device_posture integration (CrowdStrike, disk_encryption, os_version) so an unmanaged device fails.
Service tokens over-scoped: an Any-Access-Service-Token policy bypasses human auth, scope tokens to one app and rotate them.
Verify: from an un-enrolled network curl https://wiki.company.com and confirm you are redirected to the IdP, never straight to the app; then curl the origin server IP directly and confirm it refuses. Sign in from a device failing the posture rule and confirm Action: deny / Allowed: false in the access_requests Logpush dataset.
Prerequisites
Cloudflare account with Zero Trust subscription (Free for up to 50 users, paid plans for larger teams)
Domain name managed by Cloudflare DNS (or ability to add CNAME records)
Linux, Windows, or macOS server to run cloudflared tunnel daemon
Identity provider: Okta, Microsoft Entra ID, Google Workspace, GitHub, or any SAML/OIDC provider
Cloudflare WARP client for device-level enrollment (optional but recommended)
Workflow
Step 1: Create a Cloudflare Tunnel to Internal Applications
Install cloudflared and create a persistent tunnel to expose internal services.
# Install cloudflared on Ubuntu/Debian
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb \
-o cloudflared.deb
sudo dpkg -i cloudflared.deb
# Authenticate cloudflared with your Cloudflare account
cloudflared tunnel login
# Create a named tunnel
cloudflared tunnel create internal-apps
# Output: Created tunnel internal-apps with id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx# Configure tunnel routes to internal applicationscat > ~/.cloudflared/config.yml << 'EOF'
tunnel: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
credentials-file: /home/admin/.cloudflared/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json
ingress:
- hostname: wiki.company.com
service: http://localhost:8080
- hostname: git.company.com
service: http://10.1.1.50:3000
- hostname: grafana.company.com
service: http://10.1.1.60:3000
- hostname: ssh.company.com
service: ssh://localhost:22
- hostname: rdp.company.com
service: rdp://10.1.1.100:3389
# Catch-all rule (required)
- service: http_status:404
EOF
# Route DNS to the tunnel
cloudflared tunnel route dns internal-apps wiki.company.com
cloudflared tunnel route dns internal-apps git.company.com
cloudflared tunnel route dns internal-apps grafana.company.com
# Run tunnel as a systemd servicesudo cloudflared service install
sudo systemctl enable cloudflared
sudo systemctl start cloudflared
# Verify tunnel status
cloudflared tunnel info internal-apps
Step 2: Configure Identity Provider Integration
Set up authentication with your organization's identity provider.
Cloudflare Tunnel (cloudflared): Daemon creating encrypted tunnels from internal networks to Cloudflare edge
WARP Client: Cross-platform endpoint agent for device enrollment, DNS filtering, and private network routing
Cloudflare Gateway: Secure Web Gateway providing DNS/HTTP filtering and DLP inspection
Cloudflare Logpush: Real-time log streaming to external SIEM and storage destinations
Access for Infrastructure: SSH and RDP access with short-lived certificates and session recording
Common Scenarios
Scenario: Startup with 200 Employees Deploying Zero Trust from Scratch
Context: A SaaS startup with 200 employees and no existing VPN wants to provide secure access to internal tools (Grafana, internal APIs, staging environments) running on AWS. Budget is limited, and the team has no dedicated security staff.
Approach:
Start with Cloudflare Zero Trust free tier (up to 50 users) for proof of concept
Deploy one cloudflared tunnel on an EC2 instance in the production VPC
Expose Grafana, internal wiki, and staging apps through tunnel with DNS routing
Configure Google Workspace as IdP for SSO authentication
Create Access policies requiring @company.com email domain for all applications
Add device posture checks for disk encryption and OS version
Upgrade to paid plan and deploy WARP client to all employee laptops via MDM
Enable Gateway DNS filtering and HTTP inspection for malware protection
Configure Logpush to send access logs to Datadog for monitoring
Pitfalls: Cloudflare root certificate must be installed on all devices for TLS inspection to work; some applications may break with TLS interception. Tunnel failover requires running multiple cloudflared instances or using Cloudflare's replicas feature. Access policies should always include a default deny rule. WebSocket applications may require specific tunnel configuration.
