Cloudflare Tunneling

Author Info
Author	mjlo
Discord	mjlo

This is a quick guide on how to set up a secure cloudflare tunnel to a resource behind a firewall, and then host that resource on securely on the public internet, with optional zero trust login. This is all free for basic usage.

• note I am not actually following these steps, but trying to walk through them after the fact. things will probably be off a little.

What you need

• Cloudflare Account (sign up at dash.cloudflare.com)
• a Domain (doesn't have to be transferred to cloudflare)
• a webserver (doesn't have to be secure or accessible on the internet)

Steps

• you don't need to transfer the domain, but you do have to host your DNS at cloudflare (free). I think if you transfer your domain, yearly renewal is about $10 USD per domain. Not sure if that's a good price or not. it might be cheaper than my current host, but not by much.
  • gather up all of your dns entries before switching unless your current DNS provider loses them when you switch.
• add a domain - Domains -> Overview -> Add domain
• when domain DNS is complete, go to Networking -> Tunnels -> Create Tunnel
  • it'll give you download links/commands to install cloudflared on your computer and connect cloudflared to your account.
• when you have a tunnel set up, open the tunnel and Add Route -> Published Application
  • subdomain is the domain url, ie: nuthatch.jadetimber.com
  • path is optional, if you want to redirect different folders to different servers. (ie nuthatch.jadetimber.com/test1 -> server1 / nuthatch.jadetimber.com/test2 -> server2
    • if no path is specified, it applies to the full domain
  • service URL is the url and port as the machine running cloudflared sees it. the webserver is listening on (ie. http://localhost:8080
    • can be http, as it's passing through an encrypted tunnel to a cloudflare server.
    • cloudflare will add a letsencrypt cert automatically and redirect all incoming public http traffic to https (ie http://nuthatch.jadetimber.com/meme.jpg will auto-forward to https://nuthatch.jadetimber.com/meme.jpg, which would read from http://localhost:8080/meme.jpg on your local webserver)
• if you want only you/specific people you trust to access this webpage click "Zero Trust"
  • Access Controls -> Policies -> Add a policy
    • add a rule to Include -> Emails -> enter the email address(es) you want to have access to this domain
    • Action: Allow
    • Policy Session Duration: when you log in, how long until that login expires (browser cookie specific, opening a different browser or an incognito window will ask again)
    • there may be other ways to do this, this is just what I have set up for myself.
  • Access Controls (still in Zero Trust) -> Applications -> Create new application (if it doesn't already exist)
    • add subdomain and path you set up earlier
    • Access Policies -> Add existing policy -> policy you created earlier

That should hopefully be all you need. If this needs updating/corrections, ping mjlo on discord, or edit it? idk wikis.