DLDanpLab
DanpLab · Lab NoteArchitettura operativa

Zero Trust with Cloudflare: Architecture and Practical Implementation

How to implement Zero Trust access with Cloudflare Access and Tunnel in a hybrid on-premise environment. Practical guide with architecture, configuration steps and best practices.

2 min readBased on real operational use
zero-trustcloudflaresecuritynetworking

What is the Zero Trust Model

The Zero Trust model is based on a simple principle: never trust, always verify. Unlike the traditional perimeter model (firewall → inside is safe), Zero Trust treats every request as potentially hostile, regardless of where it comes from.

"Never trust, always verify" — John Kindervag, Zero Trust framework creator

Why It Matters Today

  • The network perimeter no longer exists: remote workers, hybrid cloud, BYOD
  • Traditional VPNs grant too much access to the internal network
  • Lateral movement after a breach is the most dangerous attack vector

Architecture with Cloudflare

┌─────────────────────────────────────────────────────────┐
│                    INTERNET                              │
└────────────────────────┬────────────────────────────────┘
                         │
              ┌──────────▼──────────┐
              │  Cloudflare Edge    │
              │  (Access + Tunnel)  │
              └──────────┬──────────┘
                         │ Auth + Policy Check
                    ┌────▼────┐
                    │  IdP    │ (Entra ID / Google)
                    └────┬────┘
                         │ Validated Token
              ┌──────────▼──────────┐
              │  Cloudflare Tunnel  │
              │  (cloudflared)      │
              └──────────┬──────────┘
                         │ Outbound connection only
              ┌──────────▼──────────┐
              │  Internal Server    │
              │  192.168.x.x        │
              └─────────────────────┘

Step 1: Install cloudflared on the server


curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb
cloudflared --version

Step 2: Authenticate

cloudflared tunnel login

Step 3: Create and configure the tunnel

cloudflared tunnel create my-homelab-tunnel

Create /etc/cloudflared/config.yml:

tunnel: <TUNNEL-ID>
credentials-file: /root/.cloudflared/<TUNNEL-ID>.json

ingress:
  - hostname: app.yourdomain.com
    service: http://localhost:8080
  - hostname: ssh.yourdomain.com
    service: ssh://localhost:22
  - service: http_status:404

Step 4: Configure Cloudflare Access

  1. Go to Zero Trust Dashboard → one.dash.cloudflare.com
  2. Access → Applications → Add → Self-hosted
  3. Set domain: app.yourdomain.com
  4. Add policy: Allow emails ending with @yourcompany.com

Step 5: Run as a service

sudo cloudflared service install
sudo systemctl start cloudflared
sudo systemctl enable cloudflared

Best Practices

  • ✅ One tunnel per application — better isolation
  • ✅ Mandatory MFA — configure in your IdP
  • ✅ Short session duration — 8h max, 1h for critical apps
  • ✅ Audit logs enabled — retain at least 30 days
  • ❌ Don't expose SSH directly — use cloudflared access ssh

Resources