Zero Trust Access with Cloudflare

Exposing self-hosted services to the internet traditionally requires port forwarding, SSL certificates, constant updates and an attack surface that grows with every added service. The Zero Trust model reverses this logic: no open ports, no implicit trust, every access verified.

Cloudflare Zero Trust (Tunnel + Access) as the publishing and authentication layer for all internal services. The tunnel establishes an outbound encrypted connection to Cloudflare — no NAT rules, no exposed public IP. Cloudflare Access manages who can access what and how.

The cloudflared daemon runs in a dedicated LXC and maintains outbound connections to the nearest Cloudflare PoPs. The tunnel configuration file maps each hostname to an internal service.

Each hostname has an associated Access policy: OTP email authentication, or service token for machine-to-machine access.

For services requiring the highest security level (Ollama API, management interfaces), mTLS is used with client certificates issued by the internal PKI. Only clients with a valid certificate can establish the connection — regardless of Cloudflare Access authentication.

The internal CA is managed with cfssl; client certificates are distributed via Intune policy for corporate devices and manually for the lab.

Three isolation levels: network VLANs (L2 traffic separation), MikroTik firewall rules (L3/L4 control), Cloudflare Access (application authentication). A service exposed on danplab.com cannot reach the management VLAN even if Cloudflare access were compromised.