Securely Access Internal Servers Over the Internet Using Cloudflare Tunnels

Cloudflare Tunnels: An Easy Way to Access Internal Servers

Cloudflare Tunnels provide a secure, efficient, and straightforward way to access internal servers, network devices, and resources from the public internet—without the hassle of setting up and managing a VPN.

For a detailed guide on setting up a Cloudflare account and configuring tunnels with Docker, visit Cloudflare Tunnel Easy Setup Guide.

Prerequisites for Setting Up Cloudflare Tunnels

To follow this guide, ensure you have the following:

• An Ubuntu 22.04 server hosting two or more websites/applications.
• Apache installed and running, with properly configured virtual hosts.
• A public domain (we'll use example.com for this guide).
• A Cloudflare account already set up (free accounts are enough).
• A Cloudflared Connector to link your server to Cloudflare.

Server Setup Overview

In this setup, an Ubuntu 22.04 server hosts three web applications or websites, each accessible locally via the following addresses:

• projectA.local.com
• projectB.local.com
• projectC.local.com

Steps to Configure Cloudflare Tunnels

Update Domain Nameservers

Before proceeding, confirm that your Cloudflare account is set up, and the domain's nameservers are updated to Cloudflare's nameservers.

Create a Tunnel

1. Log into your Cloudflare Dashboard and select your domain.
2. Navigate to the Traffic menu on the left and select Cloudflare Tunnel.
3. Click the Launch Cloudflare Zero Trust button to access advanced configurations.
4. In the Cloudflare Zero Trust Dashboard, select Tunnels from the left-hand menu.
5. Click Create Tunnel, provide a suitable name, and save.
6. Choose the appropriate environment (in this case, Debian) and copy the installation command for the connector.

Install the Connector

On your Ubuntu server, open the terminal and run the following commands to download and install the Cloudflare connector:

Remember to replace <cloudflare-key> with the proper key.

1curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb && \
2sudo dpkg -i cloudflared.deb && \
3sudo cloudflared service install <cloudflare-key>

Add Local Services

1. Return to the Cloudflare Zero Trust Dashboard and select the tunnel you created.

2. Click Configure and then navigate to the Public Hostname tab.

3. Click Add a Public Hostname, and configure the following:

   • Subdomain: financeapp
   • Domain: example.com
   • Path: (Leave blank unless the app is not hosted at the root folder.)
   • Type: HTTP
   • URL: projectA.local.com (local address of the application).

4. Repeat these steps to add more local resources as needed.

Verify Access

Access your resources securely from the internet using the subdomain configured earlier.
For instance, financeapp.example.com should now route traffic securely to projectA.local.com on your local server.

Add an Extra Security Layer

To enhance security, configure the following in the Cloudflare Zero Trust Dashboard:

• Authentication: Use Google or other identity providers.
• IP Filtering: Exclude or allow specific IP ranges to access the resources.

Summary

This method enables hosting servers locally while allowing secure, remote access via the internet without needing costly cloud servers. Cloudflare Tunnels provide added security to protect against external threats.