AUTOMATE NOW

Cloudflare Tunnel Access Guide

Table of Contents

Cloudflare Tunnel Configuration

Go to Cloudflare Dashboard → Networking → Tunnels → Create Tunnel → Cloudflared.

  • Set the Tunnel name
  • Set the Tunnel environment
    • Operating System : Window  or Linux/Debian
    • Architecture: 64-bit
Create a new tunnel
Figure 1 : Create a new tunnel

With Linux, cloudflare will generate an installation command similar to:

sudo cloudflared service install <TUNNEL_TOKEN>

Install cloudflared and run this command on the Linux SFTP Server.

Verify that the Tunnel status becomes HEALTHY.

Cloudflare Access Configuration 

Create Published Application

Go to Networking → Tunnels → nla-sftp-tunnel → Routes → Add route → Published application.

Figure 2 : Create published application
Figure 2 : Create published application

Configure:

Hostname: <your-full-hostname>
Service: SSH
URL: localhost:22

Equivalent service URL:

ssh://localhost:22

Create Cloudflare Access Application

Go to Zero Trust → Access controls → Applications → Add an application → Self-hosted.

Figure 3 : Create new self-host application
Figure 3 : Create new self-host application

Configure:

Application Name: NLA SFTP Access
Domain: <your_domain>

Access Policy Configuration

In this Cloudflare Access Application, create two policies to support both Email OTP access and Service Token access. 

Allow Access by Email

Create Policy

Create an Allow policy for authorized users only. 

Figure 4 : Set access policies for self-host application
Figure 4 : Set access policies for self-host application

Example:

Policy Name: Allow Beehexa SFTP Access
Action: Allow

Allow specific users:

team@beehexa.com
dinh.thai@beehexa.com

Using specific accounts is recommended instead of allowing the entire email domain.

Configure One-Time PIN

Back to your Cloudflare Access Application, at Authentication > Choose available identity providers for this application > Select onetimepin

Figure 5: Setup authentication for Cloudflare Access Application
Figure 5: Setup authentication for Cloudflare Access Application

One-Time PIN determines how the user authenticates.

The Access Policy determines who is allowed to connect.

Allow Access by Service Token

Create Service Token

First, in Cloudflare Zero Trust, create a Service Token for automated server-to-server access.

Go to: Zero Trust > Access controls > Service credentials > Service Tokens

Click Create Service Token.

Figure 6 : Create service tokens
Figure 6 : Create service tokens

Example:

Service Token Name: Beehexa SFTP Service
Duration: 1 year

After creating the token, Cloudflare will provide:

Client ID
Client Secret

Save both values securely.

The Client Secret is only displayed when the token is created. Make sure to copy and save it before closing the page.

Then go back to your Cloudflare Access Application and create a policy: 

Create Policy

Create another policy for server-to-server access.

Example:

Policy Name: Allow Beehexa SFTP Service
Action: Service Auth


Under Include, select:

Service Token
> Service Token created in the previous step 

The Service Token allows automated services to access the SFTP server without requiring Email OTP or browser login.

Related Posts