AUTOMATE NOW

Cloudflare Tunnel Access Guide – Server Configuration

Table of Contents

Verify SSH/SFTP Service

Make sure SSH is running on the Linux SFTP Server:

sudo systemctl status ssh

or:

sudo systemctl status sshd

Verify port 22:

sudo ss -lntp | grep :22

Test locally:

ssh localhost

The SSH service must work locally before configuring Cloudflare Tunnel.

Configure SFTP User Authentication

Use a dedicated SFTP user, for example:

your-sftp-user

Configure an authentication method for this user. The SFTP server may use either:

  • SSH key authentication
  • Password authentication

If SSH key authentication is used, add the client’s public SSH key to:

/home/your-sftp-user/.ssh/authorized_keys

Configure the required permissions:

chmod 700 /home/your-sftp-user/.ssh
chmod 600 /home/your-sftp-user/.ssh/authorized_keys
chown -R your-sftp-user:your-sftp-user /home/your-sftp-user/.ssh

The authentication method must be working locally before testing the connection through Cloudflare Tunnel.

Install Cloudflare Tunnel Connector

After the Tunnel is created in Cloudflare, run the installation command generated by Cloudflare on the  Linux SFTP Server.

Example:

sudo cloudflared service install <TUNNEL_TOKEN>

Verify:

sudo systemctl status cloudflared

Expected status:

active (running)

We recommend that you install and manage the Cloudflare Tunnel connector on your server so that you can maintain full control over access to your SFTP server.
You can refer to the Cloudflare Tunnel setup guide here: Cloudflare Tunnel Setup Guide

Verify Tunnel Connectivity

Check Cloudflare Tunnel logs:

journalctl -u cloudflared --no-pager -n 100

Follow logs in real time:

journalctl -u cloudflared -f

Restart the Tunnel if required:

sudo systemctl restart cloudflared

Firewall Requirement

Cloudflare Tunnel creates an outbound connection from the Linux SFTP Server to Cloudflare.

Therefore, public inbound access to:

TCP/22

is not required for this connection flow.

The server-side architecture is:
e3242711 0fe8 4908 8855 01c4c950c9a0

The existing IP whitelist access remains the primary method, while Cloudflare Tunnel is used as a backup access option.

Start / Stop Tunnel

Start:

sudo systemctl start cloudflared

Stop:

sudo systemctl stop cloudflared

Restart:

sudo systemctl restart cloudflared

Enable automatic startup:

sudo systemctl enable cloudflared

Final Validation

  • SSH/SFTP works on localhost:22.
  • SFTP user is configured.
  • SFTP user authentication is configured and works locally.
  • cloudflared is installed and running.
  • Cloudflare Tunnel status is healthy.
  • Clients can connect through the Tunnel.
  • Old VPN/IP whitelist access is removed only after successful validation.

Related Posts