From the moment an application is deployed, developers and IT spend time locking it down: configuring ACLs, rotating IP addresses, and using clunky solutions like GRE tunnels.
There’s a simpler and more secure way to protect your applications and web servers from direct attacks: Cloudflare Tunnel.
Ensure your server is safe, no matter where it’s running: public cloud, private cloud, Kubernetes cluster, or even a Mac mini under your TV.
"With Cloudflare, I've been able to reduce the administrative overhead of firewalls, reduce the attack surface, and get the added benefit of higher performance through the tunnel."
Co-Founder and CTO at Netwrk
Your origin IP addresses and open ports are exposed and vulnerable to advanced attackers, even when they’re behind your cloud-based security services. Some common ways to stop these direct DDoS or data breach attempts include creating ACLs and allowing incoming IP addresses, or establishing GRE tunnels and enabling IP security.
These approaches are painful to setup and maintain, lack fully integrated encryption, and can be slower or more costly.
The Tunnel daemon creates an encrypted tunnel between your origin web server and Cloudflare’s nearest data center — all without opening any public inbound ports.
After locking down all origin server ports and protocols using your firewall, any request on HTTP/S ports are dropped, including volumetric DDoS attacks. Data breach attempts — such as snooping of data in transit or brute force login attacks — are blocked entirely.
Tunnel lets you quickly secure and encrypt application traffic to any type of infrastructure, freeing you to focus on delivering great applications. Now you can encrypt origin traffic and hide your web server IP addresses so direct attacks can’t happen.
Learn more about the Tunnel story.
After you deploy the Tunnel daemon and lock down your firewall, only inbound web traffic through Cloudflare’s network ever reaches your application’s origin servers.
Now your web server’s firewall blocks volumetric DDoS attacks and customer data breach attempts.
Tunnel is the perfect solution for only allowing the right people to access internal applications (including those in development environments) that you’d like to make externally facing.
When Tunnel is combined with Cloudflare Access, users are authenticated by major identity providers, like Gsuite and Okta, without a VPN.
Applications once accessible to anyone through the origin IP are now only accessible by authenticated users through Cloudflare’s network.
To use Tunnel, you’ll need to enable your Argo subscription in the Cloudflare dashboard. Argo includes access to: Smart Routing, Tunnel, and Tiered Caching.
Argo Smart Routing improves application performance by routing visitors through the least congested and most reliable paths, using Cloudflare's private network. Smart Routing reduces average origin traffic latency by 30% and connection errors by 27%.
Setting up Tunnel to protect origin servers and ports is easy
$ brew install cloudflare/cloudflare/cloudflared ==> Installing cloudflared from cloudflare/cloudflare ==> Downloading https://warp.cloudflare.com/ dl/warp-2018.3.0-darwin-amd64.tgz
$ cloudflared login
$ cloudflared --hostname tunnel.example.com --url http://localhost:8000 INFO Registered at https://tunnel.example.com
$ netcat -v -z [Origin IP Address] 80 [Origin IP Address] 80 (http):
Connection refused $ netcat -v -z [Origin IP Address] 443 [Origin IP Address] 443 (https): Connection refused
Easy-to-install agent with low performance overhead
Custom tags to identify tunnels
Encrypted tunnels with TLS (origin-side certificates)
Application and protocol-level error logging