We use a VPC called adm which is peered to other VPCs ( stg/qa/prod.). This instance will need to have access to your internal services, so, you have to place it on a VPC that has access to these services. We will run cloudflared on this instance to create and manage Argo Tunnels and DNS records for accessing internal services. SetupĪ proxy instance will be used to access internal services. Once you're authenticated, Cloudflare will return a certificate file, cert.pem, that we will need to save to manage our tunnels. This command will open a browser and prompt you to authenticate with your Cloudflare account. Once we have installed cloudflared, we need to run the following command: cloudflared tunnel login We need to generate a certificate that cloudflared will use to create tunnels and change DNS routing. Enable Argo Smart Routing for your account.Setting up Cloudflare Argo Tunnels and AccessĪrgo Tunnel relies on cloudflared to create a persistent connection between your web server and the Cloudflare network. IT teams can build rules that enforce authentication using their existing identity provider.īy combining Argo Tunnels with Access, we can achieve a great solution to give access to your internal services to people in a secure way, without exposing your services publicly and avoiding the complexity of a VPN service. What is Cloudflare Access?Ĭloudflare Access enables distributed account access control integrating with major identity providers (IdP), such as Google, Okta, Microsoft Azure AD, GitHub, Facebook, OneLogin. Argo Tunnel also ensures requests route through Cloudflare before reaching the web server, so you can be sure attack traffic is stopped with Cloudflare’s WAF and Unmetered DDoS mitigation, and authenticated with Access if you’ve enabled those features for your account.įor more information, check out Cloudflare Argo Tunnel docs and How Argo Tunnel works. Instead, a lightweight daemon runs in your infrastructure and creates outbound-only connections to Cloudflare’s edge.Īrgo Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs. With Argo Tunnel, you do not expose an external IP from your infrastructure to the Internet. What is Cloudflare Argo Tunnel?Īrgo Tunnel provides a secure way to connect your origin to Cloudflare without a publicly routable IP address.

We are going to use Terraform to create the setup, and AWS as a cloud provider, but it should be adaptable to other IaC tools and cloud providers.Īrgo Tunnels + Access provides us with an easy way to have and manage fine-grained access control over internal services.

In this article, we are going to explain our setup based on Cloudflare Argo Tunnels + Cloudflare Access that can be used as an alternative to a VPN.

Cloudflare tunnel for ssh