Restrict Access to Your Cloudflare Tunnel Applications

[@zadekeys2194]

If you setup CloudflareD (CloudFlare DDNS) and whitelist that hostname for access, then if your IP changes, you should still have full access via the DDNS hostname.

[@AhmadYusuf85]

Thanks for the video, I used to use the Email method for sometime , but recently I managed to get the Cloudflare tunnel to use Authelia for authentication which gives me full control on what subdomains to bypass, single factor or two factor authentication. Was done using the OpenID login method in Cloudflare authentication and adding a new client in Autherlia configurations file

[@doddezx]

Any writeup you have on how you did that. Also how is your Authelia exposed to the net via the tunnel as well?

[@nolasaint638]

Simple thank you. New to IT and try to learn by doing home IT projects. After trying other you tube examples, this is the one that worked for me. Big thanks and keep up the good work.

[@MrXrockyx]

Would love to see a video on how to bypass when my phone is on the WARP VPN. With this, apps like Homeassistant would automatically work, but I did not manage that :(

[@kshitijkadlag]

Hey! I've followed the steps in one of your previous videos to setup a Nextcloud instance using Docker and Portainer. I'm using Cloudflare Tunnel to access it on the internet, but I'm unable to use video calls in Nextcloud Talk because it needs a Turn Server. Could you please make a video on how to set that up in Docker using Portainer?

[@vgamesx1]

Sorry for giving a late reply, that would be nice since there isn't a lot of information on setting those up, however do know that the entire point of a TURN server is that it sits outside your NAT exposed to the internet, which is exactly why I gave up on that idea, if you're going to do it then it would be best to host one on a VPS service away from your home network, otherwise if you really want to use Nextcloud Talk then I recommend just setting up a VPN or find a different service such as Jitsi Meet or Matrix.

[@PrimalDashes]

Absolutely loving what you do, sir. I've been going through your videos and perfecting my setup on my server and you do a great job of walking through installs. I would love to see you setup Shlink Url Shortener in containers. I have it running, but it has a bunch of quirks and setup can be tricky, would love to see your complete start to finish on it as I'm sure I'm still missing pieces

[@Zazpi_Zezenak]

thanks a lot for this super tutorial. Very helpful! I noticed a small security issue (display of personnel information). I can tell you exactly where when available. thanks again :)

[@juliandizy]

Yes, I noticed it too. It's not ideal, especially in a video discussing security and restricted access control... I fully agree that it is a very useful tutorial, although the static IP method is probably not practical anymore.

[@jonathansilva3364]

Great video, David. Thank you. Helped me out protecting my server.

[@haydenc2742]

Do you have a writeup on this? Would be great to be able to copy/paste the commands and be able to read along instead of clicking back and forth Such a great howto! Keep em coming!!!!

[@waltrobson7648]

14:53 you can see all your emails

[@supramaxis]

Great content, better than others i have seen

[@DBTechYT]

Thanks!

[@YevhenZhuchenko]

Hey, thanks for the video. Is there a way to add access restriction automatically or assign an access group directly to the tunnel application without creating duplicated app restrictions? That's a bunch of work if you have 30+ apps.

[@airconditioner6576]

Hi, can u discuss also the limitation of Cloudflare tunnel in your future video? ty.

[@cyberbud]

Amazing. Learning cloudflare tunnel. Can you make a video how to access your Windows PC on RDP via cloudflare tunnel? Tried couple of things but did not work.

[@captainpumpkinhead1512]

Thank you. The wording Cloudflare has chosen for the configuration page is rather confusing.

[@quemediga]

ei, please, I'm trying to put an authentication screen (with biometrics options) to Google SaaS apps with it. My office Cloudflare Access authenticates with the Google Workspaxe accounts already, but setting it as a policy doesn't seem to have this effect

[@ShlomiDavidson]

Hey, great video! can you please make a video tutorial of how to setup Cloudflare tunnel to work with Authelia in front of another docker container?

[@ali2kan]

Point the Cloudflare Tunnel at an instance of Traefik with Authelia Middleware and you'll be good to go! Just add the labels to docker compose. This is what i do.

[@DBTechYT]

Do you have a resource with more details that you can share for anyone else who is interested?

[@ali2kan]

Ibracorp has some great videos and documents on how to setup traefik and authelia together. He also has one on how to setup Cloudflared using CLI (this is what i do). This is how my ingress looks like -- pointing to my traefik instance. ``` ingress: - service: Reverse-Proxy-IP:Port originRequest: noTLSVerify: true ``` My next mission is to set up SMB, SSH and RDP with my cloudflare tunnels!

[@BrianThomas]

Wow... Fantastic video. Thank you very much. Hey do you think you could do a video with SSD caching on Open Media Vault?

[@mpuertac]

Amazing tutorial! As always straight to the point and resolutive.

[@DBTechYT]

Thank you!!

[@joostdenboer5689]

Have you tried getting access via Warp (1.1.1.1)? According to Cloudflare it should work, but I’m struggling for months now to get this working. I have Warp on my moble devices (phone/tablet) and my goal is to be able to access by home via the tunnel _without_ additional authentication when the Warp VPN is on.

[@chrisumali9841]

Thanks for the demo and info, have a great day

[@DBTechYT]

You bet

[@kstehn]

The IP Methode is fine if you have static ones. Which is not easy to come by where i live. The Email method i also tries but i am not a Fan of waiting for an Email with a Code. So for me the best setup is to use keycloak with saml access. I love this and when setup its so easy to add new users. The best for me is then i can Set a temp password and after first login they are forced to change it. But to get this setup up first was a bit tricky.

[@auag666]

Thanks for the clean instructions!

[@lilitdk]

I am not sure if Tunnel is free - because it ask me for payment so i try to keep it cheap but it looks very usefull.

[@localadm]

Simplest trick to restrict access to your tunnel apps is to just use cloudflare firewall rules plus set up allowed IPs in Configurations>Lists. This way I only allow my home IP and my mobile provider range to safely access what I really need without the vpn, like bitwarden or nextcloud.

[@DBTechYT]

Thanks for the info

[@kevinhughes9801]

Excellent vid thanks loving the tunnels content thanks

[@MrDennisloi]

Thanks for the video. However i didn't find a configuration that works for me. The VPN solution is cool but i don't like running a VPN on every device just for this and the mail method brokes some apps implementations. (some apps don't have a method to allow the session when connecting throught the tunnel). Any suggestions?

[@adamyork2333]

Do I understand correctly that this needs to be reconfigured on a monthly basis? That would appear to be the case. Do they allow policies to remain in place permanently for a fee?

[@DBTechYT]

Should only have to set it up once and I've never had to pay for it

[@adamyork2333]

@@DBTechYT Ok. The "Session "Duration" field under applications, which is required and only has time limited options, is throwing me off then. Maybe "No duration, expires immediately" is permanent? That's strange language if that's the case though.

[@DBTechYT]

The session duration is how long do you want the cookie to stay valid before it expires and the user has to log back in

[@adamyork2333]

@@DBTechYT Excellent. Sorry. I thought this was how long the policy lasted. This is awesome. Thanks!

[@ArnabSaha]

Hey, I want to set up a vpn server into my home router / pc but my ISP don't provide a public ip. So please help me out so that i can setup a vpn to share my internet connection via cloudflare or other service !!!! Please.

[@jagdeepmarahar]

Is there any way to add Authelia with cloudflare tunnels? Also can you please make a video for installing crater with cloudflare tunnels as all the tutorials online uses nginx proxy manager. I have been using tunnels from quite a some time and absolutely loving it and don't want to move to nginx for just one application. Thanks.

[@ersonusaini]

Sir i am using homeserver with proxmox and install ubuntu 22.04 lts and install aapanel or add wp site but i am getting error 523 Origin is unreachable what i do please help me

[@jeytis72]

Love it! Something I missed maybe. If you don't have a Reverse proxy like Nginx PM, how do you redirect each subdomain to your services running as docker containers linked to different ports like 5555:5555 or 1234:1234 for example? Do you also need to set on the Cloudflare GUI their port other than their domains (or subdomain)? Thanks

[@DBTechYT]

It all happens on the CloudFlare side of things like I show in this video: kzbin.info/www/bejne/jKO5Yaiah7qcbqM

[@jeytis72]

@@DBTechYT thanks

[@jarryd3996]

I tried setting this up with just IP address for access control and it presents me with a e-mail authentication page. How do I remove the e-mail and just have it use IP included?

[@umcynbolcyn4175]

Great video! Quick question - is it possible to set a bypass for one IP address (let's say my local IP so I don't have to authenticate myself locally) and at the same time set up one allowed email to have external access (with code, GitHub, Google, etc.)?

[@umcynbolcyn4175]

OK - there was no question. I've just had to add another policy separately.

[@HisLoveArmy]

Hey would love to do this but instead of using IP addresses I want to use URLS (because they a dyndns urls) would something like that be possible?

[@christians6843]

What configurations besides nameservers have you setup for your domain? I bought mine from a different service, not cloudflare.

[@DBTechYT]

I didn't buy mine from cloudflare either. I set the nameservers they told me to set. The rest was configured in cloudflare as I showed

[@christians6843]

@@DBTechYT Ah got it. I was totally confused by that GUI. Finally, I managed to expose my web apps on the internet through cloudflare even behind the extra layer of authorization via Microsoft Entra ID.

[@mrgman7899]

good day. if i was to do the same with CASAOS would i be able to only allow access to a sersific folder using email address /

[@DBTechYT]

Should be the same

[@joehwang1]

This is useful for me ! Thanks

[@ersonusaini]

how to use cloudflare tunnel services with aapanel panel with homeserver please make video tutorial i need help

[@dylanmaniatakes]

If i just do the top level doman will it require the authentication for all subdomains or will i have to set it up individually

[@paul_grimsley]

Thanks for such great videos, as someone who has moved from ESXi and virtual machines on an old dell 2u server to running docker in Ubuntu and containerising everything your videos have been invaluable and given me some great ideas. There is one thing that I haven’t been able to find though. I want to be able to file share without port forwarding. I thought that Cloudflare might be able to let me do this but I want AFP shares, and I can’t even get SMB shares to work over CF. Any ideas on services that could achieve this??? Many thanks

[@DBTechYT]

I think with something like what you're looking at, you might consider something like Tailscale or Zerotier?

[@paul_grimsley]

@@DBTechYT Thank you, I'll look into those.

[@paul_grimsley]

@@DBTechYT A massive thank you, Zerotier does exactly as I need it to, I can now connect to all the services on my remote Synology as well as any Mac or PC in my remote office with Zerotier installed and a connection to my zerotier network, without a single port being forwarded! Really appreciate the pointer. Keep up the great work.

[@DBTechYT]

@@paul_grimsley Outstanding!! Glad it worked!

[@angelgil577]

Great tutorial DB

[@SolarPV.]

I use Pfsense and restrict access IP's to just Cloudflare's blocking everything else on ports 80 & 443

[@ExileSparroW]

I have been really enjoying the tutorials and they've helped me create my own accessible server. However, I do want to make it more secure. Is there any way to set up an SSL with CloudFlare Tunnel? it looks to have mTLS and I would love to learn how to use that in order to make sure only computers i give that certificate to, can access my server. I hope you are able to help, as that seems like the most secure and fully free (hopefully) way to connect to the servers!

[@DBTechYT]

I'd start here: kzbin.info/www/bejne/h2bHeGudaZKGrpI

[@jkarimkhani]

What is a good way to restrict lets say an apache server from serving a guacamole login page hosted on Linode if the request does not originate from the cloudflare tunnel?

[@DBTechYT]

Yeah. Just install the CloudFlare tunnel agent in your server and then set up a firewall rule to block all incoming traffic other than your IP address. The tunnel should still have access.

[@Haemo]

is there an option for just a simple user/ pass system?

[@DBTechYT]

I don't believe so

[@danielb4959]

I’ve been messing with this recently to connect to a services on a VPS running some containers to try get a HA setup for when my home server goes down. But tbh Tailscale seems a better solution for me as nothing needs to be publicly exposed. I know you’ve done videos on both. But can I ask why you use this over Tailscale?

[@DBTechYT]

I use this because I want my services to be publicly available to me wherever I am

[@danielb4959]

@@DBTechYT thanks for the reply. I’m debating over which option is best for me. Do you expose all of your services publicly with this method? Or are there some things you keep only on your local network? For example portainer?

[@Breeegz]

Can you mix & match? IP address if I am home, and email as a backup when you are out and about?

[@DBTechYT]

Yeah. You would just do a bypass on your home IP address and add email beyond that. I use a dedicated IP from my VPN and have that IP and my home IP set as bypass.

[@doddezx]

Ip kinda makes zero sense if you're public hosting. Like if you work from anywhere but home, you can never guarantee your ip. And if you're gonna vpn to get on that ip then why even publicly host the service just use it over VPN.

[@DBTechYT]

Everyone likes to do things differently. I'm sure you'll find something that works for you :)

[@Pro-cheeseburger]

curious why would you use PIA and not Cloudflares WARP?

[@DBTechYT]

Depends on the needs of whoever is using it. I've since switched to Warp, but for people who don't want to use it, you can also get a dedicated IP from a lot of VPNs and use that dedicated IP as a way to restrict access.

[@Pro-cheeseburger]

@@DBTechYT perfect thanks!

[@actng]

the dread gmail dark mode... yet the email opens in light mode...

[@andrewa3216]

Do you have any videos on using warp? I'd like to block an application to everything UNLESS you're connected using a device using WARP and added as a device in CloudFlare zero trust

[@DBTechYT]

I don't yet. But it's what I'm currently using on my self-hosted stuff to help make sure that no one can access my stuff if I don't want them to. I'll look into making some content about it soon-ish :)

[@andrewa3216]

@@DBTechYT the only thing I’m not a huge fan of is the application screen where you have to input an Authenticator. I haven’t been able to find out yet if you can just disable this screen. If I’m secured with a vpn requiring warp there’s really no reason for all these extra security steps. I’d prefer it just go directly to my application as normal. In the end tailscale ended up being a better solution for what I wanted to do.

[@martingerlach_1990]

Are restrictions/access by MAC-addresses also possible?

[@DBTechYT]

Not that I'm aware of, no

[@PanduPujoWicaksono]

Any idea about how to lock vaultwarden login page behind CF access?

[@DBTechYT]

Follow these steps, but put the restrictions you want on your VaultWarden URL

[@AnSapien]

Is there a way to include a dynamic IP because my public IP changes daily

[@DBTechYT]

I think you can use a DDNS container for CloudFlare. I've got a video coming out today that allows you to use 3rd party authentication like Google or Github. Or you can get a VPN with a dedicated IP.

[@KarollyneCosta-u4l]

Does this works with mtls/service mesh architecture?

[@DBTechYT]

I haven't tested it, but I don't know why not since you're restricting access to the app at the Cloudflare level

[@AngadSodhi]

What's the best way to setup wireguard behind CGNAT? Cloudflare zero trust tunnels don't support UDP yet and I don't fully understand WARP

[@Mind-RX]

Is it also good for accessing vaultwarden?

[@DBTechYT]

it's how I access my own instance of vaultwarden

[@Mind-RX]

@@DBTechYT Thanks :)

[@Mind-RX]

@@DBTechYT I can't seem to enable HTTPS... :(

[@DBTechYT]

In your zero trust dashboard, open the tunnel you created for your vaultwarden app. Then go to the "public hostname" tab. edit the vaultwarden public hostname. if your "Service Type" is set to https, then click "Additional application settings" and then make sure that the "No TLS Verify" option is enabled.

[@dibu28]

Thank you!

[@DBTechYT]

Thanks for watching and commenting!!

[@redstormsju777]

Hello, another great video. Do you happen to use this for Synology DSM? I’ve set this up for all of my self hosted apps and it works great. The only hiccup I encountered is setting it up for the synology DSM application I have set up through cloudflare tunnel. The access policy sets up correctly, I get the authentication code to the email address I set up in the policy and I do get redirected to my synology dsm login page. After entering my DSM credentials I get an error message “unable to sign into the system. Try again later or contact synology support.” However, if I remove the access policy, I have no issues going through the tunnel and logging into DSM. Any thoughts?

[@DBTechYT]

I use the IP address method for remote access to my Synology, but haven't tried the email authentication method.

[@redstormsju777]

@@DBTechYT what are your thoughts on the GitHub authentication method? I use the email method and I use a gmail account specifically for my self hosted stuff. Any other auth method you recommend to be better for this purpose?

[@DBTechYT]

I've always tried to stay away from 3rd party auths like GitHub, Facebook, etc. If one of the involved parties changes their API integration and the other doesn't update quickly enough, you're gonna have problems getting logged in. I like to use the IP method as it's the least likely to cause me issues.

[@redstormsju777]

@@DBTechYT makes sense. In regards to the ip method, would that be the ip from the location I am accessing from? What if I’m accessing from my mobile device on the road and not on any specific network?

[@DBTechYT]

So in the IP address block, you'll put your home IP. If you want access while away, I use PIA with a dedicated IP for my setup. The extra IP is like $30/year, but it sure is convenient

[@ScofieldMuliru]

Thanks

[@DBTechYT]

Thank you for the support!

[@ramonsito9687]

Videos starts at 20:00

[@DBTechYT]

And now I'll consider blocking your comments from showing up on my channel again

[@AakashKumar-ru4gv]

At 14:53, your emails unblurred.

[@DBTechYT]

You mean my public-facing email address that is available on my KZbin About page? I think it'll be okay. Thanks, though.

[@stautonel]

Good content! But please don’t talk so fast.

[@DBTechYT]

I talk fast. I don't know what to tell you other than what I (and others) have been responding with for years with comments like this: You can play the videos at .75 or .5 speed and there's also a Play/Pause button you can utilize.

[@GlenBland]

super helpful. Thank you!