Cloudflare Tunnel

The Cloudflare Tunnel enables secure remote access to local services over the Internet without requiring port forwarding or a public IP address. The connection is established from the local system to Cloudflare. This allows networks behind CG-NAT or restrictive internet connections to be securely accessible.

Notes: Cloudflare Tunnel is only available from Core 2 or higher.

Note: Antcas Control supports connection via its own Tunnel and can provide the visualization publicly without configuration.

Prerequisites

For use, a Cloudflare account with a managed domain is required. Management is done automatically via the Cloudflare API. The used API token requires appropriate permissions. See further below under Configuration.

If the server is behind a restrictive firewall, it must be ensured that outgoing connections to Cloudflare are possible. In particular, access to port 7844 must be allowed. Further information can be found under the link:
https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/

Functionality

The Cloudflare Tunnel establishes an outgoing, encrypted connection to Cloudflare. External users then access the visualization or other application via the configured domain. The connection is routed through the Cloudflare infrastructure without requiring incoming ports to be opened on the router.

The application's port is assigned to the virtual local network interface and securely published via the tunnel.

Configuration

Various configuration options are available. The following chapters explain the respective procedure for different configurations and use cases.

Locally Managed Configuration

In this configuration, the tunnel configuration is stored in Antcas Control and then synchronized with the Cloud. The advantage of this variant is that the tunnel can be easily configured and managed. However, it should be noted that all users with permission to configure the server can also make changes to the tunnel configuration in the Cloud.

Create a new API token in your user profile in your Cloudflare account. This requires the following permissions:

Type	Subject	Permission
Account	Cloudflare Tunnel	Edit
Zone	DNS	Edit

Note: A DNS zone must be assigned to the account at least so that the account can be determined.

Then, a new Cloudflare Tunnel is added in the Infrastructure under Server ▸ Network ▸ VPN and Tunnel. Each tunnel creates a virtual network interface such as cf-tunnel0. It is recommended to complete the configuration of the tunnel first and then configure the applications.

Warning: If an existing tunnel is selected, the authentication of the tunnel may be overwritten to establish a connection. Antcas Control supports one tunnel with a simultaneous connection to Cloudflare at a time.

A Cloudflare API token is required for automatic configuration. With this, Antcas Control can automatically retrieve, create and manage the required DNS entries and tunnel configurations. You can find instructions on how to create an API token in the Cloudflare help under:
https://developers.cloudflare.com/fundamentals/api/get-started/create-token/

After the API token has been validated, the account and tunnel can be selected. It is possible to create a new tunnel, which will then receive the name of the server plus the name of the interface. For example, Office Building - cf-tunnel0.

Note: The configuration of the tunnel takes place completely automatically via API. Ensure that the server can establish a connection to Cloudflare during configuration.

Once the tunnel has been created, you should assign all visualizations that should have access via the tunnel to the network interface. Then these can be added as Applications to the Tunnel. The Applications are located one level higher than the configured Tunnel.

In the configuration, select the domain and assign a name for the subdomain. Then select the endpoint.

Note: If the name has already been used for another tunnel, it will not be assigned and the connection will be established as before. If the name is changed, Antcas Control deletes the subdomain if the ID of the tunnel was managed by Antcas.

Zero Trust Configuration

An alternative to the locally managed configuration is the Zero Trust configuration. In this case, the configuration is done in the Cloudflare console and then synchronized with Antcas Control. The advantage of this variant is that access to the Cloudflare configuration via Antcas Control is not possible.

For this configuration, a port does not necessarily have to be assigned to the interface. Any address in the network can be used as an endpoint. This way, for example, the port of the main interface or another service in the network can be released. However, unlike the usual configuration, localhost cannot be used as an endpoint.

If the connection is unencrypted, the option noTLSVerify must be set to TRUE in the Cloudflare console. However, an unencrypted connection to a service outside the server is not recommended for security reasons.

For configuration, a new Cloudflare Tunnel is added in the Infrastructure under Server ▸ Network ▸ VPN and Tunnel. Each tunnel creates a virtual network interface such as cf-tunnel0. For setup, only the token of the Zero Trust tunnel is required. This can be copied directly from the Cloudflare console and inserted. If the inserted text additionally contains the complete installation command, it will be automatically removed so that only the token is stored.