Cloudflare Zero Trust Tunnels (Previously Argo) for Home Lab Access
Cloudflare Tunnel was previously named Warp during the beta phase. As Warp was added to the Argo product family, Cloudflare changed the name to Argo Tunnel to match. Once Cloudflare decided that there is no longer required users to purchase Argo to create Tunnels, Argo Tunnel has been renamed to Cloudflare Tunnel.
In this post, I am gonna show how you can use Cloudflare Tunnel (free) to access our home lab internal network with a couple of simple steps and also how you can make this access secure.
Related posts:
- Use Cloudflare Argo Tunnel to Expose Internal Web Application to Internet
- [Free Hosting] Get Permanent Free Domain Name from EU.ORG & Integrate with Cloudflare
- Cloudflare Tips and Tricks
- Set Up CloudFlare Workers to Use Your Own Domain
Diagram
Steps
- Free Cloudflare accound
- Free Domain (https://nic.eu.org/)
1 Add a tunnel
2 Create a new tunnel
3 Install and run a connector
4 Route traffic to your applications
Access Policy - OneTime Password
One Time PIN
1 Add an application
2 Add policies
3 Setup
4 Access to route.51sec.eu.org
Set Up Google as an IdP (Identity Provider)
You can add other authentication methods such as Google, GitHub as an identity provider.
Set up Google as an identity provider
-
Visit the Google Cloud Platform console. Create a new project, name the project, and select Create.
-
On the project home page, go to APIs & Services on the sidebar and select Dashboard.
-
On the sidebar, go to Credentials and select Configure Consent Screen at the top of the page.
-
Choose
Externalas the User Type. Since this application is not being created in a Google Workspace account, any user with a Gmail address can login. -
Name the application, add a support email, and input contact fields. Google Cloud Platform requires an email in your account.
-
Return to the APIs & Services page, select Create Credentials > OAuth client ID, and name the application.
-
Under Authorized JavaScript origins, in the URIs field, enter your team domain.
-
Under Authorized redirect URIs, in the URIs field, enter your team domain followed by this callback at the end of the path:
/cdn-cgi/access/callback. For example:https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback -
Google will present the OAuth Client ID and Secret values. The secret field functions like a password and should not be shared. Copy both values.
-
In Zero Trust, go to Settings > Authentication.
-
Under Login methods, select Add new. Choose Google on the next page.
-
Input the Client ID and Client Secret fields generated previously.
-
(Optional) Enable Proof of Key Exchange (PKCE). PKCE will be performed on all login attempts.
-
Select Save.
Videos
共有 0 条评论