Setting up CloudFlare Zero Trust tunnels with Plesk
I was using firecove to reconfigure my OVH’s firewalls to only allow cloudflare connections, but there are better and newer ways! 🚀
Since I’m a CloudFlare customer already the entry bar for using CloudFlare’s new Zero Trust tunnels is low.
On this page
Steps to take
- Create unique local IP’s on our plesk server
- Assign the created IP to a website/domain
- Set up a tunnel in CloudFlare
- Set up cloudflared on our host
- Configure cloudflared with our API key from cloudflare
- Set up a public hostname in the tunnel
Updating Plesk to support CloudFlare zero trust tunnels
Maybe there is a better way of doing this, but to me it looked like adding local IP’s to my node (not routable) and marking them as dedicated was the way forward.
Pick whatever you want as an internal IP, I pick the 10 range, just have an unique IP per website, and make sure dedicated is selected
Now switch your domain/website “Home > Domains > [domain]” to the freshly made local IP
Setting up the CloudFlare zero trust tunnel
Head over to the CloudFlare zero trust panel
First, let’s set up a tunnel
I do suggest NOT to run that curl command.
I suggest installing cloudflared with your hosts package manager (so it stays up to date if you have autoupdates enabled)
Installing cloudflared as a service with your package manager (for me AlmaLinux)
sudo dnf update sudo dnf config-manager --add-repo https://pkg.cloudflare.com/cloudflared-ascii.repo sudo dnf install cloudflared sudo cloudflared service install
Once you have your tunnel up and running, head over to the tunnel’s public hostnames
It might error saying you already have an A record for whatever you are trying to set up, just delete that from your DNS settings and retry the save step.
give the DNS some time to propagate, and 🎉 you now no longer expose your web server to the public internet
Some more notes / things that you might have to do too!
railgun & cloudflared
If you have a railgun on your domain, disable that first 🤔 my cloudflare tunnel and my railgun were fighting 🥊 and I had to disable railgun
TLS verify / SSL errors
I was having some connectivity issues after adding a public hostname. Checking the logs of the cloudflared service showed there were certificate issues between the tunnel and the locally hosted website, so turn on No TLS Verify
journalctl -u cloudflared.service -f
under the problematic public hostname, enable No TLS verify
WWW / CNAME
a CNAME www -> @ did not seem to work for me, I had to add www. to my tunnel too
Disable your firewall rule for WWW
Once you have your tunnel up and running, I suggest to disable any incoming WWW traffic (80/443) in the firewall settings
Enable HTTP2 for the tunnel
Depending on your firewall, allow tunnel ports out
Since I work with outbound ports closed too, I had to allow some outbound ports for the Cloudflare tunnel to work ( their documentation )