Protecting an internal app with Tunnel and Access
Connect an origin through an outbound Tunnel, then protect the public hostname with default-deny Access policy.
Edited and verified by Orange Book Editorial Team ·
Order determines exposure
Create the Access application and Allow policy before publishing the Tunnel hostname. The official guide is explicit: without Access, a published application route is open to the Internet.
Responsibility boundary
User → Cloudflare Access (identity and policy) → Tunnel (outbound connector) → internal appTunnel lets the origin connect outward and reduces exposed inbound ports. Access decides who can enter. The combination does not patch the origin application or replace its own authorization and least privilege.
Secure deployment
Define the Access application
Create a self-hosted application for the hostname. Access is deny by default; only users matching an Allow policy pass. Start with one test identity, not a broad domain bypass.
Create the remotely managed Tunnel
Create it under Networking > Tunnels and run the Dashboard-provided install command on the origin. Keep its token in origin secret management—not screenshots, issues, or Git.
Publish the route
Map the hostname to an explicit local service URL such as http://localhost:8080. Confirm the origin firewall no longer exposes the original port.
Test both directions
An allowed identity should authenticate; a disallowed identity and a request without the cookie should fail. Enable Access-token validation at the origin to prevent a network misconfiguration bypass.
Failure and rollback
| Symptom | Check first | Safe rollback |
|---|---|---|
| Tunnel is Inactive | cloudflared and outbound port 7844 | Keep Access and remove the published route |
| Everyone is denied | IdP, Allow selector, session | Add only a temporary restricted admin policy |
| Anonymous request succeeds | Access hostname and policy | Remove the published route immediately |
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.
Turnstile and WAF security baseline
Separate human verification from request filtering, with mandatory server validation and narrowly scoped rules.
Production release checklist for a complete application
Turn code, configuration, data, security, observation, staging, and rollback into verifiable release evidence.