Documents

Cloudflare Tunnel: Access & SSH Security Setup (Part 3)

5 min readMar 24, 2026Mar 24, 2026

[Chapter 3] Serving Subdomains with Cloudflare

Cloudflare Access + SSH Security Configuration

1. Goals

At this point we have:

  • Cloudflare Tunnel connected
  • Services accessible via subdomains

But the current state is:

Anyone who knows the URL can access the service
SSH port is exposed to the internet

This chapter addresses the following:

  • No access without authentication
  • SSH port fully blocked
  • A structure that scales to multiple services

2. Final Architecture

User
→ Cloudflare Access (login)
→ Cloudflare Tunnel
→ Reverse Proxy (nginx / traefik)
→ Services (docker)

SSH:

ssh → Cloudflare → Tunnel → Server

3. Cloudflare Access (Login Protection)

Concept

Enforce authentication before users can reach a service.

Configuration

  1. Cloudflare Dashboard
  2. Zero Trust → Access → Applications
  3. Add Application → Self-hosted

Basic Settings

Domain:

geny.hrletsgo.me

Policy Settings

Action: Allow
Include:

  • Emails
  • Google accounts
  • GitHub accounts

Result

On access:

Login → Pass → Service access

4. Moving SSH Behind the Tunnel

Current Architecture

Internet → port 22 → Server

Problems:

  • Brute force attacks
  • Port scanning

Target Architecture

ssh → Cloudflare → Tunnel → Server

config.yml

ingress:
  - hostname: ssh.hrletsgo.me
    service: ssh://localhost:22

  - service: http_status:404

DNS

cloudflared tunnel route dns hr107 ssh.hrletsgo.me

Connecting

cloudflared access ssh --hostname ssh.hrletsgo.me

5. Blocking the Port

sudo ufw deny 22

6. Multi-Service Routing

Architecture:

Cloudflare → Tunnel → Reverse Proxy → Services

7. nginx Approach

server {
    server_name api.hrletsgo.me;
    location / {
        proxy_pass http://backend:8000;
    }
}

server {
    server_name app.hrletsgo.me;
    location / {
        proxy_pass http://frontend:3000;
    }
}

8. Traefik Approach

labels:
  - "traefik.http.routers.app.rule=Host(`app.hrletsgo.me`)"

9. Wildcard Strategy

*.hrletsgo.me

10. Operational Approach

A dedicated tunnel per server is recommended.

11. Health Check

docker ps
ss -tlnp

12. Troubleshooting

  • 502 → Service issue
  • 1033 → Tunnel not running
  • TLS error → HTTP/HTTPS mismatch

13. Key Takeaways

  • Cloudflare Access is essential
  • Use SSH over the tunnel
  • A reverse proxy is required