Secure Cloudflare Tunnels with vLANs and an Internal Firewall Before It's Too Late!

Shoutout to @christianlempa

Cloudflare Tunnels are great, but they come at a cost. Cloudflare sees all of your data, and if you're not careful you'll only have a single layer of defence in your network. In this video I show you how to reintroduce some of those layers by segmenting your Cloudflare Tunnel on its own vLAN, and then route this traffic through a firewall with IDS and IPS. I also show how to create a Cloudflare Tunnel.

Cloudflare Tunnel Docker Compose:

Christian's Video:

00:00 - Introduction to the "Problems" with Cloudflare Tunnels
01:46 - Summary of how we "Fix" the problem
03:43 - Creating a Cloudflare Tunnel to Demonstrate the Problem
06:12 - "Fixing" the Problem with macvLANs and a Firewall
06:22 - Docker macvLAN Implementation
10:35 - Routing Cloudflare Tunnel Through a Firewall (Sophos XG)
12:34 - Testing It All Works
13:13 - Outro & Summary

[electricitymachine]

You're one of the few channels that has given me a better outlook on my homelab and how to make it all tick. Many content creators only scratch the surface, but you manage to go in depth and explain how this is all set up, why it should be set up, the pros and cons, and specifics like what rules you should be setting up in your firewall. Keep up the great work!!

[melaronvalkorith]

Really excellent job explaining. You can’t explain everything in one video and everyone is on a different part of the learning journey. You approach that challenge intentionally by adding brief explanations for each component and referencing other content for further explanation.

Well done, sir.

[Glatze]

Very good and important content! Thanks for making this video.

[madeyeQ]

I've been using cloudflare for a while, but I couldn't figure out how to limit it to a few containers.
What I really wanted was to find a way to limit docker to only use a single interface on my server, but it has proven impossible.
It was possible to use incus to create a vm for docker to run in, and that could be limited. However it feels a little cumbersome.
Your video really helped me find the right solution using macvlan. 👍

[ARedHerring]

Nice video mate. You explained it well and didn't go too far into the weeds. I'm keen to loop through your other videos. Keep making content!

[stevemazza]

Thank you for such a clear and succinct explanation. This has been most helpful!

[cbaservs]

Christian is doing some very good work but so do you James. clear video's also the good stuff i want to learn

[mrd]

I had also this concern about the "privacy" of these services when they became available! Mac-Vlans are pretty powerful feature!
Thanks for the solution and the fantastic tutorial!

[cloud]

Like the way your explain everything in your videos. Keep up the good work.

[chrisumali]

Thanks for the demo and info, have a great day

[codecrush_]

Thanks a lot, this is what I was looking for, you did such a great job explaning things clear and precisely, keep up the good work sir!

[leobottaro]

Great video! Thanks for reaching me how to secure my self hosted server!

[romayojr]

excellent tutorial regarding added security. i’ll be adding mac vlan soon to my setup soon. i might also add 2fa and sso using authelia.

[antoniomax]

By the way, as I said, I don't use docker, but debian. The virtual machine is located in virtualbox, which is installed on windows 10. Because when I used docker, I couldn't figure out how to set up a network connection. Rather, I did not understand why there is no connectivity between the docker, which is installed on the Ubuntu virtual machine and the local network. The virtual machine was also on virtualbox, ubuntu was installed, there was a docker in it. There was connectivity between Ubuntu and the local network, there was a connection between docker and Ubuntu - the network worked. But there is no connection between docker and LAN. I couldn't ping or anything. It was as if Docker was isolated. That's why I used debian, because it's very simple there. Just one team.

[rocket]

my biggest complaint with all the "How to" videos is the fact that no one talks about TLS and the importance of the Origin cert.

[tmsd]

Just implemented this for my cloudflare tunnel. great content. so easy to understand!

[alfonce]

Just wanted to pop in and say awesome series - this has really made all the difference in my homelab journey. Thanks and keep up the good work! Question - does this still have value if you already host all your external accessible apps on a DMZ?

[difegam]

Thanks! Nice video a very well explained.

[lossless]

Thank you, exactly what I was looking for! Great info and points here!

[Nightrapture]

Very interesting video. Now I have to realize how setup this without docker, as I installed CF tunnel for a Jellyfin service hosted in my proxmox server. I wonder if proxmox firewall could also be used for this. 🤔