Restrict Access to Your Cloudflare Tunnel Applications

This video is sponsored by Tuxedo Computers and the Aura 15 Gen 2.

/=========================================/

In this video we're going to look at adding additional levels of restriction to your Cloudflare Tunnel setup.

First we're going to look at restricting access to your applications by IP address. Then we'll look at restricting by granting access by email address.

We'll take it an additional step and set up Access Groups for easier management of multiple applications.

I use Private Internet Access for my VPN when I'm away from home and I purchased a dedicated IP address from them so that I can use that IP in my rules to make sure I can always access my home servers even when I'm away from home.

Here's my PIA affiliate link:

You can find more about their Dedicated IP option in the left column once you're logged into your account.

/=========================================/

Get early, ad-free access to new content by becoming a channel member, a Patron or signing up for the members' only website!

/=========================================/

The hardware in my recording studio is:
✔ Custom PC w/ Ryzen 2600, 32GB RAM, RTX 2070, Assorted Storage

/=========================================/

The hardware in my current home servers:

/=========================================/

✨Find all my social accounts here:

✨Ways to support DB Tech:

✨Come chat in Discord:

✨Join this channel to get access to perks:

✨Hardware (Affiliate Links):

[zadekeys]

If you setup CloudflareD (CloudFlare DDNS) and whitelist that hostname for access, then if your IP changes, you should still have full access via the DDNS hostname.

[AhmadYusuf]

Thanks for the video, I used to use the Email method for sometime, but recently I managed to get the Cloudflare tunnel to use Authelia for authentication which gives me full control on what subdomains to bypass, single factor or two factor authentication.
Was done using the OpenID login method in Cloudflare authentication and adding a new client in Autherlia configurations file

[nolasaint]

Simple thank you. New to IT and try to learn by doing home IT projects. After trying other you tube examples, this is the one that worked for me. Big thanks and keep up the good work.

[PrimalDashes]

Absolutely loving what you do, sir. I've been going through your videos and perfecting my setup on my server and you do a great job of walking through installs. I would love to see you setup Shlink Url Shortener in containers. I have it running, but it has a bunch of quirks and setup can be tricky, would love to see your complete start to finish on it as I'm sure I'm still missing pieces

[MrXrockyx]

Would love to see a video on how to bypass when my phone is on the WARP VPN. With this, apps like Homeassistant would automatically work, but I did not manage that :(

[Zazpi_Zezenak]

thanks a lot for this super tutorial. Very helpful!
I noticed a small security issue (display of personnel information).
I can tell you exactly where when available.

thanks again :)

[jonathansilva]

Great video, David. Thank you. Helped me out protecting my server.

[kshitijkadlag]

Hey! I've followed the steps in one of your previous videos to setup a Nextcloud instance using Docker and Portainer. I'm using Cloudflare Tunnel to access it on the internet, but I'm unable to use video calls in Nextcloud Talk because it needs a Turn Server. Could you please make a video on how to set that up in Docker using Portainer?

[captainpumpkinhead]

Thank you. The wording Cloudflare has chosen for the configuration page is rather confusing.

[haydenc]

Do you have a writeup on this? Would be great to be able to copy/paste the commands and be able to read along instead of clicking back and forth
Such a great howto!
Keep em coming!!!!

[kstehn]

The IP Methode is fine if you have static ones. Which is not easy to come by where i live. The Email method i also tries but i am not a Fan of waiting for an Email with a Code. So for me the best setup is to use keycloak with saml access. I love this and when setup its so easy to add new users. The best for me is then i can Set a temp password and after first login they are forced to change it. But to get this setup up first was a bit tricky.

[localadm]

Simplest trick to restrict access to your tunnel apps is to just use cloudflare firewall rules plus set up allowed IPs in Configurations>Lists. This way I only allow my home IP and my mobile provider range to safely access what I really need without the vpn, like bitwarden or nextcloud.

[mpuertac]

Amazing tutorial! As always straight to the point and resolutive.

[chrisumali]

Thanks for the demo and info, have a great day

[ShlomiDavidson]

Hey, great video! can you please make a video tutorial of how to setup Cloudflare tunnel to work with Authelia in front of another docker container?

[supramaxis]

Great content, better than others i have seen

[YevhenZhuchenko]

Hey, thanks for the video. Is there a way to add access restriction automatically or assign an access group directly to the tunnel application without creating duplicated app restrictions? That's a bunch of work if you have 30+ apps.

[BrianThomas]

Wow... Fantastic video. Thank you very much.

Hey do you think you could do a video with SSD caching on Open Media Vault?

[kevinhughes]

Excellent vid thanks loving the tunnels content thanks

[cyberbud]

Amazing. Learning cloudflare tunnel. Can you make a video how to access your Windows PC on RDP via cloudflare tunnel? Tried couple of things but did not work.