Demo library › Chapter 2
Replace the VPN for an internal app
An internal app on a server with no open ports, reached by name through the Cloudflare One client. With the client off, the address does not answer.
The problem
Horizon Inc reaches its internal tools through a VPN. The VPN needs an inbound port, and once connected a user can reach the whole network, not just the app they need. Its own service desk has a ticket open about it.
Lands with: infrastructure and network teams
Before you start
- Lab only. This uses Backlog, the internal service desk on the lab VM.
- The Cloudflare One client signed in as
, and switched off. - On the lab VM,
curl -sk https://192.168.10.10/healthzreports 30 people. If not, check/var/log/private-estate.log.
Run it
No door to knock on
| Do | Say |
|---|---|
| Zero Trust → Networks → Tunnels → Horizon Inc traffic on-ramp. | The server runs a connector that dials out to Cloudflare. Nothing dials in, so there is no inbound firewall rule and nothing to scan. |
Open the tunnel's routes: 192.168.10.10/32 and 192.168.10.11/32. | One address per application, not a whole subnet. |
With the client off, open https://backlog.corp.internal. | Nothing happens. The name does not resolve and the address does not route. Unlike a VPN, there is no login page to attack. |
Whybackground, if you are asked
A VPN concentrator needs an open port and a login page that anyone on the internet can find. A tunnel only makes outbound connections, so there is nothing to misconfigure and no address to scan. Granting one address per application means we grant an application, not a network.
How the laptop reaches it
| Do | Say |
|---|---|
| Team & Resources → Devices → Device profiles → default profile → Split tunnels. | Only the company's internal addresses go through Cloudflare from here. You do not have to route everything on day one. |
Networks → Internal DNS → corp.internal, then Traffic policies → Resolver policies. | Internal names live in a private DNS zone that only Gateway answers. |
| Access controls → Applications → Backlog (internal service desk). | The policy is for the application, port 443 on one address, allowed to all employees. pgAdmin on the same server has a different policy. |
Whybackground, if you are asked
This is a pilot a customer could run on Monday. Split tunnels mean only the internal range goes through Cloudflare, so nothing else changes for users. The resolver policy sends any corp.internal query to the private zone, so the name works on an enrolled laptop and does not exist anywhere else. And because Access matches each application, two apps on the same server can have different policies.
Switch the client on
| Do | Say |
|---|---|
Turn the client on and reload https://backlog.corp.internal. | Access asks who Alice is, she signs in, and the service desk loads. |
| Point at the padlock. | A valid certificate on a name that is not on the internet. Nothing was installed for it: the client already trusts Cloudflare's certificate. |
| Open BKL-1060, "VPN drops every twenty minutes from home". | Their own users already know the problem. |
Whybackground, if you are asked
The browser's encrypted session ends at Cloudflare, where Access and Gateway inspect it before it goes on down the tunnel. That is why the certificate is valid without installing anything, and why the data protection in the browser DLP chapter also works on this internal app.
What the audience should see
- With the client off, the name does not resolve.
- With it on, an Access sign-in, then Backlog's ticket list.
Where the evidence is
Insights → Logs: the Access sign-in for Backlog, and the Gateway network session to 192.168.10.10:443 with Alice's identity.
Known limitations
- The apps server is the same lab VM that deployed the demo.
- The device profile's local domain fallback must not cover
corp.internal, or the laptop asks its own resolver and the name never resolves. - The lab's 10.0.0.0/8 network stays outside the tunnel, so the estate uses its own addresses, 192.168.10.10 and .11.
Part of: The whole of Cloudflare One · Replace the VPN · The full tour