cloudflare-zero-trust
Replace VPN access to internal services using Cloudflare's Zero Trust platform, which combines identity verification, device compliance checks, and encrypted tunnels to protect dashboards, admin panels, and on-premises apps. Enforce DNS-level threat filtering and support remote teams without opening inbound ports.
Cloudflare Zero Trust secures internal apps with identity-based access, device checks, and encrypted tunnels—no VPN required.
AI-generated summary based on this skill's SKILL.md
Install
BagelHole/DevOps-Security-Agent-Skills/cloudflare-zero-trust · repository language: Shell
git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills
cp -r DevOps-Security-Agent-Skills/infrastructure/cloudflare/cloudflare-zero-trust ~/.claude/skills/cloudflare-zero-trustnpx skillfed install BagelHole/DevOps-Security-Agent-Skills/cloudflare-zero-trustFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I replace VPN with Cloudflare Access for internal apps?
Cloudflare Zero Trust replaces traditional VPN by verifying user identity and device posture before granting access to internal services. Instead of opening inbound ports, you deploy Cloudflare Tunnel on your origin server, which creates an outbound-only encrypted connection to Cloudflare's edge. Users authenticate through your identity provider, and their devices are checked for compliance. Once verified, they access your dashboards, admin panels, and on-premises apps through Cloudflare's network—no VPN client needed.
What is Cloudflare Zero Trust setup and how do I get started?
Cloudflare Zero Trust setup involves configuring identity policies, device posture checks, and encrypted tunnels to secure internal apps without VPN. Start by enabling Cloudflare Tunnel on your origin server using cloudflared, then set up access policies in the Cloudflare dashboard to define who can reach each app based on identity and device compliance. Add your identity provider (Okta, Azure AD, etc.), configure device posture rules (OS version, firewall status), and deploy WARP client to remote teams for encrypted network access.
How do I configure device posture and access policies for remote teams?
Cloudflare Zero Trust's device posture feature checks endpoint security before granting access. In your Cloudflare dashboard, define posture policies requiring specific OS versions, firewall status, antivirus presence, or disk encryption. Create access policies that combine identity checks (email domain, group membership) with device requirements. Remote teams install the WARP client, which reports device health to Cloudflare. Only devices meeting your posture rules can access internal services, ensuring your remote workforce maintains compliance.
Can I secure SSH without VPN using Cloudflare Zero Trust?
Yes, Cloudflare Zero Trust secures SSH without VPN by routing SSH traffic through Cloudflare Tunnel and enforcing identity verification. Deploy cloudflared on your SSH server, create an access policy requiring authentication, and users connect via a browser-based terminal or SSH client configured to proxy through Cloudflare. This eliminates the need to expose SSH ports publicly and ensures every connection is logged and audited through your Zero Trust policies.
How does Cloudflare Gateway DNS filtering block malware and phishing?
Cloudflare Zero Trust includes Gateway DNS filtering that inspects DNS queries at the network level to block malware and phishing domains. Configure DNS policies in your Cloudflare dashboard to block known malicious sites, and enable WARP client on user devices to route DNS queries through Cloudflare's threat intelligence. Gateway automatically blocks requests to domains associated with malware, ransomware, and phishing, protecting your remote teams even before they reach dangerous content.
How do I automate CI/CD access using Cloudflare service tokens?
Cloudflare Zero Trust supports CI/CD automation through service tokens, which allow non-human identities to authenticate to protected applications. Create a service token in the Cloudflare dashboard, configure an access policy to grant it permissions to your internal CI/CD tools, and embed the token in your deployment pipeline. This enables automated deployments to access internal services without exposing credentials or requiring manual authentication.
SKILL.md
rendered from the published skill — quoted content, verbatim
Cloudflare Zero Trust
Secure access to internal services without VPNs using Cloudflare's Zero Trust platform (Access, Tunnel, Gateway, and WARP).
When to Use
- Replacing VPN access to internal web applications, SSH, or RDP.
- Enforcing identity-aware access policies on internal tools (dashboards, admin panels).
- Exposing on-premises or private-network services securely to remote teams.
- Filtering DNS traffic to block malware, phishing, and shadow IT.
- Enforcing device posture checks (managed devices, OS version, disk encryption).
Prerequisites
- Cloudflare account with Zero Trust plan (free tier supports up to 50 users).
- A domain on Cloudflare (for Access application hostnames).
- Identity provider configured (Google Workspace, Okta, Azure AD/Entra ID, GitHub).
cloudflaredCLI installed on the server hosting internal services.
```bash
Install cloudflared
macOS
brew install cloudflared
Debian/Ubuntu
curl -fsSL
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
infrastructure/cloudflare/cloudflare-zero-trust/SKILL.md