cloudflare-zero-trust
Replace VPN access to internal services using Cloudflare's Zero Trust platform, which combines identity verification, device compliance checks, and encrypted tunnels to protect dashboards, admin panels, and on-premises apps. Enforce DNS-level threat filtering and support remote teams without opening inbound ports.
Cloudflare Zero Trust secures internal apps with identity-based access, device checks, and encrypted tunnels—no VPN required.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-05-22
Cloudflare Zero Trust secures internal apps with identity-based access, device checks, and encrypted tunnels—no VPN required. Replace VPN access to internal services using Cloudflare's Zero Trust platform, which combines identity verification, device compliance checks, and encrypted tunnels to protect dashboards, admin panels, and on-premises apps. Enforce DNS-level threat filtering and support remote teams without opening inbound ports.
Use it when
- Cloudflare Zero Trust setup involves configuring identity policies, device posture checks.
- Cloudflare Zero Trust's device posture feature checks endpoint security before granting access.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
BagelHole/DevOps-Security-Agent-Skills/cloudflare-zero-trust · repository language: Shell
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I replace VPN with Cloudflare Access for internal apps?
Cloudflare Zero Trust replaces traditional VPN by verifying user identity and device posture before granting access to internal services. Instead of opening inbound ports, you deploy Cloudflare Tunnel on your origin server, which creates an outbound-only encrypted connection to Cloudflare's edge. Users authenticate through your identity provider, and their devices are checked for compliance. Once verified, they access your dashboards, admin panels, and on-premises apps through Cloudflare's network—no VPN client needed.
What is Cloudflare Zero Trust setup and how do I get started?
Cloudflare Zero Trust setup involves configuring identity policies, device posture checks, and encrypted tunnels to secure internal apps without VPN. Start by enabling Cloudflare Tunnel on your origin server using cloudflared, then set up access policies in the Cloudflare dashboard to define who can reach each app based on identity and device compliance. Add your identity provider (Okta, Azure AD, etc.), configure device posture rules (OS version, firewall status), and deploy WARP client to remote teams for encrypted network access.
How do I configure device posture and access policies for remote teams?
Cloudflare Zero Trust's device posture feature checks endpoint security before granting access. In your Cloudflare dashboard, define posture policies requiring specific OS versions, firewall status, antivirus presence, or disk encryption. Create access policies that combine identity checks (email domain, group membership) with device requirements. Remote teams install the WARP client, which reports device health to Cloudflare. Only devices meeting your posture rules can access internal services, ensuring your remote workforce maintains compliance.
Can I secure SSH without VPN using Cloudflare Zero Trust?
Yes, Cloudflare Zero Trust secures SSH without VPN by routing SSH traffic through Cloudflare Tunnel and enforcing identity verification. Deploy cloudflared on your SSH server, create an access policy requiring authentication, and users connect via a browser-based terminal or SSH client configured to proxy through Cloudflare. This eliminates the need to expose SSH ports publicly and ensures every connection is logged and audited through your Zero Trust policies.
How does Cloudflare Gateway DNS filtering block malware and phishing?
Cloudflare Zero Trust includes Gateway DNS filtering that inspects DNS queries at the network level to block malware and phishing domains. Configure DNS policies in your Cloudflare dashboard to block known malicious sites, and enable WARP client on user devices to route DNS queries through Cloudflare's threat intelligence. Gateway automatically blocks requests to domains associated with malware, ransomware, and phishing, protecting your remote teams even before they reach dangerous content.
How do I automate CI/CD access using Cloudflare service tokens?
Cloudflare Zero Trust supports CI/CD automation through service tokens, which allow non-human identities to authenticate to protected applications. Create a service token in the Cloudflare dashboard, configure an access policy to grant it permissions to your internal CI/CD tools, and embed the token in your deployment pipeline. This enables automated deployments to access internal services without exposing credentials or requiring manual authentication.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Cloudflare Zero Trust
Secure access to internal services without VPNs using Cloudflare's Zero Trust platform (Access, Tunnel, Gateway, and WARP).
When to Use
- Replacing VPN access to internal web applications, SSH, or RDP.
- Enforcing identity-aware access policies on internal tools (dashboards, admin panels).
- Exposing on-premises or private-network services securely to remote teams.
- Filtering DNS traffic to block malware, phishing, and shadow IT.
- Enforcing device posture checks (managed devices, OS version, disk encryption).
Prerequisites
- Cloudflare account with Zero Trust plan (free tier supports up to 50 users).
- A domain on Cloudflare (for Access application hostnames).
- Identity provider configured (Google Workspace, Okta, Azure AD/Entra ID, GitHub).
cloudflaredCLI installed on the server hosting internal services.
```bash
Install cloudflared
macOS
brew install cloudflared
Debian/Ubuntu
curl -fsSL
(truncated - see the full file via the links below)
File tree — 1 file
infrastructure/cloudflare/cloudflare-zero-trust/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Set up Cloudflare Zero Trust to secure internal apps without VPN”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Expose any local HTTP service to the internet using your own domain through Cloudflare Tunnel, with zero inbound firewall configuration or certificate hassle. The skill handles tunnel creation, DNS setup, and cloudflared installation automatically while you manage the Cloudflare account and API token. Supports multiple sites on a single tunnel for efficient resource use.
Cloudflare One helps you architect and operate zero trust deployments spanning identity, traffic control, private networking, and data protection. It covers Access for app authorization, Gateway for traffic filtering, WARP for device connectivity, Tunnel for private network on-ramps, plus DLP, CASB, device posture, and identity federation. Use it to design topology, configure policies, troubleshoot connectivity, and review security posture across your infrastructure.
Configure Workers to reach private APIs across cloud providers and on-premise infrastructure using encrypted tunnels. This skill covers tunnel setup, VPC service creation, wrangler binding configuration, and the critical rules that prevent common errors like dns_error and requests leaking to public endpoints.
This skill guides you through migrating from Zscaler ZIA/ZPA, Palo Alto, legacy VPN, SWG, or SASE environments to Cloudflare One. It covers migration assessments, policy mapping, dependency sequencing, and safe rollout staging with source-specific guidance for each platform.
Systematically identifies and resolves Cloudflare Tunnel connectivity failures that block remote access. Checks container status, validates tunnel tokens, analyzes logs for Error 1033 and QUIC issues, and provides targeted recovery commands.
Configure Cloudflare Access service tokens to enable automated systems, scripts, and monitoring to authenticate without human intervention or Google OAuth. Store credentials securely in .env, test access with curl or a helper script, and manage token lifecycle through the Cloudflare dashboard.
More skills Cloudflare Tunnel Setup (unlicensed) · cloudflare-zero-trust-access (MIT) · cf-access-wall (MIT) · firewall-config (MIT) · Macos Security Privacy Hardening (NOASSERTION)