• Cloudflare account with Zero Trust
• Custom domain
• Raspberry Pi with SSH enabled

Make sure you change your nameserver and delete any existing nameserver. You can obtain the correct name server on Cloudflare dashboard. Example:

owen.ns.cloudflare.com

george.ns.cloudflare.com

Go to: https://dash.cloudflare.com/ then add your domain.

Your domain won't be actived if the nameserver is not change to Cloudflare.

For more details, Cloudflare docs here.

sudo mkdir -p --mode=0755 /usr/share/keyrings

curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main" | sudo tee /etc/apt/sources.list.d/cloudflared.list

sudo apt-get update && sudo apt-get install cloudflared

Check if cloudflared has been installed:

cloudflared --version

cloudflared tunnel login

Use the link cloudflared spit out on the terminal and login on web browser.

cloudflared tunnel create [NAME_OF_YOUR_TUNNEL]

Cloudflare will generate the certificate.json for the tunnel. We will need it later. Make sure to save the path of the cert.

sudo nano ~/.cloudflared/config.yml

Within this file, you will want to type in the following lines and adjust them for your use case as you go.

[TUNNELNAME] – Replace this value with the name of your tunnel.

[USERNAME] – This value will need to be replaced with your user’s name.

[UUID] – You will need to specify the UUID that you got back in step 5 of this section.

[HOSTNAME] – Swap this value out with the domain name you are planning to utilize. For example, “test.pimylifeup.com“.

[PORT] – Finally, replace “PORT” with the port you want accessible through the tunnel.

[PROTOCOL] – This is the protocol you want tobe utilized for your service. In the case of a web server, you will want to use “http” or “https“.

E.G., http://localhost:8080 https – Forward HTTPS requests to the specified service

E.G., https://localhost:8080 unix – Same as HTTP but using a Unix Socket.

E.G., unix:/home/example/exam.sock unix+tls – Same as HTTPS but utilizing a Unix socket.

E.G., unix+tls:/home/example/exam.sock tcp – Proxy a service using the TCP protocol to a local service. (For example, a Minecraft server)

E.G., tcp://localhost:25655 ssh – Allows you to proxy an SSH connection to a local service.

E.G., ssh://localhost:22 rdp – Proxies a connection made using RDP to the specified service.

E.G., rdp://localhost:338

tunnel: [TUNNEL_ID]
credentials-file: [PATH_OF_THE_CERT_ABOVE]

ingress:
	- hostname: [your-subdomain].[your-domain] #pi4.khoah.com
	  service: ssh://localhost:22
	- service: http_status:404

cloudflared tunnel route dns [TUNNEL_ID] [HOSTNAME]

Start and run the tunnel as service

sudo cloudflared --config ~/.cloudflared/config.yml service install

sudo systemctl enable cloudflared
sudo systemctl start cloudflared

To uninstall cloudflared service

sudo cloudflared service uninstall

You can check the status of the tunnel and see if it is running in the Zero Trust Dashboard.

Zero Trust > Network > Tunnels.

1. Create Application on Cloudflare

   Zero Trust > Access > Applications.

   For the setting details, please follow the documents from Cloudflare here.

2. Select Add an application > Self-hosted.

3. Enter your Application name then select Add public hostname.

4. Enter the Subdomain and Domain in the config. In this case, my hostname is pi4.khoah.com

5. In the Advanced setting (optional) > Browser rendering settings > SSH.

Now you can SSH to your Pi using web browser.

If you don't want to use browser, you can install cloudflared on the remote client.

Then run:

ssh -o ProxyCommand="cloudflared access ssh --hostname [YOUR_DOMAIN]" username@your_domain