Setting Up Cloudflare Access

Setting Up Cloudflare Access
Cloudflare Access

I’ve been a fan of Cloudflare for a while now. I love how fast they can propagate DNS changes and I typically like to use them as a DNS resolver. An issue that I’ve ran into many times, is how to protect something with MFA (Multi-Factor Authentication) that doesn’t have any support for MFA.

This problem is common with legacy web applications and very common with SCADA (Supervisory Control And Data Acquisition) web applications. The issue I was trying to solve was how to put MFA in front of a SCADA web application.

I decided to use Cloudflare Access. Cloudflare Access goes by a few names some of them are Cloudflare Zero Trust Network Access (ZTNA), Cloudflare Access, and Cloudflare Zero Trust Access. For simplicity I’m going to refer to it as Cloudflare Access.

Cloudflare Access is really nice because you can put it in front of any web application and it will require the user to authenticate before they can even reach the website.

If you have a lot of applications like this you can even set it up so the users can login to a portal to see all of the applications that are available to them. You can do all of this without the user having to install anything. What’s even better is that it’s free for 50 users.

Here’s how I setup a SCADA web app with Cloudflare Access.

Prerequisites

For everything to go smoothly here are a few things that should be in place first

  • DNS for the web app is in Cloudflare
  • Cloudflare Proxy is enabled for the DNS record of the web app
  • The Web App is running directly on port 443 (you can have a reverse proxy in front of it if needed)
  • The firewall in front of the web app is setup to only allow access from Cloudflare’s IPs (this makes it so you can’t get to the application even if you know the public IP it would be on) you can find the list of Cloudflare’s IPs here.

Initial setup

  • Click on Access > Applications
Cloudflare Zero Trust Access Applications
Cloudflare Zero Trust Access Applications
  • Click on Add an application
Add a Cloudflare Zero Trust Access Application
Add a Cloudflare Zero Trust Access Application
  • Select Self-hosted from the list of options
Self-hosted option for Add a Cloudflare Zero Trust Access Application
Self-hosted option for Add a Cloudflare Zero Trust Access Application

Configuring the app

  • Name your application (I’m going to call mine SCADA App)
  • Select your Session Duration (I usually leave it at the default of 24 hours)

Session duration is how long the user can access the application until they need to login to Cloudflare Access again.

  • Enter what the DNS name is for the web app (I’m going to use scada.dxt.dev)

Your settings should look similar to this.

Cloudflare Zero Trust Access SCADA application example
Cloudflare Zero Trust Access SCADA application example

You also have the option to show the app in an app launcher.

Cloudflare Zero Trust Access App Launcher options
Cloudflare Zero Trust Access App Launcher options
  • Now you need to select an Identity Provider. If you don’t have one you can just use the One-time PIN. (You can find a list of all the supported Identity Providers here)
Cloudflare Zero Trust Access App Identity Providers
Cloudflare Zero Trust Access App Identity Providers

Configuring the policies

Now we need to configure the Policies

  • Name the policy (I’m naming it Allow SCADA Access)
  • Set the rule action as Allow
  • Set the Session duration (I usually leave it set to same as application session timeout)

It should look something like this

Cloudflare Zero Trust Access App Policy
Cloudflare Zero Trust Access App Policy
  • Create an include rule for who should have access

It should look something like this. (I set mine to only allow access to one specific email address)

Cloudflare Zero Trust Access App policies include rule example
Cloudflare Zero Trust Access App policies include rule example
  • Now you can click Add application
Completing Cloudflare Zero Trust Access application addition
Completing Cloudflare Zero Trust Access application addition

Now you should see your application in your Applications list

Cloudflare Zero Trust Access list of Applications
Cloudflare Zero Trust Access list of Applications

Testing it

If you go to the URL of the web application you should now see a Cloudflare Access login page.

Here’s what mine looks like.

Cloudflare Zero Trust Access Login Wall Example
Cloudflare Zero Trust Access Login Wall Example

Now If I enter the email address I specified in the Allow SCADA Access policy, I will get an email with the code and I will be able to access the SCADA web app.

Here’s an example of the login code email

Example of the One-time PIN email

A few things to note

  • If the web application also has a login wall, the user will still need to login to the application after they’ve authenticated to Cloudflare Access.
  • If you need to allow specific IPs to access it without hitting the login wall you can add those IPs as bypasses in your Policies for the application.
  • You can harden your policy rules a lot more (you can read more here)
  • If you link this with your identity provider you can enable SSO to make it more seamless for the users. (you can read more here)

Cloudflare Access is part of Cloudflare Zero Trust platform once you start playing with it the sky’s the limit. You can read more about Cloudflare Access here.

One response to “Setting Up Cloudflare Access

Leave a comment

Your email address will not be published.