Demo library › Chapter 2
2 Retire the VPN concentrator.
An internal ticketing app on a server with no open ports, reached by name through the Cloudflare One client - and with the client off, the address does not answer at all.
The problem
Horizon Inc still runs a VPN concentrator for its internal tools. It needs an inbound port, it is a single point of failure, and anyone connected to it can reach the whole network the server sits on - not just the application they needed. Its own service desk has a ticket open about it.
Lands with: infrastructure and network teams, and anyone who has been paged about a VPN appliance
Before you start
- Lab only. This chapter reaches the private estate on the lab VM - Backlog, an internal
ticketing app, at
192.168.10.10. A laptop deploy has no server to reach. - The Cloudflare One client installed and enrolled as
, and switched off to begin with. - On the lab VM,
curl -s http://192.168.10.10:8080/healthzreports 30 people. If not, see/var/log/private-estate.log.
Run it
No door to knock on
| Do | Say |
|---|---|
| Zero Trust → Networks → Tunnels → Horizon Inc traffic on-ramp. | The apps server runs a small connector that dials out to Cloudflare and holds the connection open. Nothing dials in. There is no inbound firewall rule anywhere, so there is nothing to misconfigure and no address to scan. |
Open the tunnel's routes: 192.168.10.10/32. | One address, not a subnet. We are about to grant one application, not a network. |
With the client off, open http://backlog.corp.internal:8080. | Nothing happens. Not a block page, not "access denied" - the name does not resolve and the address does not route. There is nothing to attack, which is the difference from a VPN, whose login page is always there. |
A pilot you could run on Monday
| Do | Say |
|---|---|
| Zero Trust → Team & Resources → Devices → Device profiles → the default profile → Split tunnels. | Only the internal range goes through Cloudflare from this profile's point of view; everything a 10/8 network needs locally still goes around it. You do not have to route the whole company through anyone on day one. |
Networks → Internal DNS → corp.internal, then
Traffic policies → Resolver policies → Resolve company internal DNS to
Cloudflare service. | Internal names live in a private DNS zone that only Gateway answers. The resolver policy sends any query for corp.internal to it, so the name works for an enrolled laptop and does not exist anywhere else - not on the internet, and not on a laptop with the client off. |
| Access controls → Applications → Backlog (internal service desk). | The application, not the server: destination 192.168.10.10, port 8080, allowed to All
Employees. pgAdmin on the same server, port 8081, has a different policy - which is what per-resource
means. |
Then switch the client on
| Do | Say |
|---|---|
Turn the client on and reload http://backlog.corp.internal:8080. | Same address. Access asks who Alice is, she signs in once, and the service desk loads - from a laptop that, a minute ago, could not find it at all. |
| Open BKL-1060, "VPN drops every twenty minutes from home". | Their own users already know the problem. This is the replacement plan the ticket mentions. |
What the audience should see
- With the client off, the browser fails to resolve the name - no Cloudflare page at all.
- With it on, an Access sign-in, then Backlog's ticket list as Alice.
Where the evidence is
Zero Trust → Insights → Logs: the Access authentication for Backlog, and in Gateway's
network logs the session to 192.168.10.10:8080 with Alice's identity on it.
Known limitations
- The apps server is the same lab VM that deployed the demo. Say so; an audience notices.
- Access matches the destination address and port; the friendly name is answered by Cloudflare's
internal DNS. The device profile's local domain fallback must not cover
internalorcorp.internal, or the laptop asks its own resolver and the name never resolves. - The estate uses its own address, 192.168.10.10, because the lab's 10/8 network has to stay outside the tunnel for the lab's remote desktop to work.
Part of: The whole of Cloudflare One · Replace the VPN · The full tour