Problem
Internal tools were only reachable from inside the network, and the alternative on the table was opening inbound ports on the router. Forwarding a port would have exposed the service directly to the internet and moved the only control to whatever authentication the application happened to have.
Our role
Independent project — configuration and deployment for our own environment.
Approach
Each service is published through a named Cloudflare Tunnel, so the connection is outbound from the origin and nothing is listening for inbound traffic at the edge. Cloudflare Access sits in front of each hostname with its own policy, which means access is tied to an identity rather than to a network location.
DNS is scoped to those hostnames only, so a service that is not meant to be public has no public name to find. Tunnels, policies, and DNS entries are named after the service they belong to, which keeps the configuration readable when it is reviewed later.
Outcome
Services are reachable from anywhere without inbound ports open, and every request is checked against an access policy before it reaches the origin. Removing a service is a matter of deleting its tunnel and DNS entry rather than closing a hole in the router.
Notes
No configuration dumps, hostnames, or account details are published here. The write-up describes the shape of the setup, not the credentials inside it.