2 Retire the VPN concentrator.

ReadyLab only~8 minCloudflare TunnelPrivate network routesSplit tunnelsInternal DNSResolver policiesAccess

An internal ticketing app on a server with no open ports, reached by name through the Cloudflare One client - and with the client off, the address does not answer at all.

The problem

Horizon Inc still runs a VPN concentrator for its internal tools. It needs an inbound port, it is a single point of failure, and anyone connected to it can reach the whole network the server sits on - not just the application they needed. Its own service desk has a ticket open about it.

Lands with: infrastructure and network teams, and anyone who has been paged about a VPN appliance

Before you start

Lab only. This chapter reaches the private estate on the lab VM - Backlog, an internal ticketing app, at 192.168.10.10. A laptop deploy has no server to reach.
The Cloudflare One client installed and enrolled as , and switched off to begin with.
On the lab VM, curl -s http://192.168.10.10/healthz reports 30 people. If not, see /var/log/private-estate.log.

Run it

No door to knock on

Do	Say
Zero Trust → Networks → Tunnels → Horizon Inc traffic on-ramp.	The apps server runs a small connector that dials out to Cloudflare and holds the connection open. Nothing dials in. There is no inbound firewall rule anywhere, so there is nothing to misconfigure and no address to scan.
Open the tunnel's routes: `192.168.10.10/32` and `192.168.10.11/32`.	Two addresses, one per application, not a subnet. We are about to grant an application, not a network.
With the client off, open `http://backlog.corp.internal`.	Nothing happens. Not a block page, not "access denied" - the name does not resolve and the address does not route. There is nothing to attack, which is the difference from a VPN, whose login page is always there.

A pilot you could run on Monday

Do	Say
Zero Trust → Team & Resources → Devices → Device profiles → the default profile → Split tunnels.	Only the internal range goes through Cloudflare from this profile's point of view; everything a 10/8 network needs locally still goes around it. You do not have to route the whole company through anyone on day one.
Networks → Internal DNS → `corp.internal`, then Traffic policies → Resolver policies → Resolve company internal DNS to Cloudflare service.	Internal names live in a private DNS zone that only Gateway answers. The resolver policy sends any query for corp.internal to it, so the name works for an enrolled laptop and does not exist anywhere else - not on the internet, and not on a laptop with the client off.
Access controls → Applications → Backlog (internal service desk).	The application, not the server: destination `192.168.10.10`, port 80, allowed to All Employees. pgAdmin on the same server, at its own address, has a different policy - which is what per-resource means.

Then switch the client on

Do	Say
Turn the client on and reload `http://backlog.corp.internal`.	Same address. Access asks who Alice is, she signs in once, and the service desk loads - from a laptop that, a minute ago, could not find it at all.
Open BKL-1060, "VPN drops every twenty minutes from home".	Their own users already know the problem. This is the replacement plan the ticket mentions.

What the audience should see

With the client off, the browser fails to resolve the name - no Cloudflare page at all.
With it on, an Access sign-in, then Backlog's ticket list as Alice.

Where the evidence is

Zero Trust → Insights → Logs: the Access authentication for Backlog, and in Gateway's network logs the session to 192.168.10.10:80 with Alice's identity on it.

Known limitations

The apps server is the same lab VM that deployed the demo. Say so; an audience notices.
Access matches the destination address and port; the friendly name is answered by Cloudflare's internal DNS. The device profile's local domain fallback must not cover internal or corp.internal, or the laptop asks its own resolver and the name never resolves.
The estate uses addresses of its own, 192.168.10.10 and .11, because the lab's 10/8 network has to stay outside the tunnel for the lab's remote desktop to work.

Part of: The whole of Cloudflare One · Replace the VPN · The full tour