Choose and clean up the right design

You built the same capability twice in this course: once with WireGuard, once with Cloudflare. Neither is “the right one”. Each fits different requirements.

Choose WireGuard when you want a small protocol, control of both peers, and your own endpoint. Nothing sits between you and your traffic. The cost is that everything is yours: key distribution, server patching, routing, DNS, and firewall design.

Choose Cloudflare private access when outbound-only connectivity, managed clients, identity, and destination policy are central requirements. You trade a third party in the path for policies that understand who is connecting, not just which key they hold.

And sometimes neither is right. For one web application, Cloudflare Access through a browser may be narrower than network access — the user reaches one app and touches no network at all. For two networks that must behave as one, a site-to-site design fits better than per-device clients ever will.

one device → your network, full control        WireGuard remote access
workforce → internal apps, identity rules      Cloudflare private access
a few people → one web app                     Access in front of the app, no tunnel
network ↔ network, permanently                 site-to-site design

Decide from the sentence you wrote back in the first module: who must reach what. The design falls out of the sentence.

Now finish the course by removing the lab completely: lab peers, keys, routes, policies, enrolled devices, tunnels, firewall rules, and any paid server. Leftover access paths are a real risk — a forgotten peer key is a credential, and a forgotten tunnel is a door.

Then confirm the private resource is unreachable afterward. The verification of a cleanup is a failed connection:

ping -c 2 -W 2 10.0.1.100
# 2 packets transmitted, 0 received, 100% packet loss

ssh -o ConnectTimeout=5 flavio@10.0.1.100
# ssh: connect to host 10.0.1.100 port 22: Operation timed out

Here, the timeout is the passing test.

The cleanup mistake people make is walking only one list. Deleting the cloud server while the Zero Trust organization still holds routes and enrolled devices leaves config pointing at nothing — or worse, at whatever gets that IP next. Walk both inventories: the cloud provider’s resources and the Cloudflare organization’s configuration. Done means both are empty.