Understand Cloudflare private access

Cloudflare calls this a VPN replacement. The result is remote access to private resources, but the architecture differs from one VPN server you operate — and the difference is worth understanding before you build it.

Your WireGuard server had a public address and listened for inbound UDP. The whole design depended on that open door. Cloudflare’s model inverts it: nothing on the private network listens for anything.

A connector named cloudflared creates outbound connections from the private network to Cloudflare. It runs on any machine inside that network that can reach the private resource. It dials out to Cloudflare’s edge and keeps those connections alive, waiting for work.

The Cloudflare One Client on the remote device sends matching traffic to Cloudflare. Cloudflare routes it through the connector to the private destination.

laptop (Cloudflare One Client)
   │  outbound connection to Cloudflare
   ▼
Cloudflare edge   ← identity and policy checks happen here
   ▲
   │  outbound connection from inside the private network
cloudflared connector ──▶ 10.0.1.100 (the private resource)

Both arrows point outward. No public inbound port is required on the private network. The firewall stays closed to inbound traffic entirely — there is no UDP 51820 to expose, and nothing for an Internet scanner to find.

Two properties follow from this shape. First, the attack surface changes: a listening VPN port is discoverable and probeable by anyone, while an outbound-only connector offers nothing to connect to. Second, every connection passes Cloudflare’s edge, which is where identity and policy get evaluated — access decisions can consider who is asking, not just who holds a key.

The price is that Cloudflare now sits in the path of every connection. We look at that trade honestly in a later lesson.

On the connector machine, health is easy to check:

systemctl status cloudflared
# ● cloudflared.service - cloudflared
#      Active: active (running)

The misconception to drop now: cloudflared does not “open a port” or “expose the server”. If you find yourself adding an inbound firewall rule for it, you have misread the model — it needs outbound connectivity and nothing else.