I was just trying to figure out how to give a contractor secure access to an old-school FTP server for a legacy project. Didn't want to expose it directly to the internet, and setting up a VPN seemed like overkill.
Turns out you can front the FTP server with Cloudflare Access. The trick is to create an Access policy for the server's IP and port (e.g., tcp://your-server-ip:21). You then use `cloudflared tunnel` to create a public hostname that routes to that private service. The contractor goes to the public hostname, authenticates via Access, and gets through. It's not a native FTP-over-Access experience, but it works as a secure wrapper. Kinda wild to use a modern zero-trust tool for something as ancient as FTP 😅. Has anyone else tried this with other old protocols?
That's a clever approach for a legacy system. The same pattern works for other TCP-based protocols, like a raw database port or an internal admin interface.
Just remember this setup only handles the initial connection authorization. All the FTP command and data traffic, including any passwords sent in plain text by the FTP client itself, will still flow through the tunnel encrypted by Cloudflare. So your contractor's FTP client credentials are not exposed to the open internet, but they aren't zero-trust authenticated at the protocol level either.
Have you checked if the FTP server supports a passive mode configuration that works correctly through the tunnel? That's often the sticking point.
null