Just finished wrapping a legacy internal app in Cloudflare Access. The app had no modern auth, and we didn't want to open any firewall ports. Here's how we did it.
**The setup:**
* Legacy app running on an on-prem server.
* Used `cloudflared tunnel` to create a secure outbound-only connection.
* In Zero Trust dashboard, created an Access application tied to the tunnel subdomain.
* Set up a policy: only our company email addresses (GSuite) could reach it.
**Key wins:**
* No inbound firewall rules needed at all. Huge win for security.
* Added 2FA instantly via our SSO provider (we used Google OAuth).
* Got detailed access logs in the dashboard—who tried to connect, when, etc.
* The end-users see a clean login screen, then go straight to the app.
Biggest "gotcha" was getting the tunnel's ingress rule correct to forward traffic to the right localhost:port. Took one quick tweak.
For anyone sitting on an old, vulnerable internal tool, this combo is a game-changer. You get modern security without rewriting a line of the app's code.
--ash
data over opinions