Daniel Lyons' Notes

EASY Remote Access How to setup CloudFlare Tunnels

Description

Notes

00:00 Introduction to Cloudflare Tunnels

  • Fast, secure remote access even behind CGNAT or Starlink
  • No need to expose NAS directly to the internet
  • Setup on Synology NAS (works with Docker on other devices too)
  • Provides signed SSL certificates without port forwarding

00:52 What Are Cloudflare Tunnels

  • Web firewall that exposes local network services to the internet without port forwarding
  • How it works:
    • Run a Cloudflare daemon (typically in Docker container) on local network
    • Daemon creates encrypted connection to Cloudflare servers
    • Traffic flows through encrypted tunnel to your NAS
    • Public IP never exposed
    • 01:38 Works even without a public IP address (like Starlink)
  • Use cases:
    • Share files via Synology Drive
    • Host websites on NAS
    • Supports SSH and web traffic
    • 01:58 Note: Does not work with Synology Drive Share Sync
  • Security considerations:
    • 02:12 Can limit access similar to a VPN using web authentication
    • Less secure than a full VPN - not for highly sensitive data
    • Good middle-ground solution for employee access to non-critical resources

02:56 Requirements

  • Domain registered with Cloudflare
  • NAS or device capable of running Docker
  • 03:28 For Synology: Container Manager must be installed
  • Uses Cloudflare free tunnel (no cost)

03:47 Setup Process

03:47 Creating the Tunnel in Cloudflare

  • Access Cloudflare Zero Trust dashboard
  • Go to Networks → Tunnels → Add Tunnel
  • 04:18 Name your tunnel and generate secret token
  • 04:32 Token is one-time use - save it temporarily (destroy after setup)

05:04 Installing Cloudflare Daemon on NAS

  • Open Container Manager (or Docker for older DSM versions)
  • Search registry for "cloudflare" → Download cloudflared image
  • 05:25 Run container with these settings:
    • Name: Match your tunnel name
    • Enable auto-restart
    • Run on host network
    • 06:05 Replace default command with tunnel run token
  • 06:32 Container will quickly connect; delete token file after

06:46 Configuring Public Access

  • Choose public hostname (e.g., "drive-demo")
  • 07:08 Set local service URL using HTTPS protocol
  • 07:21 Enter Synology IP address and port (e.g., 10.30.19.X)
  • Recommend setting static DHCP reservation for NAS IP

08:05 Configuring Synology Drive Port

  • Edit Synology Drive application settings
  • Set custom HTTPS port (e.g., 2345)
  • 08:31 Route specific port only to Synology Drive
  • Add this port to tunnel configuration

08:56 Advanced Settings

  • Enable "No TLS verify" - skip SSL certificate verification on NAS
  • Assumes local network is secure
  • 09:19 Save tunnel configuration

09:31 Testing and Using

  • Access Synology Drive globally with signed SSL certificate
  • 09:40 Configure Synology Drive to use tunnel URL for all shared links
  • Go to Drive admin console → Settings → Sharing
    • Enable sharing link customization
    • Force HTTPS
    • Create custom URL

10:42 Adding Authentication and Access Control

  • Security concern: Service is publicly accessible if URL is known
  • Solution: Create access groups and policies
  • 11:04 Create new access group
    • 11:25 Example: "Space Rex Employees" - restrict to specific email domains
    • Multiple configuration options available
  • 12:01 Create application policy
    • Set application name (e.g., "Synology Drive")
    • Set session duration (e.g., 24 hours)
    • Configure identity providers
    • Link to access group
  • 13:10 Result: Email verification required to access service
  • 13:40 Provides middle-layer security without requiring full VPN setup

14:20 Summary

  • Cloudflare Tunnels provide powerful customization and access control options
  • Extensive authentication methods available
  • Much more functionality beyond basics covered in this tutorial
EASY Remote Access How to setup CloudFlare Tunnels
Interactive graph
On this page
Description
Notes
00:00 Introduction to Cloudflare Tunnels
00:52 What Are Cloudflare Tunnels
02:56 Requirements
03:47 Setup Process
03:47 Creating the Tunnel in Cloudflare
05:04 Installing Cloudflare Daemon on NAS
06:46 Configuring Public Access
08:05 Configuring Synology Drive Port
08:56 Advanced Settings
09:31 Testing and Using
10:42 Adding Authentication and Access Control
14:20 Summary