Zero Trust Access and Tunnels Instead of VPN Ingress

Zero Trust is not a product you install. It is a decision to stop treating network location as proof of identity. On a traditional VPN, a user who authenticates once lands on an internal subnet and can reach anything routable from there. Zero Trust replaces that with a per-request check: who is this identity, what device are they on, and is that combination allowed to reach this specific application right now.

Outbound tunnels remove inbound ingress

The first structural change is how traffic reaches your application. Instead of opening a port on a firewall and publishing a public IP, you run a lightweight connector inside the network next to the service. That connector dials outbound to the edge and holds the connection open. Requests arrive at the edge, are authorized there, and are handed down the existing outbound connection.

The practical consequence is that the origin has no listening port exposed to the internet. There is nothing to port scan, nothing to brute force, and no need for inbound firewall rules or a static public address. It also means the application does not have to move; the connector reaches it over the internal network the same way any other internal client would.

Route definitions map a public hostname to an internal address the connector can reach. Keep those mappings narrow. A connector configured to route an entire private range is a flat VPN with extra steps.

The mechanics of getting a connector running, including the outbound port it needs and the ingress rules that decide what it will serve, are covered step by step in Cloudflare Tunnel setup: your first tunnel.

Policies are identity plus context, not IP ranges

An access policy answers a single question: should this request be allowed. The inputs are the authenticated identity from your identity provider, the group or role membership carried in that token, and signals about the device and the request itself.

Integrating an identity provider over SAML or OIDC is what makes this workable. The identity provider stays the single source of truth for accounts, group membership, and multi factor enrollment. Access consumes assertions from it rather than maintaining a parallel user list. When someone leaves and is disabled centrally, their access disappears everywhere without per application cleanup.

Write policies against groups, not individual users. Individual grants accumulate silently and nobody audits them. Group based rules stay legible and get reviewed as part of normal identity governance.

Order matters as much as content. Cloudflare’s documentation states that Bypass and Service Auth policies are evaluated first from top to bottom, then Block and Allow policies in their listed order, and that evaluation stops once a user matches an Allow or Block. A broad permissive rule sitting above a narrow one is not redundant; it is the policy that actually applies. Whether a proxied policy engine is the right shape for your fleet at all is the subject of Cloudflare Access compared with Tailscale.

Device posture narrows the trust boundary further

Identity alone still allows a valid user on a compromised or unmanaged machine. Device posture adds checks about the endpoint: whether the device enrolled through the managed client, whether disk encryption is on, whether an endpoint agent is running, whether the operating system is current.

Roll posture out in stages. Start by logging which devices would fail a proposed check before you enforce it. Posture rules enforced on day one against an unknown fleet will lock out people who did nothing wrong, and the usual response is to disable the check entirely rather than fix the fleet.

Common mistakes

The most frequent one is lifting and shifting a VPN. If every application ends up behind one broad policy that says any employee, you have rebuilt flat network access with a different login page. Segment by application sensitivity from the start.

The second is forgetting non browser traffic. Web applications are the easy case. SSH, RDP, databases, and internal APIs need their own handling through the device client or through protocol aware routing, and teams often leave a legacy VPN running indefinitely just to cover them. That legacy path becomes the weakest link.

The third is skipping logging. Per request authorization produces a decision log that tells you who reached what and when. Ship it somewhere durable before you need it for an incident, not after.

The fourth is treating the connector as infrastructure that looks after itself. A single daemon running in a terminal on one host is a single point of failure for every application behind it, and when it stops, users get an error page rather than a degraded experience. Cloudflare error 1033 and how to fix a broken tunnel walks through why connectors disappear and which redundancy actually helps.

Start with one internal application, put it behind identity and a narrow policy, confirm the origin port is closed from outside, and expand from there.