Locking the Front Door: Securing Public Linux Servers with Cloudflare Tunnels and Zero-Open-Port Firewalls

Secure Linux servers with Cloudflare Tunnels and zero-open-port firewalls. Eliminate exposed SSH and reduce attack surface dramatically. 

Exposing SSH (port 22) or any other service directly to the internet is one of the fastest ways to get compromised. The modern and much safer approach is to use Cloudflare Tunnels combined with a zero-open-port firewall policy.

This setup allows you to access your Linux servers securely without opening any inbound ports, dramatically reducing your attack surface.

I migrated several production servers to this model after seeing repeated brute-force attempts and one successful unauthorized access. Since switching, the servers have zero public-facing ports open, and all traffic goes through Cloudflare’s secure tunnel.

How Cloudflare Tunnels Work

You install cloudflared on your Linux server and run it as a tunnel. The daemon creates an outbound connection to Cloudflare’s network. Cloudflare then proxies traffic to your server without you ever opening inbound ports on your firewall.

Setting Up the Tunnel

Here is a production-ready config.yml:

# /etc/cloudflared/config.yml
tunnel: 1111aaaa-22bb-33cc-44dd-555566667777
credentials-file: /etc/cloudflared/1111aaaa-22bb-33cc-44dd-555566667777.json

ingress:
  # Route SSH traffic securely
  - hostname: ssh.yourdomain.com
    service: ssh://localhost:22

  # Route your high-traffic web API
  - hostname: api.yourdomain.com
    service: http://localhost:8000

  # Catch-all rule: Drop anything else with a 404
  - service: http_status:404

Connecting From Your Local Machine

Since port 22 is completely blocked to the public internet, a standard SSH command will time out. Add this to your local ~/.ssh/config:

Host ssh.yourdomain.com
    ProxyCommand /usr/local/bin/cloudflared access ssh --hostname %h

Now when you run ssh user@ssh.yourdomain.com, the request is automatically wrapped into a secure WebSocket tunnel and authenticated through Cloudflare Zero Trust.

Hardening systemd: Running as Non-Root

Never run cloudflared as root. Create a dedicated system user:

sudo useradd -r -s /bin/false cloudflared
sudo chown -R cloudflared:cloudflared /etc/cloudflared

Then create the systemd service as shown earlier.

Zero-Open-Port Firewall Policy

Once the tunnel is active, lock down the firewall completely:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

No ports are exposed to the public internet anymore.

What Changed After Implementation

After adopting this setup, brute-force attacks on SSH dropped to zero. The servers now have a much smaller attack surface, and management became easier and more secure at the same time.

Final Thoughts

By dropping all inbound packets at the hardware firewall and forcing every connection through an authenticated outbound tunnel, you transform your server from a public target into an invisible node on the network. Brute force attempts cease to exist because there is simply no port to attack.

For more details on tunnel configuration, see the official Cloudflare Tunnel Documentation and Cloudflare Access for SSH.