AllTech
Retire the VPN.
Keep every port closed.
Cloudflare Tunnel connects your servers, apps, and sites to Cloudflare without a public IP or a single inbound firewall rule. WARP puts every laptop and phone on that same private network — no concentrator to size, no license count to renew, no split-DNS to babysit.
The VPN was never designed for this.
Most of the networks we take over have the same three problems: a firewall with inbound ports open to the internet because a vendor needed RDP, a VPN concentrator that becomes the bottleneck the moment everyone works remote, and a tunnel that — once a user is on it — puts them on the whole flat network instead of the one app they actually needed.
Open ports are scanned in minutes
Anything published to a public IP gets found. RDP and VPN appliances are the two most common ransomware entry points we see.
All-or-nothing access
A VPN grants network access, not application access. One compromised laptop reaches everything on the subnet.
Appliance ceilings
Concentrator throughput, license tiers, and firmware CVEs all become your problem on a schedule you don't control.
Multi-site sprawl
Every new location means another IPsec tunnel, another overlapping subnet, another routing table to reconcile.
Outbound-only, by design.
Cloudflare Tunnel
A lightweight daemon called cloudflared runs on a server, VM, or container inside your network. It makes outbound-only connections to the nearest Cloudflare data centers on port 7844 — the kind of traffic your firewall already permits. Once established, traffic flows both directions over that connection. Your origin never needs a publicly routable IP, and you can close inbound entirely.
A tunnel is a persistent object with its own UUID. You can run multiple cloudflared connectors against the same tunnel across different hosts, so a reboot or a failed VM doesn't take the connection down. Routes point either to a public hostname or into a private subnet reachable only by authenticated users.
It carries more than web traffic: HTTP servers, SSH, RDP, SMB, internal line-of-business apps, and private subnet routing for protocols that legacy reverse proxies can't handle.
WARP
WARP is the endpoint client — the other half of the connection. Installed on Windows, macOS, Linux, iOS, and Android, it enrolls the device into your Cloudflare organization and routes traffic through Cloudflare's network before it reaches the internet or your internal apps.
That gives you three things a VPN client doesn't:
Device profiles
Different rules for different groups. A field tech, a front-office workstation, and a server admin don't need the same routes or the same posture requirements.
Split Tunnel control
Exclude mode sends everything through Cloudflare except what you carve out. Include mode does the opposite — only your private ranges route through the tunnel, everything else goes direct. We pick per client, and usually per profile.
Posture-aware access
Disk encryption, OS version, EDR presence, domain join, serial number. Fail the check, lose the access — no ticket required.
Because WARP terminates in the same place your tunnels do, users reach private resources
by Layer 4 without running cloudflared access
commands on their own machines. It looks like the app is just there.
Sized for your network, not a demo tenant.
Tunnel architecture
Connector placement, replica pairs for high availability, and per-site tunnels with clean subnet separation. Designed so no one location is a single point of failure.
WARP rollout
Deployed silently through Datto RMM or Intune with your enrollment parameters baked in. Users get the client already logged in, not a PDF with setup instructions.
Device profiles & posture
Profiles mapped to your actual roles, with Split Tunnel routes and posture checks tuned per group instead of one global policy that fits nobody.
Private DNS & local fallback
Internal hostnames keep resolving. We configure Local Domain Fallback so your domain controllers, NAS shares, and legacy apps answer the way they always have.
Site-to-site replacement
Multi-location networks connected through Cloudflare instead of a mesh of IPsec tunnels. Includes OT and industrial segments where the PLC network needs to reach head office and nothing else.
Terraform-managed
Your configuration lives as code in version control. Changes are reviewed before they ship and auditable after.
What clients actually use it for.
Three ways to start.
VPN & remote access review
We document what's currently published, who has access to what, and where the VPN is actually being used. You get a written report and a migration plan. Often the right first step.
Fixed-scope rollout
Tunnel architecture, WARP deployment, device profiles, DNS, and cutover. Typically 2–6 weeks depending on site count and application inventory. The old VPN stays up until the new path is proven.
Managed Cloudflare
Policy changes, user provisioning, connector health monitoring, version upgrades, and incident response. Billed monthly per seat.
Common questions
Does this replace our firewall?
No. It replaces inbound firewall rules and your VPN. You still want a proper edge device for local segmentation, routing, and WAN failover — we deploy UniFi for that side.
What happens if the internet drops at a site?
Local resources stay local. Tunnel connectivity depends on your ISP the same way a VPN does — which is why we design multi-WAN failover alongside it for sites that can’t be offline.
Will our old software work?
Usually. Tunnel carries SSH, RDP, SMB, and arbitrary TCP over private routing. Anything we're unsure about gets tested during the assessment, before you commit.
Do users have to do anything?
Log in once. After that WARP runs in the background and reconnects on its own. There’s no “connect to VPN” step in the morning.
Is this only for large companies?
No. We run this for organizations from a dozen seats up. Cloudflare's Zero Trust tier is free under 50 users, which makes the math work for businesses that could never justify an appliance refresh.
The rest of the stack it plugs into
Secure Web Gateway
DNS, network, and HTTP filtering as a service, applied to the same WARP-enrolled devices.
Learn moreCloudflare Zero Trust
The full Cloudflare One platform this sits inside — Gateway, Email Security, DNS, and DDoS protection.
Learn moreNetwork & Infrastructure
The edge device, segmentation, and multi-WAN failover that Tunnel sits on top of rather than replaces.
Learn moreAllTech Top 10
Where identity-aware remote access fits in the wider security stack we deploy first.
Learn moreRemote IT Support
What we deliver remotely vs. what needs someone on-site, in one place.
Learn moreStill running a VPN?
Tell us what's published today and how many people connect. We'll do a 30-minute scoping call and tell you honestly whether Tunnel and WARP are the right move — sometimes the answer is fix the firewall first.
