LRSFC_DanJ Posted March 11 Posted March 11 In order to integrate with the admissions platform we're using, we'd like to use a Cloudflare tunnel and web application firewall to make the API endpoint for our MIS system available for their system to connect to over the internet, without needing to expose our MIS system directly to the public internet. However looking at Cloudflare's documentation it seems like you have to switch your whole domain's DNS over to Cloudflare as part of the Cloudflare onboarding process? We don't want to do that as we are an .ac.uk domain holder and as such we use Janet DNS for our public DNS. Is it still possible for us to use Cloudflare's tunnels, or do we need to look for a different solution? Entra Application Proxy was something else we looked at but this appears to require an Entra sign-in, which is no good for an API that is only going to be used by automated systems.
machy Posted March 11 Posted March 11 If the other end is a server you have control over it can have the (warp?) client installed and then you can use private hostnames like \\mis\ or even the IP directly If not, for £10/Year, you may aswell just buy a domain specifically for using with CF Tunnels
DrCheese Posted March 11 Posted March 11 21 minutes ago, LRSFC_DanJ said: Entra Application Proxy was something else we looked at but this appears to require an Entra sign-in, which is no good for an API that is only going to be used by automated systems. Only if you set it that way, you can just have it transparently publish.
LRSFC_DanJ Posted March 11 Author Posted March 11 24 minutes ago, machy said: If the other end is a server you have control over it can have the (warp?) client installed and then you can use private hostnames like \\mis\ or even the IP directly If not, for £10/Year, you may aswell just buy a domain specifically for using with CF Tunnels No, the other end is controlled by our third party admissions platform provider. We also would not want them "inside" our network boundary, which would be the case if we had a tunnel directly to them.
LRSFC_DanJ Posted March 11 Author Posted March 11 9 minutes ago, DrCheese said: Only if you set it that way, you can just have it transparently publish. Does Entra Application Proxy have any web application firewall functionality? As we'll need that as well, hence looking at Cloudflare as they have a WAF option.
dhicks Posted March 11 Posted March 11 2 hours ago, LRSFC_DanJ said: We don't want to do that as we are an .ac.uk domain holder and as such we use Janet DNS for our public DNS. As suggested above, you could probably simply purchase the .co.uk / .com / .online / etc version of your domain name from Cloudflare, that might be the cheapest option. We've used Cloudflare's zero-trust tunnels for several years now to host various on-site applications, and found them to be reliable and very good value for money (free!). You can secure endpoints using login-with-Google/Microsoft (OAuth), which again is still free for under 50 users. For tunneling alternatives, the two I've used in the past are ngrok and Tailscale, a quick Google for "Tailscale alternatives" in particular brings up a good selection. The system I'm developing with at the moment is Pangolin, which can handle both the tunneling and user login, and (the self-hosted version of) which I find well designed and capable.
dmj Posted March 11 Posted March 11 Why couldn't you transfer a subdomain like www to Cloudflare and keep the top level at JANET ? Technically your 'whole domain' is just a subdomain so it sounds feasible to portion it out further.
LRSFC_DanJ Posted March 11 Author Posted March 11 5 minutes ago, dmj said: Why couldn't you transfer a subdomain like www to Cloudflare and keep the top level at JANET ? Technically your 'whole domain' is just a subdomain so it sounds feasible to portion it out further. I think we'll go with the easier suggestion of buying a commercial domain direct through Cloudflare and using that instead. 1
machy Posted March 11 Posted March 11 53 minutes ago, dmj said: Why couldn't you transfer a subdomain like www to Cloudflare and keep the top level at JANET ? Technically your 'whole domain' is just a subdomain so it sounds feasible to portion it out further. I'm pretty sure cloudflare only supports the route domain. At least without spending alotta money
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now