Understanding Cloudflare Zero Trust vs. Cloudflare Proxy With Respect
to Security
reddit / selfhosted

----------------------------------------------------------------------
layer4andbelow · 2023-12-21 12:39

I am trying to understand the benefit of Cloudflare Zero Trust over
Cloudflare proxy when combined with strong firewalling.

I am currently using Cloudflare proxy and a reverse proxy hosted at
home (all encrypted with lets encrypt). I have firewall rules setup to
only allow Cloudflare's IP's to access port 443. That is the only port
I have open and it is forwarded to one machine:port on a DMZ VLAN. The
only way out of that VLAN is via port 443. I am using various
Cloudflare tools like WAF to restrict GoIPs at the proxy level as
well.

While I understand using Zero Trust allows me to open zero ports, or
use an ephemeral port if my ISP is a pain. But I don't understand the
benefit past that? Sure I have an open port, but with good firewalling
(only allowing trusted Cloudflare IPs), what makes it less secure?

As a side note, I am talking about this with respect to applications
that don't play nice with additional layers of authentication.
Something like Home Assistant.

----------------------------------------------------------------------
RedditSlayer2020 · 2023-12-21 14:32

r/cloudflare

----------------------------------------------------------------------
ericesev · 2023-12-21 16:01

>As a side note, I am talking about this with respect to applications
that don't play nice with additional layers of authentication.
Something like Home Assistant.

The main benefit to Zero Trust is the authentication. If you aren't
using that, then it doesn't add value.