Cloudflare Zero Trust : A secure way to access your Self hosted Linux Server

If you run a self-hosted Linux server like me, you probably love Webmin for easy server management. But exposing Webmin (which runs on port 10000 by default) directly to the internet is a security nightmare. Port forwarding, firewall rules, and constant attack attempts? No thanks!

Cloudflare Zero Trust + Cloudflare Tunnel solves this perfectly. You get full HTTPS access from anywhere in the world, protected by email OTP (or your own identity provider), without opening a single port on your server or router.

What is Cloudflare Zero Trust?

Cloudflare Zero Trust is a modern security model built on the principle of “never trust, always verify.” It replaces traditional VPNs by continuously authenticating every user, device, and request before granting access to private applications and resources. Using Cloudflare Access and Cloudflare Tunnel lets you securely expose internal tools (like Webmin) to the internet without opening firewall ports or exposing your server publicly.

What is Cloudflare Tunnel?

Cloudflare Tunnel (powered by the lightweight cloudflared daemon) creates a secure, outbound-only connection from your server straight to Cloudflare’s global edge network. It lets you safely expose internal applications—like Webmin—to the internet without opening any firewall ports, doing port forwarding, or exposing your server publicly. All traffic is routed through Cloudflare, giving you automatic HTTPS, DDoS protection, and seamless integration with Zero Trust security.

What is Webmin?

Webmin is a popular open-source, web-based control panel for Linux and Unix servers. It provides an easy graphical interface in your browser to manage users, services, networking, databases, web servers, and security settings — all without needing advanced command-line skills. Self-hosters love it for quick remote administration (usually on port 10000).

In this step-by-step guide (based on my real setup with domain rupindersingh.in, I’ll show you exactly how I did it in under 15 minutes.

Why This Method Beats Traditional Port Forwarding

• Zero Trust security: Only verified users (via email OTP) can even see the login page
• No public ports → No brute-force attacks
• Works behind CGNAT, home routers, or any network
• Automatic HTTPS + Cloudflare’s global edge network
• Completely free for personal use

Prerequisites

• A domain already added to Cloudflare (with DNS managed by Cloudflare)
• A Linux server (Debian/Ubuntu in my case) running Webmin on port 10000
• SSH/root access to the server
• An email address you can receive OTPs on

What is Cloudflare Zero Trust?

Cloudflare Zero Trust is a modern security model built on the principle of “never trust, always verify.” It replaces traditional VPNs by continuously authenticating every user, device, and request before granting access to private applications and resources. Using Cloudflare Access and Cloudflare Tunnel, it lets you securely expose internal tools (like Webmin) to the internet without opening firewall ports or exposing your server publicly.

What is Webmin?

Webmin is a popular open-source, web-based control panel for Linux and Unix servers. It provides an easy graphical interface in your browser to manage users, services, networking, databases, web servers, and security settings — all without needing advanced command-line skills. Self-hosters love it for quick remote administration (usually on port 10000).

Step 1: Create the Application in Cloudflare Access

1. Log in to the Cloudflare Dashboard
2. Select your domain → Access (left sidebar)
3. Click Get started under Cloudflare Access

You’ll see three options.

Choose:
Connect a private web application

and click on Continue

Step 2: Define Your Webmin Application

Fill in the details exactly like this:

• Application name: Webmin (or whatever you like)
• Internal hostname or IP address: Your server’s local LAN IP (e.g., 192.168.1.100)
• Protocol: HTTPS (even if Webmin is running plain HTTP internally – Cloudflare handles it)
• Port: 10000

Click Continue

Step 3: Choose a Public Subdomain

• Select your domain (rupindersingh.in in my case)
• Enter a subdomain: I used webmin(so the full URL becomes https://webmin.rupindersingh.in)

Cloudflare will automatically create the required CNAME record.

Then click Continue

Step 4: Add Your First Access Policy (Email OTP)

• Add your email address under Approved user emails (e.g., jxxxxxxxxu@gmail.com)
• Click Continue

This creates a simple policy that sends a One-Time PIN to your inbox. You can later add Google, Okta, Microsoft, etc.

Step 5: Create & Deploy the Cloudflare Tunnel

On the next screen, click Continue under “Assign a Tunnel”.

Now choose Debian as the operating system and 64-bit architecture.

Cloudflare will give you the exact commands. Copy and run them one by one on your server:

# Add Cloudflare GPG key
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-public-v2.gpg | sudo tee /usr/share/keyrings/cloudflare-public-v2.gpg >/dev/null

# Add repo
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-public-v2.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

# Install cloudflared
sudo apt-get update && sudo apt-get install cloudflared

# Install the tunnel service
sudo cloudflared service install eyJhIjoi... (the long token Cloudflare gives you)

After running these, the tunnel starts automatically and runs as a service.

Step 6: The Final Moment!

Open your browser and go to the subdomain you created:

https://webmin.rupindersingh.in

You’ll see the beautiful Cloudflare Zero Trust login page.

1. Enter the email you added in the policy
2. Check your inbox for the OTP
3. Enter the OTP
4. Boom! You’re inside Webmin – fully secure, from anywhere in the world.

Final Result

• Webmin is now accessible from any device (phone, laptop, anywhere)
• No ports are open on your server or firewall
• Everything is encrypted end-to-end
• You can add more users, enforce 2FA, device posture checks, etc., anytime

Bonus Tips

• Want to use your own domain with custom branding? Go to Access → Applications → Edit later
• Need SSH access too? Just create another application with “Configure clientless SSH”
• The tunnel stays connected even after a server reboot (thanks to the service)

That’s it! In less than 15 minutes, I turned my private Webmin interface into a securely accessible web app without touching my firewall.

Have you tried Cloudflare Tunnels yet? Drop your experience or any questions in the comments below — I reply to everyone!