Cloudflare with Devolutions Gateway

Important Cloudflare Tunnel behavior: a Cloudflare named tunnel public hostname serves HTTP/HTTPS/WebSocket at the Cloudflare edge on port 443. It does not expose raw TCP as hostname:port on the public internet. For native RDM TCP relay sessions, each client must run cloudflared access tcp, which creates a local listener such as localhost:8181.

1. Log in to the Cloudflare dashboard.
2. Go to the Zero Trust section under the Cloudflare Dashboard. This may prompt you to choose a plan; the Zero Trust free plan will work.

The free Cloudflare plan can be used to install and run Cloudflare tunnels. However, on the free plan, the public domain must use full setup DNS, with Cloudflare as the authoritative nameserver.

1. Go to Networks – Tunnels & Mesh and click Create a tunnel.
2. Select Cloudflared and click Next.
3. Input a name and click Save tunnel.
4. Choose the appropriate operating system and architecture.
5. Download the installer via the given link.
6. Copy the configuration string.
7. Run the Cloudflare installer.
8. In the Install and run a connector section of the Cloudflare installation window, copy the command.
9. Open the server with the Cloudflare tunnel daemon installed, then open Command Prompt as an administrator.
10. Paste the configuration string copied in step 8, then press Enter.

It is advisable to verify that the Status shows as Connected. If the tunnel is token/remotely managed, it uses the ingress and TLS settings configured in the Cloudflare dashboard. If you instead run cloudflared with a local config.yml that defines its own ingress: block, the dashboard settings, including No TLS Verify, are ignored.

1. Click Next.
2. Input a unique subdomain.
3. Choose HTTPS as Type. When using a self-signed certificate or an internal-CA certificate for Devolutions Gateway, enable the No TLS Verify option under Additional application settings – TLS.

Use localhost:7171 as the URL if the default gateway configuration was used.

Keep HTTP2 connection turned off for the HTTPS ingress. Devolutions Gateway uses WebSocket, and HTTP/2 to the origin can break WebSocket upgrades.

1. Click Complete setup.
2. Click on the newly created Tunnel name.
3. Click on Published application routes and then Add a published application route.
4. Input a unique subdomain (different from step 14).
5. Choose TCP as Type. Enter localhost:8181 if using the default port.

Cloudflare does not terminate TLS on the TCP path, and there is no TLS Verify setting for TCP. TLS validation happens end-to-end between the RDM client and Devolutions Gateway through the local cloudflared access tcp bridge.

When done, there should be two public hostnames.

Retrieve the provisioning key

The DVLS public key file needs to be accessible to the server hosting Devolutions Gateway, which is behind the Cloudflare tunnel.

1. Log in to the Devolutions Server or Devolutions Cloud instance as a user with access to the Devolutions Gateway configuration.
2. Go to Administration — Devolutions Gateway.
3. Click the More button and select Download public key.

Install Devolutions Gateway with Cloudflare

1. Open a connection to the server hosting Devolutions Gateway and download the installer.
2. Run the installer.
3. Click Next.
4. Once the desired installation path is selected, click the Next button.
5. Click Next.
6. Click Next in the Listeners window.

It is advisable to leave the default listeners in place, as they will likely correspond to the Cloudflare tunnel configuration.

1. Enter the external URI by which the gateway will be reachable.
2. Click Next.
3. Specify the path to the TLS certificates or to the system certificate store location.

The gateway certificate must include every name that a TLS client validates against. For the Cloudflare TCP bridge model, the client connects to localhost:<port>, so localhost must be in the certificate SAN, along with the gateway internal FQDN. The public Cloudflare tunnel hostnames typically do not need to be in the gateway certificate.

1. Click Next.
2. Specify the path to the previously retrieved public key from Devolutions Server or Devolutions Cloud.

This key file must be accessible to the NetworkService account under which Devolutions Gateway runs.

1. Click Next.
2. Click Install.

Launch the Cloudflared client on the Remote Desktop Manager host

The Cloudflared client needs to be downloaded and launched to properly tunnel the connection. This client will create an outbound Cloudflare tunnel connection from any local Remote Desktop Manager client to the Cloudflare tunnel connecting to Devolutions Gateway.

The following code needs to be run in a terminal window as long as the tunnel needs to be open, and each time a gateway will be accessed behind a Cloudflare tunnel. The runnable client executable is cloudflared.exe (though you may need to rename the downloaded version). Use the same local port here as the TCP Listening Port configured in Devolutions Server or Hub Business.

Here, we demonstrate this by using port 8182. If you plan on never running RDM on the same server as the Gateway service, you could use 8181, otherwise you would get a port conflict. One way to avoid it is to use a different port, as seen here.

cloudflared.exe access tcp --hostname gateway-client-tcp.mydomain.com --url localhost:8182

The client software connects to localhost:8182, not to gateway-client-tcp.mydomain.com:8181. Because the TLS client validates the gateway certificate against localhost, the gateway certificate must include localhost in its SAN. If it does not, the gateway log may show received fatal alert: CertificateUnknown.

To avoid running the code every time, create a service:

1. Launch an elevated PowerShell session.
2. Input this code to create a new PowerShell service:

   New-Service -Name "Cloudflared Egress" -BinaryPathName '"C:\Tools\cloudflared.exe" access tcp --hostname gateway-client-tcp.mydomain.com --url localhost:8182' -StartupType Automatic
   Start-Service -Name "Cloudflared Egress"

3. Start the service.

The tunnel is now running permanently on the client side.

Configure Devolutions Server

1. Log in to a Devolutions Server instance as a user with access to the Devolutions Gateway configuration.
2. Go to Administration — Devolutions Gateway.
3. Click the Add (+) button and choose Gateway.
4. Enter the previously retrieved details from Cloudflare used to configure Devolutions Gateway.

It may be needed to preface the Cloudflare tunnel domain with https://. Auto-detect will only work if the HTTPS hostname is reachable through Cloudflare.

Set the Gateway URL to the HTTPS tunnel hostname, for example, https://gateway.mydomain.com. Set the TCP Hostname to localhost, not the public TCP tunnel hostname. Set the TCP Listening Port to the same local port used by the client bridge, for example 8182.

Make sure not to use the TCP port at the end of the Gateway URL. The Gateway URL uses the Cloudflare HTTPS hostname on 443; the TCP port is configured separately as the TCP Listening Port.

1. Click Save.
2. Click the ellipsis (More) button next to the newly configured gateway and select Publish revocation list.
3. If the Publish Gateway configuration option is available, it should be done before Publish revocation list.

Configure Devolutions Cloud

1. Log in to a Devolutions Cloud instance as a user with access to the Devolutions Gateway configuration.
2. Go to Administration — Devolutions Gateway.
3. Click the Add (+) button.
4. Enter the previously retrieved details from Cloudflare used to configure Devolutions Gateway.

It may be needed to preface the Cloudflare tunnel domain with https://. Auto-Detect will only work if the HTTPS hostname is reachable through Cloudflare.

Set the Gateway URL to the HTTPS tunnel hostname, for example, https://gateway.mydomain.com. Set the TCP Hostname to localhost, not the public TCP tunnel hostname. Set the TCP Listening Port to the same local port used by the client bridge, for example 8182.

1. Go through any combination of Vaults, Groups, or Users tabs to decide how the licenses will be distributed.
2. Click Add.
3. Click the ellipsis (More) button next to the newly configured gateway and select Publish Gateway configuration.

Troubleshooting notes

• received fatal alert: CertificateUnknown In the gateway log, this usually means a TLS client rejected the gateway certificate due to a SAN/name mismatch. In this setup, that often means TCP Hostname is localhost but localhost is missing from the gateway certificate SAN.
• A red TCP listening hostname configuration diagnostic usually indicates that DVLS cannot reach raw TCP on the configured hostname. If it points at the public tunnel FQDN, change it to localhost and ensure the local cloudflared access tcp bridge is running.
• Certificate could not be verified with blank fields, followed by Cannot read properties of null (reading 'thumbprint'), usually means the gateway detect returned no certificate because the tunnel or gateway was unreachable. Fix reachability first.
• Cloudflare Error 1033 means Cloudflare cannot resolve the tunnel. Confirm the origin cloudflared daemon is running, and the tunnel status is Connected.