Secure Remote Access with Cloudflare Tunnel
Connect PocketNOC to your SolarWinds Orion server from anywhere, without opening inbound firewall ports or exposing your server to the internet.
~15 minutes to set upOverview
Cloudflare Tunnel creates an outbound-only encrypted tunnel from your network to Cloudflare's edge, letting you access your Orion server from anywhere without opening inbound firewall ports or exposing it to the internet.
How it works: A small service (cloudflared) runs on your network and connects outbound to Cloudflare. PocketNOC connects to Cloudflare, which routes traffic through the tunnel to your Orion server. No inbound ports need to be opened on your firewall.
Prerequisites
- A Cloudflare account (free tier is sufficient)
- A machine on the same network as your Orion server (can be the Orion server itself, or any Windows/Linux host that can reach it)
- Your Orion server's internal hostname or IP and SWIS port (default:
17778) - A domain name managed in Cloudflare DNS (you can add one for free, or use a subdomain of an existing domain)
Setup Guide
Create a Cloudflare Tunnel
- Log in to the Cloudflare dashboard
- Go to Networking → Tunnels
- Click Create a tunnel
- Give your tunnel a name (e.g.,
orion-pocketnoc) - Click Create Tunnel
Cloudflare renames dashboard menus from time to time. If a menu name here doesn't match what you see, use the search bar at the top of the dashboard.
Install the connector on your network
After creating the tunnel, Cloudflare will show installation instructions for your platform. Choose the one that matches the machine you'll run the connector on.
Windows (most common for SolarWinds environments)
Cloudflare provides a single command to download and install cloudflared as a Windows service. Copy the command from the dashboard and run it in an elevated PowerShell prompt. It will:
- Download the
cloudflaredbinary - Install it as a Windows service (starts automatically on boot)
- Register the connector with your tunnel
Tip: You can run this on your Orion server itself, or on any machine that can reach your Orion server over the network.
Linux / Docker
If you prefer to run the connector on a Linux host or in Docker, the dashboard provides commands for those environments as well.
Publish your Orion server through the tunnel
Once the connector is running and shows as Healthy in the dashboard:
- Open your tunnel and go to the Routes tab
- Click Add route, then choose Published application
- Enter a Subdomain (e.g.,
orion) and select your Domain - For Service URL, enter
https://your-orion-server:17778(use the internal hostname or IP) - In the route's TLS settings, turn on Disable TLS certificate verification (older dashboards call this No TLS Verify). This lets the connector accept your Orion server's self-signed certificate.
- Save the route
Important: Disabling certificate verification only applies to the connection between the cloudflared connector and your Orion server on your internal network. The connection from PocketNOC to Cloudflare is always encrypted with a valid certificate.
Add access controls (recommended)
By default, anyone on the internet can reach the tunnel hostname. Restrict it with Cloudflare Access. PocketNOC signs in with a service token, not a browser login, so do these three parts in this order.
A. Create the service token first
- In the Cloudflare dashboard, go to Zero Trust → Access controls → Service credentials → Service Tokens
- Click Create Service Token
- Name it (e.g.,
pocketnoc) and choose a Service Token Duration - Click Generate token
- Copy the Client ID and Client Secret somewhere safe. You'll enter both in PocketNOC.
The Client Secret is shown only once. If you lose it, you have to generate a new token. Note the expiry date too: when the token expires, PocketNOC gets a 403 until you refresh it.
B. Create the Access application
- Go to Zero Trust → Access controls → Applications
- Click Add an application and choose Self-hosted
- Give it a name and add your tunnel hostname as the application domain (e.g.,
orion.yourdomain.com)
C. Add a Service Auth policy
- In the application's Policies section, create a new policy
- Set Action to Service Auth. Do not use Allow: Allow sends a browser login page that PocketNOC can't complete.
- Add an Include rule with Selector set to Service Token and Value set to the token you created in part A
- Save the policy, make sure it's attached to the application, then save the application
| Action | Rule type | Selector | Value |
|---|---|---|---|
| Service Auth | Include | Service Token | pocketnoc |
Free tier: Cloudflare Access is free for up to 50 users. Service tokens do not count toward user limits.
Configure PocketNOC
Open PocketNOC on your device. On the Sign In screen, enter your connection details:
Enter your Cloudflare Tunnel hostname as the Server URL. Use your normal SolarWinds Orion credentials.
If you set up Cloudflare Access (Step 4), tap Advanced Options and add your service token headers:
CF-Access-Client-Secret: def456...
Enter one header per line. These are the service token values you saved when creating the Cloudflare Access application.
Tap Sign In. PocketNOC will reach your Orion server securely through the tunnel.
Firewall Requirements
One of the main benefits of Cloudflare Tunnel is that no inbound firewall rules are required. The cloudflared connector only makes outbound connections.
Outbound (from the machine running cloudflared)
| Port | Destination | Purpose |
|---|---|---|
443/tcp | Cloudflare edge | Tunnel connection (QUIC/HTTP2) |
7844/udp | Cloudflare edge | Tunnel connection (QUIC, preferred) |
Internal (from cloudflared to Orion)
| Port | Destination | Purpose |
|---|---|---|
17778/tcp | Orion server (LAN) | SWIS API |
No changes needed on your Orion server's firewall. If the machine running cloudflared can already reach your Orion web console on the internal network, the tunnel will work.
SolarWinds Account Recommendations
PocketNOC works with both local Orion accounts and Active Directory accounts. When using an AD account, you must log in with the down-level format:
- Use
DOMAIN\username(e.g.,CORP\jsmith) - Do not use the UPN format (
user@domain.com) — this may result in limited data visibility or denied API permissions
Troubleshooting
Tunnel shows "Inactive" or "Down" in the dashboard
Verify the cloudflared service is running. On Windows, check Services (services.msc) for "Cloudflared agent". Restart the service if needed.
PocketNOC shows "Connection refused" or timeout
- Verify the published application route's Service URL points to the correct Orion server and port (
https://your-orion-server:17778) - Confirm the machine running
cloudflaredcan reach your Orion server: openhttps://your-orion-server:17778/SolarWinds/InformationService/v3/Json/Metadatain a browser on that machine - Ensure Disable TLS certificate verification (No TLS Verify) is turned on for the route, so the connector accepts the Orion self-signed certificate
PocketNOC shows "403 Forbidden"
- Make sure the CF-Access-Client-Id and CF-Access-Client-Secret headers are entered correctly in PocketNOC's Advanced Options. The values are case-sensitive.
- Check that the service token hasn't expired (Access controls → Service credentials → Service Tokens)
- Check that the policy's Include rule selects this exact service token
PocketNOC shows a login page or says the server returned HTML
The Access policy action is almost always set to Allow instead of Service Auth. Allow policies send a browser login page, which PocketNOC can't complete. Change the action to Service Auth (step 4, part C).
Alerts or nodes are missing
This is usually an account permissions issue, not a tunnel issue. Try switching to the DOMAIN\username login format or use a local Orion account. See the account recommendations above.
Security Considerations
- No inbound ports: Your Orion server is never directly exposed to the internet
- End-to-end encryption: Traffic is encrypted from PocketNOC to Cloudflare (TLS) and from Cloudflare to your Orion server (through the tunnel)
- Cloudflare as intermediary: Cloudflare terminates TLS at their edge. They can technically inspect traffic in transit. For most organizations this is acceptable. If your security policy prohibits third-party traffic inspection, consider connecting directly to your Orion server over VPN instead
- Access controls: Cloudflare Access service tokens add a strong second layer of authentication on top of your Orion credentials
- No credentials stored by PocketNOC: The tunnel is entirely managed within your Cloudflare account. PocketNOC does not have access to your tunnel configuration or Cloudflare account
Further Reading
- Cloudflare Tunnel — Getting Started
- Create a tunnel via the dashboard
- Publish a self-hosted application
Need help? Contact us and we'll walk you through the setup.