Zero Trust Access (VPN Replacement)

What is the challenge?

Why is a flat-network VPN a security and productivity problem?

Traditional VPNs put every authenticated user on the corporate network, granting broad access far beyond what any one role actually needs. One compromised credential or stolen laptop becomes a lateral-movement event. On top of that, VPN concentrators become single points of failure and add real latency for remote employees, contractors, and partners — all while creating friction every time someone needs to reach an internal app.

Architecture

How it fits together

Cloudflare Tunnel architecture: outbound-only cloudflared connectors expose private apps without open inbound ports, with Access enforcing identity- and posture-checked, per-application authorization for remote users, WARP clients, and clientless browser access. — Cloudflare Tunnel: outbound-only connectors, per-application Access policies, and explicit allow/deny — no inbound ports, no implicit network trust.

Cloudflare Mesh architecture: any-to-any bidirectional connectivity between sites and services over private Mesh IP addresses, including a service-initiated connection and a CIDR route advertised via a mesh node. — Cloudflare Mesh: any-to-any bidirectional connectivity between sites and services over private Mesh IPs — useful when traffic must originate from either side.

Cloudflare WAN architecture: branch offices connect via a Cloudflare One Appliance or an existing router/firewall, with any-to-any backbone routing to data centers, cloud VPCs, and remote users. — Cloudflare WAN: branches connect via a Cloudflare One Appliance or your existing router/firewall, with any-to-any routing across Cloudflare's backbone.

Cloudflare Network Interconnect architecture: a private cross-connect (Direct, Partner, or Cloud CNI) with BGP peering that feeds into the Cloudflare WAN backbone. — Cloudflare Network Interconnect (CNI): a private cross-connect — Direct, Partner, or Cloud CNI — with BGP peering into Cloudflare's backbone.

Cloudflare's Solution

How Cloudflare solves it

Per-application access, not network access. Cloudflare Access publishes individual apps (web, SSH, RDP, internal APIs) behind identity and policy. Users reach only what they're explicitly allowed to reach — no implicit trust of the network they're on.
Any identity provider, any device. Federates with Okta, Microsoft Entra ID, Google, Auth0, GitHub, SAML, OIDC, and more. Layer on device posture signals (managed device, OS version, disk encryption) and require WARP enrollment when needed.
Connects to anything, anywhere. Cloudflare Tunnel exposes apps from your data center, VPC, or even a developer laptop without opening inbound ports. Public IPs disappear from your origin.
Faster than a VPN. Traffic terminates at the nearest Cloudflare location (300+ cities) and reaches the app over Cloudflare's backbone. No backhauling through a regional VPN concentrator.
Audit everything. Every authentication event, policy decision, and session is logged and exportable to your SIEM. Replace 'who was on the VPN' with 'who touched which app and when.'

FAQ

Common questions

Do I have to rip out my existing VPN on day one?

No. The typical migration runs Access alongside the legacy VPN, app by app. Start with one or two high-value internal apps, prove the workflow, then expand. Most customers retire their VPN over 3–6 months.

What about non-HTTP apps like SSH, RDP, or databases?

Cloudflare Tunnel and Access for Infrastructure handle TCP and UDP traffic. Users can connect via the WARP client or, for SSH/RDP, through a browser-rendered terminal that requires no native client.

Does this work for contractors and partners who aren't in our IdP?

Yes. You can add one-time PIN (email OTP) as an identity source for guest users, or federate with their IdP. Access policies can require additional signals (country, device posture, MFA) on top.

How is this different from a typical IdP + SSO setup?

SSO authenticates the user once into individual apps. Zero Trust Access sits in front of every app and enforces continuous policy on every request — identity, device, location, time of day, and more — and protects apps that don't natively support SSO.

Let's Test!

Try it live

Demo coming soon

An interactive demo for Zero Trust Access (VPN Replacement) is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.