Skip to content

Cloudflare tunnel

Warning

This is unofficial instructions proposed by the community. We don't officially support this and don't know what problems may arise when using cloudflared.

Cloudflare Tunnels can be used to access PiKVM over the internet securely using Cloudflare Zero Trust with Cloudflared. This is a convenient and free (for 50 users) tool for allowing access to web services running on your internal network without port forwarding or IPv4/IPv6 compatibility issues. This document is provided as an example for accessing your PiKVM over the internet but you can also use Zerotier/Tailscale/Insert XYZ VPN service here. Basic support like whats shown below is provided as an example, any other setting or functionality needs to be redirected to the appropriate community.

If you get error 1033 / lookup localhost error

You might need to add 127.0.0.1 localhost into your /etc/hosts file

Prerequisites

  1. A domain utilizing Cloudflare for DNS

  2. A Cloudflare tunnel configured with an application created and secured by an access policy

  3. Custom firewall rules configured in Cloudflare as needed

Cloudflare Tunnel Steps

  1. Login to Cloudflare and provision a tunnel using the steps here. Save the tunnel token as we will need this later. In most cases the target will be https://localhost

  2. Create a self-hosted application with the URL matching one created in the previous step by following the steps here.

  3. You will need to check the http options to disable SSL certificate verification under Tunnels -> Configure -> Public Hostname -> yourapplication.yourdomain -> Edit -> TLS Settings -> No TLS Verify as the PiKVM uses self-signed certificates.

  4. Don't skip the access policies as this important to preventing randoms from the internet from gaining access to your PiKVM. Cloudflare offers a variety of login options with the simplest being One-time PINs that are emailed to you. NOTE: This external authentication will not replace the username/password for the PiKVM but instead supplement it acting as a first line of defense from the internet.

Installation

  1. Use these commands to install Cloudflared:

    [root@pikvm ~]# rw
[root@pikvm ~]# pacman -Syy
[root@pikvm ~]# pacman -S cloudflared
[root@pikvm ~]# cloudflared version

  2. Edit /etc/systemd/resolved.conf, uncomment DNS line and set DNS=1.1.1.1 1.0.0.1.

  3. Restart systemd-resolved:

    [root@pikvm ~]# systemctl restart systemd-resolved

  4. Install the Cloudflare tunnel service to Cloudflared.

    [root@pikvm ~]# sudo cloudflared service install SERVICE_TOKEN_HERE

  5. Ensure cloudflared service is enabled so it starts on boot.

    [root@pikvm ~]# sudo systemctl enable cloudflared

  6. Open a web browser and attempt to connect to your tunnel.

  7. Reboot pikvm with reboot command and ensure your tunnel comes back up. This may take a few minutes.

Updating Cloudflared

Use a general way to update the system packages:

Updating PiKVM OS

Tip

We recommend updating PiKVM OS only if you have physical access to the device, or in the most extreme cases. The update process is very reliable, but there is always a small chance that something may go wrong so reflashing will be required. PiKVM cannot be bricked, but you need physical access to the memory card for this operation.

To update, run following commands under the root user:

[root@pikvm ~]# pikvm-update

If you encounter an error like:

[root@pikvm ~]# pikvm-update
bash: pikvm-update: command not found

It's most likely you have an old OS release. You can update the OS as follows:

[root@pikvm ~]# rw
[root@pikvm ~]# pacman -Syy
[root@pikvm ~]# pacman -S pikvm-os-updater
[root@pikvm ~]# pikvm-update

Next time you will be able to use the usual method with pikvm-update.