Case study · Education / Technology · Bengaluru, India
A fast-growing EdTech in Bengaluru had origin servers and admin panels visible to the whole internet. ITSECOPS moved everything behind Cloudflare Tunnels and Zero Trust access policies — no inbound ports, no exposed origin IPs, and the VPN retired.
The client
An online learning platform in Bengaluru scaling quickly on cloud infrastructure, with security engineering lagging behind product growth.
The challenge
Origin IPs were discoverable, admin interfaces reachable from anywhere, and a shared VPN had become both a bottleneck and a single point of compromise.
What we did
- Deployed Cloudflare Tunnels so origin servers accept no inbound connections at all — traffic egresses outward to Cloudflare only.
- Replaced the VPN with Cloudflare Access (ZTNA): per-app policies tied to identity, device posture and location.
- Hardened the edge: WAF managed rules, rate limiting on auth endpoints, bot mitigation on exam and enrollment flows.
- Locked DNS — DNSSEC, CAA records and removal of stale records that leaked infrastructure history.
- Enforced TLS end-to-end with authenticated origin pulls.
Results
- Zero inbound firewall ports; origin IPs no longer discoverable.
- VPN decommissioned — access is now per-application and logged.
- Credential-stuffing noise on login endpoints dropped to negligible after rate limiting.
FAQ
What is a Cloudflare Tunnel?
An outbound-only connector that publishes internal services through Cloudflare without opening firewall ports — attackers cannot reach what has no inbound path.
Can Cloudflare Access really replace a VPN?
For web apps, SSH and RDP: yes, and with finer-grained control. Full-network tunnels remain for the rare legacy protocol.
How long does Zero Trust hardening take?
Typical SMB scope: 2–4 weeks from audit to VPN retirement, sequenced app by app so nobody loses access mid-migration.