Article
Building a Better Cloudflare Gateway Block Page
How I used a Cloudflare Worker to enrich Gateway blocks with policy, device, user, category and Cloudflare One Client context while keeping the page resilient and secure.
Topic
Zero Trust
28 matching entries across Articles, TIL and Projects.
Articles
Long-form writing tagged Zero Trust.
Article
A Multi-Cloud Zero Trust Lab, Built in Terraform
How I built a repeatable AWS, Azure and Google Cloud lab to explore Cloudflare Access, Gateway, WARP routing, device posture and external evaluation as one integrated Zero Trust system.
Article
Cloudflare DNS Ad Blocking with Terraform
I used Terraform to fetch public domain feeds, turn them into Cloudflare Zero Trust lists and enforce them with a Gateway DNS policy that remains reviewable as code.
Article
Gating Cloudflare Access on Training Completion
Authentication proves identity, but it does not prove a user has met a business requirement. I used Cloudflare Access External Evaluation, Workers and D1 to add training compliance to the access decision.
Article
Making Cloudflare Access Denials Actually Useful
A custom Cloudflare Access denial page can turn a generic block into useful identity, device, posture and network diagnostics without exposing sensitive control-plane details.
Article
Zero Trust Allow Lists with Workers KV
A small Cloudflare Worker can provide a controlled front end for Gateway allow-list changes while KV supplies recovery, synchronization and operational visibility.
Article
Managing Device Posture as Code
How to model, validate and deploy Cloudflare device posture checks as reusable configuration without coupling policy intent to environment-specific object IDs.
Article
Lessons from Replacing a Legacy VPN with ZTNA
Practical lessons from an enterprise ZTNA deployment: foundations, staged migration, policy automation, legacy applications, change management, and measurement.
Article
Browser vs Network-Centric Zero Trust
Enterprise browsers move enforcement into the user session. Network-centric Zero Trust still owns critical controls such as DNS, routing and non-browser traffic. The interesting architecture is often the combination.
Article
Designing Zero Trust for Failure
Zero Trust is not resilient just because it is cloud-hosted. Identity, posture, policy, tunnels, DNS and SaaS authentication all create failure domains that need deliberate recovery paths.
Article
Dynamic Cloudflare Lists from Provider IPs
A practical pattern for consuming AWS/Azure network feeds, calculating desired state and safely synchronising Cloudflare Zero Trust lists with PowerShell.
Article
Cloudflare WARP Configuration as Code
When private sites and DNS exceptions multiply, WARP device-profile configuration becomes data. Source control can become the input and PowerShell the generator.
Article
Safe Cloudflare Zero Trust Pipelines
As Zero Trust policy grows, the engineering problem shifts from configuring a dashboard to safely compiling, validating and deploying policy across environments.
Article
Why IP-Based Egress Steering Does Not Scale
Static IP and subnet rules become fragile when SaaS platforms and CDNs move underneath you. Domain-aware egress policy aligns network controls with application intent.
Today I Learned
Short notes and fixes tagged Zero Trust.
Today I learned
Cloudflare Access Checks Must Fail Closed
For a training-compliance Access evaluator, I treat missing users, invalid requests and database errors as deny conditions instead of accidental allows.
Today I learned
Resolve Gateway Rule IDs Before Showing Them
Cloudflare Gateway can provide a rule ID to a custom block page, but resolving that UUID to the rule name makes support diagnostics much more useful.
Today I learned
Device Registrations Assign Virtual IPs
When a Zero Trust diagnostic page needs the virtual IPv4/IPv6 assigned to a device, the active device registration is the useful object to query.
Today I learned
Gateway Block Pages Need Policy Context
A CF-Ray header alone does not prove a request came from Gateway, so my Worker requires Gateway-specific query context before rendering diagnostic output.
Today I learned
Derive WARP Routes from Infrastructure
When Terraform already knows the cloud subnets, those values can become inputs to WARP routing instead of being copied into a second manually maintained list.
Today I learned
Workers KV Is Backup, Not Source of Truth
In my Gateway allow-list Worker, Cloudflare lists remain the enforcement state while Workers KV stores backup and synchronization metadata.
Today I learned
DNS Names vs IPs for Egress Policy
Cloud and SaaS services move between addresses. Policy often expresses intent more accurately when it follows the application hostname.
Today I learned
Zero Trust: Find the Failed Control Plane
Before creating an emergency bypass, work out whether the failure is identity, posture, policy, DNS, tunnel or origin.
Projects
Projects and implementation patterns tagged Zero Trust.
ProjectActive
Cloudflare Access Denied Information Page
A Cloudflare Worker that turns an Access denial into a support-friendly diagnostic page with identity, device, posture, WARP, network and recent-access context.
ProjectActive
Cloudflare Allowed Domain Handler
A Cloudflare Worker that provides a narrow, Access-protected workflow for validated Gateway allow-list changes with DNS/HTTP targeting and Workers KV backup.
ProjectActive
Cloudflare Gateway Ad Blocking with Terraform
A Terraform project that consumes remote domain feeds, normalizes them into Cloudflare Zero Trust lists and builds a Gateway DNS blocking policy from the generated data.
ProjectActive
Cloudflare Gateway Custom Block Page
A Cloudflare Worker that enriches Gateway blocks with rule names, request category, user, device, Cloudflare One Client addresses and support correlation data.
ProjectActive
Cloudflare Multi-Cloud Zero Trust Demo
A Terraform-managed Zero Trust engineering lab spanning AWS, Azure and Google Cloud with Cloudflare Access, Gateway, WARP routing, device posture and optional Worker integrations.
ProjectActive
Cloudflare Training Compliance Gateway
An Access External Evaluation Worker that uses D1-backed training state to require mandatory training completion before protected applications can be opened.