Why Remote Work Is Stressing Corporate Networks
The coronavirus outbreak has forced many organizations into what Fortune has called the “world’s largest work-from-home experiment.” But even before the epidemic, remote work was already on the rise. What changed is the speed of adoption: teams that planned gradual transitions are now being asked to go distributed almost overnight.
That shift puts immediate pressure on IT and security teams. Traditional remote access models—built around VPNs and physical office perimeters—were not designed for a workforce that is suddenly spread across home offices, with employees connecting from personal laptops and tablets. Cloudflare Access offers a way to make that transition faster and less disruptive, without lengthy migrations or user training sessions.
The Limits of the Castle-and-Moat Model
When everyone works in the same building, security is simple: the network is the boundary. Users sit near the servers and repositories that power their applications, and presence inside the office is treated as proof of trust. Administrators rely on network segmentation and hope that breaches don't happen, while logging is minimal.
That model breaks down for two reasons. First, applications have moved to the cloud, so they no longer live inside the corporate perimeter—they sit in centralized providers that may be hundreds or thousands of miles from users. Second, employees themselves are increasingly distributed, working from branch offices or home. To reach internal resources, organizations must open holes in their firewall so users can connect back into the private network before being routed to their destination.
The coronavirus has accelerated both trends. Remote workers are putting new strain on the VPN appliances sitting in corporate headquarters, and IT teams are being asked to manage a workplace shift that is happening far faster than planned.
Replacing the VPN with Cloudflare's Network
Cloudflare Access is one component of Cloudflare for Teams, a security platform designed to keep users, devices, and data safe without sacrificing performance. Instead of placing internal tools on a private network, teams can deploy them in any environment—hybrid or multi-cloud—and secure them consistently through Cloudflare's network.
Administrators define rules for who should be able to reach the tools protected by Access. When users need to connect, they authenticate with their team's identity provider. Access checks the login against the list of allowed users and, if permitted, lets the request proceed.
Connecting Without Opening New Ports
Deploying Access does not require exposing new holes in corporate firewalls. Resources are connected through Argo Tunnel, a secure outbound connection that runs in your infrastructure and links applications and machines to Cloudflare. Since the tunnel makes outbound-only calls, organizations can simplify their firewall rules to a single directive: disable all inbound connections. No request can reach those IPs without first hitting Cloudflare, where Access can evaluate the request for authentication.
This applies to virtual machines and internal web applications alike—whether it's Jira, iManage, or custom software. When users connect, they pass through Cloudflare first, authenticate with their team's SSO, and are instantly connected. The experience makes internally managed apps feel like SaaS products.
Every request to those protected tools is logged and attributed to a specific user, giving administrators more visibility than a traditional VPN provides.
Supporting Any Device, Any Location
The coronavirus is changing not just where employees work but which devices they use. Digitimes reports that tablet demand is growing as workers seek alternatives to office desktops. Tablets and other mobile devices complicate the VPN model: users need to install and configure profiles, and in some cases cannot connect at all.
Cloudflare Access requires no client, agent, or user-side configuration. End users can log in and reach corporate applications from any device through their browser.
Remote Access for Developers
Browser-based tools are only part of the picture. Engineers and developers often need to work over SSH or connect to remote desktops via RDP, which is far more difficult to do from home.
Access includes support for RDP connections, allowing team members to reach desktops over Cloudflare's global network. This reduces the latency typical of VPN-based RDP clients, while still enforcing SSO authentication through the team's identity provider. Organizations don't have to deploy new credentials or leave remote desktops exposed to the Internet.
For developers, Access also supports native SSH workflows. Engineers can connect to code repositories and build systems over SSH from low-end devices, reaching powerful servers hosted in cloud environments. The SSH feature can replace static SSH keys stored on user devices with short-lived certificates generated at login time. If employees are using personal devices, organizations can prevent those devices from ever storing long-lived keys that could access production systems.
Infrastructure software company Replicated uses Cloudflare Access to support its distributed development team. Previously, each developer received a MacBook Pro and ran the full development stack locally—a setup that consumed hours every week for setup and troubleshooting. Now, the team connects to Google Cloud Platform infrastructure through Access and Argo Tunnel, with SSH traffic proxied over Argo. Developers can work from coffee shops or home offices without running code on their local machines.
Visibility Without Code Changes
When employees work remotely, security teams lose a layer of physical defense—there's no badge-in at a front desk. Cloudflare Access compensates by logging every authentication event and, if enabled, every user request made to a protected resource. Administrators can capture each request and attribute it to a user and IP address without any code changes. That helps teams meet compliance and regulatory requirements for distributed workforces.
Simplifying Onboarding
Changing how users access applications often requires training, and discoverability becomes a problem when users can't find the tools they need. Cloudflare Access includes an application launchpad that administrators can enable with minimal configuration. Instead of sending custom emails or lists of links to new contractors, teams can provide a single URL.
When external users log in with LinkedIn, GitHub, or any other supported provider, the Access App Launch displays only the applications they are permitted to reach. Employees, contractors, and partners can quickly find and launch the tools they need without losing a step.
Getting Started
Cloudflare for Teams is available at teams.cloudflare.com. Cloudflare Access works with any Cloudflare plan, and the first five seats are free. A getting started guide is also available for teams that want to deploy Access quickly.
