Zero Trust networking for small teams: a practical setup guide
Cloudflare One is designed for large enterprises, but the same core technology is available to small businesses. The Cloudflare for Teams free plan provides DNS filtering, Zero Trust access, and a management dashboard for up to 50 users at no cost. For a small network administrator, the essentials break down into securing devices, applications, and the network itself. Here is a practical path to deploying Cloudflare One in your organization today.
Step 1: Block malicious sites with DNS filtering
Every web request starts with a DNS query. Two problems arise at that point: queries are often unencrypted, allowing ISPs to spy on them or attackers to tamper with responses, and queries can resolve to known malicious hostnames. DNS-level filtering addresses the latter by preventing devices from reaching phishing and malware sites in the first place.
To get started, sign up for a Cloudflare account and open the Cloudflare for Teams dashboard. Create a location for your office network and change your router's DNS settings to point to the assigned Gateway IP address. Gateway's filtering is built on the same architecture as Cloudflare's 1.1.1.1 resolver, so you get the benefit of fast DNS alongside security.
From there, create a Gateway DNS policy to block security threats and content categories. Use the dashboard to monitor which queries are allowed and which are blocked.
The Overview tab in the dashboard shows traffic details, including what is being allowed and blocked.
Step 2: Secure remote workers with encrypted traffic routing
Remote employees no longer connect through the office network; they work from home networks and mobile hotspots that may not be private. Cloudflare One can route all of their traffic through an encrypted, accelerated path using Cloudflare WARP. The client is available for macOS, Windows, iOS, and Android, and it uses Cloudflare's WireGuard implementation to connect to the nearest Cloudflare data center.
WARP+, which leverages Argo Smart Routing, finds the shortest path across Cloudflare's global network to reach the destination. To enable this for your team, purchase a Cloudflare Gateway or Cloudflare for Teams Standard plan and create a rule in the dashboard to determine who can use WARP.
End users can install the client, enter your organization's name, and log in to start using WARP+. Alternatively, you can preconfigure and deploy the application using a device management solution like JAMF or InTune. WARP integrates with Gateway's DNS filtering so roaming devices get the same encrypted DNS resolution and policies as office devices.
Step 3: Replace your VPN with Cloudflare Access
VPNs are a common source of support tickets and frustration for small teams. Cloudflare Access replaces the VPN as the gatekeeper to your applications, following a Zero Trust model where no connection is trusted by default. Each user must authenticate against rules you configure in the Cloudflare for Teams dashboard.
Access integrates with your existing identity provider and SSO options. If you do not have a corporate identity provider, you can use free services like GitHub and LinkedIn for authentication. The Cloudflare for Teams free plan includes up to 50 seats of Access.
For hosted applications, you can connect your origin to Cloudflare's network without opening firewall ports by using Argo Tunnel. Cloudflare's private backbone accelerates traffic from your origin to users.
Team members can visit applications directly or use a custom app launcher. They log in with your identity provider, and Access checks their identity and other attributes, such as country of login, against your rules.
Step 4: Add HTTP filtering with a Secure Web Gateway
With WARP routing all device traffic through Cloudflare, you can add Gateway's HTTP filtering to inspect for threats and prevent data loss. For example, if your team uses Box, you can restrict file uploads to other cloud storage services to enforce a single approved destination.
In the Policies section of the dashboard, use the HTTP tab to build rules that inspect traffic for known malicious URLs and unapproved file uploads. To enable inspection, you need to download and install a certificate on enrolled devices. Once installed, you can enforce the policies and start capturing event logs.
Step 5: Extend Zero Trust to SaaS applications
If your team relies on SaaS applications rather than self-hosted ones, Cloudflare Access for SaaS brings the same Zero Trust rules to those tools. Cloudflare Access can act as an identity provider for any application that supports SAML SSO. Login attempts are routed through Cloudflare's network to enforce your configured rules.
Access for SaaS supports running multiple identity providers simultaneously. Users can pick the provider they need, or you can direct them to a single provider for a given application. This feature is also included in the Cloudflare for Teams free plan for up to 50 users.
What's next for small office networks
Cloudflare's Magic Transit product protects large enterprises from IP-layer attacks. According to Cloudflare, plans are underway to extend this same protection to teams operating smaller networks in upcoming releases. In the meantime, the steps above provide a path to move your small business to a Zero Trust model without requiring a large IT department or enterprise budget.
