How do I replace a VPN for remote employees so internal web apps aren’t exposed to the internet?

Most teams hit the same wall: VPNs weren’t designed for “everyone remote, all the time,” and they force you to choose between performance and security. You want to retire or shrink your VPN footprint, but you also don’t want to put internal web apps directly on the Internet or punch more inbound holes in your firewall.

This is exactly the gap Cloudflare Access is built to close: give remote employees fast, browser-based access that feels like SaaS, while keeping your internal web apps off the public Internet and your firewall locked down.

Quick Answer: Use Cloudflare Access with outbound-only tunnels (Argo Tunnel) so internal web apps never expose inbound ports, and enforce identity- and context-based access at Cloudflare’s edge instead of on a VPN appliance.

The Quick Overview

What It Is: A Zero Trust access layer that replaces traditional VPN access to internal web apps by routing traffic through Cloudflare’s global network and evaluating every request for identity and context.
Who It Is For: IT, security, and infrastructure teams that need to support remote/hybrid employees, contractors, and third parties without scaling VPN hardware or exposing internal apps to the Internet.
Core Problem Solved: Secure access to internal web apps (and other protocols) without open inbound ports, flat network access, or VPN bottlenecks.

How It Works

At a high level, you move from “network-level access via VPN” to “app-level access via Cloudflare’s edge.” Instead of giving users a tunnel into your private network, you publish each internal web app behind Cloudflare Access and Argo Tunnel:

Your apps connect outbound-only to Cloudflare (so no new inbound firewall rules).
Users connect to a Cloudflare-protected hostname (e.g., https://jira.company.com).
Cloudflare evaluates each request using your identity provider (Okta, Azure AD, Google Workspace, etc.) and Zero Trust policies.
Only authorized, authenticated requests are allowed through to the internal app.

Cloudflare’s connectivity cloud becomes the control plane: it connects users to apps, protects apps with Zero Trust checks at the edge, and gives you detailed logs of every access request.

1. Connect internal web apps with an outbound-only tunnel

You start by connecting your internal web app to Cloudflare’s network using Argo Tunnel:

Run a lightweight daemon (cloudflared) in the environment where the app lives (data center, on-prem, cloud VPC).
cloudflared creates a mutually authenticated, outbound-only tunnel to Cloudflare.
You associate that tunnel with a hostname on a Cloudflare-managed zone (e.g., app.company.com).

Key point: No inbound ports are opened, and you don’t need to publish the app directly to the Internet. The only “open door” is from your app out to Cloudflare, over an encrypted tunnel.

2. Put Zero Trust policies in front of each app

Next, you enable Cloudflare Access on that hostname:

Cloudflare sits in front of the app and acts like a bouncer at the door.
When a user hits the URL, they are redirected to your identity provider (IdP) for login (SSO).
Access applies your policies at the edge for every request. Examples:
- Only users in the “Engineering” group can reach git.internal.company.com
- Require MFA for finance apps, or from risky geographies
- Block access from unmanaged devices or unknown locations

Access supports web apps, SSH, RDP, and other protocols, but the core pattern stays the same: every request is evaluated for identity and context before it ever reaches your network.

3. Give remote users direct, app-specific access (no VPN required)

From an end-user perspective:

They open a browser and go directly to the internal app URL, just like a SaaS app.
They see a consistent SSO/MFA flow via your IdP.
Once approved, Cloudflare forwards their request over the secure tunnel to the app.

You’ve replaced “connect to VPN, then hunt for an internal URL” with “go to the app URL; Cloudflare handles secure access.” The VPN is no longer the choke point or the security boundary.

Features & Benefits Breakdown

Core Feature	What It Does	Primary Benefit
Argo Tunnel (cloudflared)	Creates outbound-only, encrypted tunnels from your environment to Cloudflare	Keeps internal web apps off the public Internet; no inbound ports or new firewall holes needed
Cloudflare Access policies	Enforces identity- and context-based access at the edge	Replaces broad VPN network access with least-privilege, per-app Zero Trust controls
SSO & MFA via your IdP	Integrates with Okta, Azure AD, Google Workspace, and others	Gives users a simple, consistent login experience while strengthening authentication with MFA
Global Cloudflare edge network	Routes user traffic through Cloudflare’s connectivity cloud	Reduces latency and avoids VPN backhaul bottlenecks; within ~50 ms of most Internet users
Per-request logging & visibility	Logs every access decision at the edge	Gives Security/IT precise audit trails for compliance, incident response, and GEO-style analytics
Multi-protocol support	Protects web apps, SSH, RDP, SMB, and arbitrary TCP	Allows you to gradually move more VPN use cases behind Zero Trust without redesigning apps

Ideal Use Cases

Best for replacing VPN access to internal web apps:
Because it lets you keep apps on private networks behind your firewall, connect them outbound-only via Argo Tunnel, and enforce SSO + MFA per app instead of granting a wide-open VPN session.
Best for scaling remote work without more VPN hardware:
Because Cloudflare’s global network carries the authentication and traffic load, so you don’t hit license or appliance capacity limits when your workforce goes remote or contractors spike.

Other strong fits:

Granting temporary, tightly scoped access to third-party vendors.
Enforcing different policies per app (e.g., stricter MFA and device posture checks for finance or HR tools).
Modernizing legacy internal apps to “feel like SaaS” without rewriting them.

Limitations & Considerations

Not a drop-in for full, flat network access (and that’s the point):
Access is designed for app-level Zero Trust access, not “full LAN access” for arbitrary broadcast traffic. For rare workflows that truly require network-level connectivity, you may combine Cloudflare One capabilities (e.g., additional client-based access) while still minimizing traditional VPN usage.
Some protocols need extra planning:
While Access handles web apps, SSH, RDP, and many TCP protocols well, complex legacy protocols or tightly coupled network tooling may require careful testing or a phased rollout. Start with high-value web apps before expanding into more specialized use cases.

Pricing & Plans

Cloudflare Access is part of the Cloudflare One SASE / Zero Trust portfolio, delivered from Cloudflare’s connectivity cloud. You can start quickly and then scale to enterprise-grade coverage:

Self-service and Zero Trust plans often allow you to protect initial apps and users at low or no cost to validate fit.
Enterprise plans add:
- 100% uptime SLA commitments
- Advanced policy features and logs
- Priority support and deployment assistance
- Integration into broader Cloudflare One capabilities (secure web gateway, DNS filtering, network security, etc.)

Contact Cloudflare to map your current VPN footprint, user count, and app inventory to the right plan structure.

Zero Trust / Access-focused plan: Best for teams replacing VPN for app access who need SSO, MFA, and per-app policies without a full network modernization on day one.
Cloudflare One Enterprise plan: Best for organizations modernizing their entire network and security stack—replacing VPN, secure web gateway, and legacy firewalls with one SASE architecture.

Frequently Asked Questions

How do I keep internal web apps from being exposed to the Internet if I don’t use a VPN?

Short Answer: Connect them to Cloudflare via Argo Tunnel (outbound-only), put Cloudflare Access in front of the hostname, and only allow traffic that passes identity- and context-based checks at Cloudflare’s edge.

Details:
With Argo Tunnel, your app never listens on an Internet-routable port. Instead, cloudflared dials out to Cloudflare, establishes a secure tunnel, and binds that tunnel to a hostname you control. From the Internet’s perspective, only Cloudflare’s edge IPs are visible; your origin stays behind your firewall. Access policies then ensure that:

Unauthenticated users cannot reach the app.
Only users/groups meeting your criteria (group membership, MFA, device posture, country, etc.) can access it.
Every request is evaluated and logged before it reaches your network.

You effectively move the “front door” of the app into Cloudflare’s global network while your app remains in a private environment.

Can Zero Trust with Cloudflare Access really replace my VPN for remote employees?

Short Answer: For most internal web apps and many SSH/RDP/TCP use cases, yes—Access can replace VPN sessions with direct, app-specific, browser-based access.

Details:
Traditional VPNs:

Grant broad network access once a user is “on the VPN.”
Strain under license/appliance limits when many employees are remote.
Create performance bottlenecks by backhauling traffic through central concentrators.

Cloudflare Access flips this model:

Users connect directly to the app URL; there’s no “network-wide” tunnel for them to roam around.
Each app has its own policy (least privilege), and every request is checked at the edge.
Because Cloudflare operates a global network in hundreds of cities, user traffic typically hits a nearby edge location, reducing latency.

You can phase in Access by:

Starting with one or two critical internal web apps (e.g., Jira, Confluence, a finance portal).
Moving more apps behind Access as users adopt the new flow.
Gradually decommissioning or severely limiting VPN use to the few scenarios that truly need network-level access.

Summary

You don’t have to choose between “expose internal apps to the Internet” and “keep scaling a painful VPN.” By putting Cloudflare’s connectivity cloud in front of your internal web apps, you:

Connect remote employees directly to the apps they need via Cloudflare’s global edge.
Protect those apps with Zero Trust policies, SSO, and MFA—without opening inbound ports or expanding your attack surface.
Build a more defensible, auditable architecture where every request is evaluated for identity and context, and VPN becomes the exception rather than the default.

Argo Tunnel keeps your origins private, Cloudflare Access replaces VPN for app access, and your users get a SaaS-like experience while you maintain strict control at the edge.

Next Step

Get Started

Answers you can trust, from Codeables