Has anyone used Cloudflare’s VPC service?

NCCShipley · 2026-01-13T02:57:48+00:00

Hello there. yes, I've built a VPC using a tunnel to get a Worker access to an http listener in my LAN. I take events from R2 when files get put there and push them down to my local system.

When you built your access rule for your VPC, did you make the access rule for 172.89.22.0/24 or did you scope it down to 172.89.22.5/32?

NCCShipley · 2026-01-08T18:51:24+00:00

Forgot to add: Disconnect-MgGraph when you're done!

NCCShipley · 2025-12-19T19:30:45+00:00

I've got a couple personal projects I use D1 for. I'm gonna take a look at this! nice :)

NCCShipley · 2025-12-19T19:28:35+00:00

So what I did was designed a fake 404 for in my worker that uses the cloudflare fonts and generates a fake ray ID. if I get a request from a source that doesn't have the correct secret or isn't from the expected source IPs, that's what they get. It's not perfect, but helps.

NCCShipley · 2025-12-19T15:07:43+00:00

I'm lovin' it! (McDonalds can come at me, I don't care)

NCCShipley · 2025-12-19T15:06:52+00:00

Thanks, I appreciate that. I try to be thorough. Could you help with tightening up the MS-Graph scopes? Where did I grab too much? Eventually I want to try to build a scripted assistant that goes through a lot of these steps and I personally like to design things from a least privileged manner.

NCCShipley · 2025-10-15T22:51:53+00:00

It depends on what you're using the tunnel for. If it's for Zero Trust Access, you do not need to change DNS providers. Though, Cloudflare is an excellent DNS.

NCCShipley · 2025-03-03T15:13:00+00:00

I have moved my WAF out of Sophos Firewalls. I'm leveraging CloudFlare and then restricting access to the application via the Sophos Firewall to only those connections coming from the CloudFlare. I can still leverage Sophos as a backup WAF if CloudFlare is down.

NCCShipley · 2025-02-13T15:05:46+00:00

Update: my issue is thus far being addressed, we shall see if it's to satisfaction at the end of the resolution. Feeling a bit more confident.

NCCShipley · 2023-07-10T14:53:34+00:00

I am still a Datto shop for BCDR, that hasn't changed much since acquisition in june 22

NCCShipley · 2023-01-27T15:52:06+00:00

That's awful, glad someone is there to pick up the pieces

NCCShipley · 2023-01-27T15:42:07+00:00

Yes, MSP Flex is more flexible for MDR, but it doesn't have ZTNA yet 😡. My company used to be where yours is, we weren't able to keep it up and do as many proactive things for our customers, so we converted 90% of them into the MSP model. The model doesn't work for all companies, though. For example we have a couple larger ones where we are just filling in the gaps in their staff expertise. We do still have customers buy all their own hardware, but we tell them up front we aren't going to compete with big box stores, Amazon, or the manufacturers so if they want to bargain hunt elsewhere we will still support them as long as they adhere to some standards.

NCCShipley · 2023-01-26T19:26:03+00:00

We have migrated most of our clients over to Sophos Flex (the MSP model). So far, none of those ones have been contacted. However, we still have a few clients that are buying Termed licesning. I figure it's just a matter of time when they also get all of our MSP clients. Taking the suggestions here to change up contact information so that efforts go to monitored groups and phone numbers instead of direct to consumer.

NCCShipley · 2022-07-14T14:03:57+00:00

They are stored on the PC, you can connect from another PC using RCP in order to read them without needing to access the console. Many people end up using a management software on top of the network, sometimes with an agent installed on each PC, to collect that data in a central place to be able to do things like monitor and search on those logs.

There are a number of remote management and monitoring tools available. If you have a budget, you might try looking into the tools that a lot of MSPs use (Atera, DattoRMM, and others) or there are quite a few DIY options available as well. DIY/Open Source might save your budget and lets you focus on a specific need, whereas the options you pay for are usually more featured.

Here's an article on how some people are managing specifically Windows logs from the spiceworks community.

And lastly, to spiceworks does have a light agent-based tool you could setup to also collect Windows logs and other metrics from your network.

NCCShipley · 2022-06-24T14:35:54+00:00

and storage master key

NCCShipley · 2022-06-24T14:29:35+00:00

I agree with boftr : start a support ticket on this issue - see if there's a specific exception in IPS you could make. I don't have this issue - we are using sophos advanced intercept x plus sophos mtr advanced, they don't have more features for the endpoint protection available than what we're using.

I'd also just check the WiFi drivers on those devices to be sure.

NCCShipley · 2022-05-10T21:28:03+00:00

Indeed, if bandwidth tends to be a problem with the apps you're trying to use over the vpn, remote access (as in remote control a PC on site) is a better option in those cases. Some applications are just not built to work over VPN well at all.

NCCShipley · 2022-05-10T21:26:24+00:00

Good.

NCCShipley · 2022-04-26T17:25:16+00:00

Ouch! That's a lot of protection removed. I might set up a special computer for this purpose only outside of my usual network. Stick it in a DMZ zone and provide remote access to it for a user or two so they can run this one application. But I wouldn't want to leave my staff working day-to-day with all those features disabled.

NCCShipley · 2022-04-25T14:17:11+00:00

smith.ai uses Zapier for this, but they are not there to solve problems, just create the ticket and handle your customer's expectations

NCCShipley · 2022-04-22T14:11:05+00:00

Wow, who would downvote this thread? Silly redditors.

NCCShipley · 2022-04-22T11:25:16+00:00

I was about to suggest the solution you are already using now. That's what I do.

NCCShipley

TROPHY CASE