# ThinLinc access via Cloudflare tunnels

**URL:** <https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570>\
**Category:** General\
**Tags:** cloudfare, vpn\
**Created:** [9 March 2023 17:14 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570 "2023-03-09T17:14:42Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![rd-thinlinc](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@rd-thinlinc](https://community.thinlinc.com/u/rd-thinlinc)\
**Post date:** [9 March 2023 17:14 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/1 "2023-03-09T17:14:43Z")

</div>

I am exploring a new option to expose a ThinLinc server on Ubuntu using the Cloudflare tunnel offering instead of local Firewall holes. The concept is done by running a Cloudflare connector endpoint inside your protected LAN where this connects and proxies the connections thru to the Cloudflare tunnel. I am attempting this as NGINX is no longer required and and SSL Certs needed by the client are provided by the cloudflare side, even if you have a locally signed SSL Cert this still works with a setting change on the tunnel configuration

So far I setup the tunnel on Cloudflare using [https://\<local-ip:300] ( Cloudflare tunnel lingo) on the inside. The connection uses a valid sub-domain to link this together.

When testing I immediately get into the web Interface of the ThinLinc server where I can put in my username password and then the connection no longer progresses. I am assuming the ThinLinc server can sense a proxy during the conversation so discontinues this connection?

Is there any configuration on the ThinLinc server where I can tell the ThinLinc server the IP of my local Cloudflare connector ( proxy) IP to allow the connection to continue?

I have seen the article linked to [Nginx Proxy rewrites](https://www.verboom.net/blog/index.html?single=20151019.0) and that works within Nginx

thanks

---

<div class="post-metadata">

**Author:** ![aaron](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/aaron/32/13_2.png) [@aaron](https://community.thinlinc.com/u/aaron)\
**Post date:** [15 March 2023 19:53 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/2 "2023-03-15T19:53:35Z")

</div>

I don’t have any experience using ThinLinc over Cloudfare tunnels unfortunately, but it may be that the redirect isn’t working. What is the value of the `agent_hostname` parameter in `/opt/thinlinc/etc/conf.d/vsmagent.hconf` on your ThinLinc server? This would need to be set to “localhost” so that the browser redirects to your client machine.

There may be other issues connecting over such a tunnel, as mentioned I’m not familiar with the solution. But let us know how you go.

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [16 March 2023 12:38 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/3 "2023-03-16T12:38:38Z")

</div>

Hello @rd-thinlinc,

I just had a go with CF Tunnels, and made it work with an out-of-the-box installation of ThinLinc.

Could you share a bit more about your set up?

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![rd-thinlinc](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@rd-thinlinc](https://community.thinlinc.com/u/rd-thinlinc)\
**Post date:** [17 March 2023 12:39 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/4 "2023-03-17T12:39:47Z")

</div>

I have the Cloudflare connector installed on a local SYNOLOGY NAS. I have a few other public host names able to get into those exposed tunnel public hostnames.

@aaron  
the vsmgent.hconf was pointing to the local IP of the Ubuntu box where I have ThinLinc Server parts installed. This is working with the client and web access locally.  
agent\_hostname=[local IP of Ubuntu box]

@martin  
CF tunnel forwards to https://[local IP of Ubuntu]:300 \<\< trying the Web access 1st

attempt:  
The Thinlinc web logon page is OK … I enter my username and password then it shows  
redirecting to ThinLinc server  
https://[local IP of Ubuntu box]:300, please wait

vsmserver log shows  
2023-03-17 08:23:57 INFO vsmserver.session: User with uid 1001 requested a reconnection to 127.0.0.1:10  
2023-03-17 08:23:57 INFO vsmserver: Verifying session 127.0.0.1:10 for [user]  
2023-03-17 08:23:57 INFO vsmserver: Session 127.0.0.1:10 for [user] is alive and ready for reconnection  
2023-03-17 08:23:57 WARNING vsmserver.session: Failed to get client ip for the session

if performing the connection locally I don’t see that error. and a eventually see in the tlwebaccess log  
a GET /websocket/[user]/10/  
connecting to: localhost:5910

@martin  
how did you setup the ‘Service’ section in CF tunnel? this may give me a clue where things go wrong

my other thought is to run another tunnel connector instance on the Ubuntu box thru docker if they allow to see if that works

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [17 March 2023 12:52 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/5 "2023-03-17T12:52:13Z")

</div>

```auto
2023-03-17 08:23:57 WARNING vsmserver.session: Failed to get client ip for the session

```

This line is safe to ignore in this case with tlwebaccess.

These are the tunnel settings I’m using:  
Adjusted `Type` to `HTTPS` and `URL` to `localhost:300`  
`Origin Server Name` to my server hostname from `hostnamectl` output  
Also enabled `No TLS Verify` since the local certificate is self-signed.

 ![Screenshot from 2023-03-17 13-49-05](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/1X/717170021cb3e4f6abe007f05ac835af270fc274.png)

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![rd-thinlinc](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@rd-thinlinc](https://community.thinlinc.com/u/rd-thinlinc)\
**Post date:** [17 March 2023 13:21 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/6 "2023-03-17T13:21:36Z")

</div>

@martin

I assume the tunnel connector is running locally on that box as well? if so is it running as a docker instance or locally as a process? Mine is not local to the ThinLinc server and that may be the issue…

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [17 March 2023 13:25 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/7 "2023-03-17T13:25:17Z")

</div>

Correct, it’s a simple setup with ThinLinc Master, agent and connector running on same server.

/Martin

---

<div class="post-metadata">

**Author:** ![rd-thinlinc](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@rd-thinlinc](https://community.thinlinc.com/u/rd-thinlinc)\
**Post date:** [17 March 2023 13:59 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/8 "2023-03-17T13:59:10Z")

</div>

I am now setup with same as you. The ThinLinc Master Agent and connector all running on my local Ubuntu box tunnel [https://localhost:300](https://localhost:300)

… and get the same result … redirecting to https://[IP of local box]:300 and this stalls…

Is that IP of your lab-29 box on a public IP?

This all works when running the client from my local LAN segment … Doesn’t work from outside Internet connected client…

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [17 March 2023 14:27 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/9 "2023-03-17T14:27:55Z")

</div>

No, it’s a LAN ip.

ThinLinc Webacces will perform a redirect after login to `agent_hostname`. If this is undefined, it will be the IP address of the agent. If your client (browser) can’t reach this IP, it will eventuelly time out.

To be able to reach this from both LAN and WAN side, one can set `agent_hostname` to a hostname Then you will need to configure your DNS service to respond with different IP addresses, depending on the source network of the DNS query, a.k.a. Split view / horizon.

[https://www.cendio.com/resources/docs/tag/network.html?highlight=nat#dns](https://www.cendio.com/resources/docs/tag/network.html?highlight=nat#dns)

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![rd-thinlinc](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@rd-thinlinc](https://community.thinlinc.com/u/rd-thinlinc)\
**Post date:** [17 March 2023 15:00 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/10 "2023-03-17T15:00:22Z")

</div>

This redirect seem to break out of the Cloudflare tunnel if I am following you correctly or no?

Since the redirect == https://[agent\_hostname]:300 \< My Firewall blocks this direct access when the external DNS provides a public IP.

---

<div class="post-metadata">

**Author:** ![rd-thinlinc](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@rd-thinlinc](https://community.thinlinc.com/u/rd-thinlinc)\
**Post date:** [21 March 2023 21:02 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/11 "2023-03-21T21:02:13Z")

</div>

> [@martin](#):
>
> agent\_hostname

Is your server you setup reachable directly using the redirected public DNS address associated with the agent\_hostname?

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [22 March 2023 12:48 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/12 "2023-03-22T12:48:57Z")

</div>

Hello,

I apologize for taking so long to respond, I’ve been busy with some other stuff.

To get this to work externally, I set agent\_hostname= to my public DNS record, and I also changed the tlwebaccess port (300) to 443, so that the redirect to agent after authentication will match the tunnel configuration at CF. This was previously set to “localhost:300” at CF in the URL field. I changed it to only be “localhost”

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![rd-thinlinc](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@rd-thinlinc](https://community.thinlinc.com/u/rd-thinlinc)\
**Post date:** [22 March 2023 16:50 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/13 "2023-03-22T16:50:20Z")

</div>

I now have this setup working through 443 Web access with your suggestion. Thank You.

I was also hoping to get the main full client to also work through these CF tunnel if possible?

---

<div class="post-metadata">

**Author:** ![Damon](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/damon/32/684_2.png) [@Damon](https://community.thinlinc.com/u/Damon)\
**Post date:** [20 May 2025 10:22 UTC](https://community.thinlinc.com/t/thinlinc-access-via-cloudflare-tunnels/570/14 "2025-05-20T10:22:52Z")

</div>

Just wanted to thank you for this thread and the answers.  
This fixed the issue for me with thinlinc and CF tunnels.  
Now thinlinc is available without opening any ports with CF tunnels.