I’ve wanted to wipe an old desktop and run a server on it for awhile, so when my university’s IT department was having and equipment sale, I had to jump on the opportunity. I bought a Dell OptiPlex 3050 micro desktop and put an Ubuntu Server on it. The following is the documentation for how I went about setting up the machine to serve a website, specifically exposing it to the public internet using Cloudflare Tunnels.

Install the Ubuntu Server

Download Ubuntu Server and flash the iso file to a USB drive using Balena Etcher. With the USB drive in the system, go into the BIOS and change the boot order to use the USB drive first. Using the installation TUI, choose the default options and install the Ubuntu Server onto the system.

NOTE: be sure to choose to install OpenSSH when prompted.

After the system reboots, login and update the system:

sudo apt update && sudo apt upgrade

Setup ssh on the server

Confirm the ssh service is running:

sudo systemctl status ssh

If the service is not running, start it:

sudo systemctl enable --now ssh

Setup the server firewall

Enable the firewall:

sudo ufw enable

Allow firewall access to ssh, http, and https:

sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

Confirm the firewall rules were added:

sudo ufw status

Setup the Cloudflare Tunnel

Once ssh is setup on the server, you can connect to server from another local client to complete the tunnel setup:

ssh <user>@<server IP>

First, follow the instructions for adding a site to Cloudflare. Then, delete all DNS records from the website in the Cloudflare dashboard.

Follow the instructions for creating a locally managed tunnel but stop after you have authenticated cloudflared via the browser popup (step 2). Be sure to follow the commands for Linux when downloading and installing cloudflared. Then create a tunnel and give it a name:

cloudflared tunnel create <name>

Confirm that the tunnel has been successfully created by running:

cloudflared tunnel list

Create a configuration file:

touch ~/.cloudflared/config.yml

# ~/.cloudflared/config.yml
 
tunnel: <tunnel_uuid>
credentials-file: /home/<user>/.cloudflared/<tunnel_uuid>.json

ingress:
  - hostname: example.com
    service: http://localhost:<port>
  - hostname: ssh.example.com
    service: ssh://localhost:22
  - service: http_status:404

Validate ingress rules:

cloudflared tunnel ingress validate

Assign a CNAME record that points traffic to your tunnel domain/subdomain:

cloudflared tunnel route dns <tunnel_uuid or tunnel_name> <hostname>

For example, based on the above config file’s ingress rules, the command to assign CNAME records would be:

cloudflared tunnel route dns <tunnel_uuid> example.com
cloudflared tunnel route dns <tunnel_uuid> ssh.example.com

Run the tunnel:

cloudflared tunnel run <tunnel_uuid or tunnel_name>

Run cloudflared as a service

In order to make the ensure the server always connects to the Cloudflare tunnel even on system reboot, cloudflared needs to be as a service.

Stop running the tunnel from above with Ctrl + c

Install cloudflared service:

cloudflared service install

Start the service:

sudo systemctl start cloudflared

Confirm the service is running:

sudo systemctl status cloudflared

Connect to the server remotely

In order to ssh onto the server from a remote machine, the remote machine must have cloudflared installed. Once cloudflared has been installed, add the following lines to the ~/.ssh/config file:

# ~/.ssh/config

Host ssh.example.com
  ProxyCommand /usr/local/bin/cloudflared access ssh --hostname %h

Connect to the server using ssh:

ssh ssh.example.com

ERROR: Connection closed by UNKNOWN port 65535

If cloudfared is not installed on the remote machine, or the config.yml file in ~/.cloudflared/ is not identical to the one in /etc/cloudflared/, attempting to ssh will throw an error:

kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

Confirm the config files are identical:

diff -ws ~/.cloudflared/config.yml /etc/cloudflared/config.yml

If the files are different, copy the config.yml from ~/.cloudflared/ to /etc/cloudflared/:

sudo cp ~/.cloudflared/config.yml /etc/cloudflared/config.yml

Restart the cloudflared service:

sudo systemctl restart cloudflared