Cloudflare Docs
Cloudflare Zero Trust
Cloudflare Docs
Cloudflare Zero Trust
GitHub icon
Visit Cloudflare Zero Trust on GitHub
Set theme to dark (⇧+D)
  1. Products
  2. Cloudflare Zero Trust
  3. ...
  4. ...
  5. Tunnel use cases
  6. SMB

Access an SMB drive through Cloudflare Tunnel

The Server Message Block (SMB) protocol allows users to read, write, and access shared resources on a network. Due to security risks, firewalls and ISPs usually block public connections to an SMB file share. With Cloudflare Tunnel, you can provide secure and simple SMB access to users outside of your network.

Cloudflare Zero Trust offers two solutions for connecting to SMB servers:

​​ Set up an SMB server on Linux

While SMB was developed for Microsoft Windows, Samba provides SMB connectivity from UNIX-like and BSD systems. A Samba server can be set up using this guide on an Ubuntu machine.

​​ Connect to SMB server with WARP to Tunnel

You can use Cloudflare Tunnel to create a secure, outbound-only connection from your server to Cloudflare’s edge. This requires running the cloudflared daemon on the server. Users reach the service by installing the Cloudflare WARP client on their device and enrolling in your Zero Trust organization. Remote devices will be able to connect as if they were on your private network. By default, all devices enrolled in your organization can access the service unless you build policies to allow or block specific users.

​​ 1. Connect the server to Cloudflare

  1. Create a Cloudflare Tunnel for your server by following our dashboard setup guide. You can skip the connect an application step and go straight to connecting a network.

  2. In the Private Networks tab for the tunnel, enter the private IP address of your server (or a range that includes the server IP).

  3. (Optional) Set up Zero Trust policies to fine-tune access to your server.

​​ 2. Set up the client

In order for devices to connect to your Zero Trust organization, you will need to:

  • Deploy the WARP client on your devices in Gateway with WARP mode. The Cloudflare certificate is only required if you want to display a custom block page or filter HTTPS traffic.
  • Create device enrollment rules to determine which devices can enroll to your Zero Trust organization.

​​ 3. Connect as a user

​​ macOS

  1. In the Finder menu, select Go > Connect to Server.

  2. Enter smb://<smb-server-ip-address>/sambashare.

    Connect to SMB server in macOS

  3. Sign in with the username and password created while setting up the server.

​​ Windows

  1. Open File Explorer and right-click Network > Map Network Drive.
  2. For Folder, enter \\<server-private-ip>\sambashare.
  3. Select Connect using different credentials.
  4. Select Finish.
  5. Sign in with the username and password created while setting up the server.

​​ Connect to SMB server with cloudflared access

Cloudflare Tunnel can also route applications through a public hostname, which allows users to connect to the application without the WARP client. This method requires having cloudflared installed on both the server machine and on the client machine, as well as an active zone on Cloudflare. The traffic is proxied over this connection, and the user logs in to the server with their Cloudflare Access credentials.

The public hostname method can be implemented in conjunction with routing over WARP so that there are multiple ways to connect to the server. You can reuse the same tunnel for both the private network and public hostname routes.

​​ 1. Connect the server to Cloudflare

  1. Create a Cloudflare Tunnel by following our dashboard setup guide.

  2. In the Public Hostnames tab, choose a domain from the drop-down menu and specify any subdomain (for example, smb.example.com).

  3. For Service, select TCP and enter the SMB listening port (for example, localhost:445). SMB drives listen on port 139 or 445 by default.

  4. Select Save hostname.

  5. (Recommended) Add a self-hosted application to Cloudflare Access in order to manage access to your server.

​​ 2. Connect as a user

  1. Install cloudflared on the client machine.

  2. Run the following command to open an SMB listening port. You can specify any available port on the client machine.

    $ cloudflared access tcp --hostname smb.example.com --url localhost:8445

    This command can be wrapped as a desktop shortcut so that end users do not need to use the command line.

  3. Open your SMB client and configure the client to point to smb://localhost:8445/sambashare. Do not input the hostname.

  4. Sign in with the username and password created while setting up the server.

​​ Windows-specific requirements

If you are using a Windows machine and cannot specify the port for SMB, you might need to disable the local server. The local server on a client machine uses the same default port 445 for CIFS/SMB. By listening on that port, the local server can block the cloudflare access connection.

To disable the local server on a Windows machine:

  1. Select Win+R to open the Run window.
  2. Type services.msc and select Enter.
  3. Locate the local server process, likely called Server.
  4. Stop the service and set Startup type to Disabled.
  5. Repeat steps 3 and 4 for TCP/IP NetBIOS Helper.