One Access

Appearance

Getting Started ​

This guide walks through exposing a host behind Cloudflare Access and connecting to it from One Access.

Prerequisites ​

  • An iPhone running the One Access app.
  • A hostname fronted by a Cloudflare Access policy that routes to a TCP service (for example, an SSH server exposed via a Cloudflare Tunnel).
  • Permission to reach it — your email/identity must satisfy the host's Access policy, since the app signs in as you via an interactive browser login.

Expose the host with Cloudflare ​

Skip this if your host is already behind Access. Otherwise, follow Cloudflare's Connect to SSH with client-side cloudflared guide — One Access takes the place of its "Connect as a user" step, so you only need the server side.

Connect the server to Cloudflare ​

  1. In the Zero Trust dashboard, go to Networking → Tunnels and create a tunnel with the Cloudflared connector.

  2. On the machine you want to reach, run the install command the dashboard shows — a token-bearing one-liner that installs the connector as a service:

    sh
    cloudflared service install <TOKEN>

  3. Back in the tunnel's config, add a public hostname: pick a domain and subdomain (e.g. ssh.example.com), set the service Type to SSH, and the URL to localhost:22.

  4. Add a self-hosted Access application for that hostname, with a policy that Includes your identity. This is what One Access signs in against.

Connect as a user — that's One Access ​

Cloudflare's guide would now have you install cloudflared locally and add a ProxyCommand ... cloudflared access ssh line to ~/.ssh/config. One Access replaces that step entirely — add the hostname in the app (below) and it runs the authenticated tunnel on-device, so you ssh straight to a local name.

1. Add a connection ​

Tap + on the Connections screen and fill in the two sections:

  • Hostname — the Cloudflare Access host to tunnel to, e.g. ssh.example.com.
  • Local — the Port to reach the service on-device (e.g. 22 for SSH), and a DNS name. The DNS name is a .internal label you connect to while the tunnel is up. Its prefix auto-fills from the hostname — ssh.example.com becomes ssh.example.com.internal — and you can shorten it, e.g. to myhost for myhost.internal. The .internal suffix is fixed.

Save with the checkmark. Repeat for other hosts; each gets its own virtual IP. Disconnect the VPN before adding, editing, or deleting hosts.

2. Connect ​

Turn on the VPN using the Status switch. All configured hosts become available at once. This step does not open a login browser or contact the origin servers. Allow VPN configuration and notifications when iOS asks.

3. Reach the service ​

While the tunnel is up, connect to the connection's DNS name (or the virtual IP displayed on that host's card) from any app on the phone. If you shortened the DNS name to myhost.internal, an SSH session is:

sh
ssh -p 22 [email protected]

Use the port you set in step 1 and the DNS name shown on the connection card.

If Access requires login, this first connection fails. Tap the notification naming the host, or tap Sign In Again on its card. Complete the browser login, then retry SSH. Other hosts remain connected. If notifications are disabled, open One Access to use the host's sign-in button.

After upgrading from the single-host version, reconnect the VPN once and update clients that used 10.64.0.1: that address now serves DNS only. Prefer the saved .internal name, or copy the host's new IP from its card.

Staying signed in ​

The app signs you in with an interactive browser login, which yields a short-lived application token. When it expires, new connections are rejected and the app prompts you to sign in again — see Sessions & Sign-In.

Service tokens — a never-expiring, no-browser credential — are supported by the kernel but not yet exposed in the app UI.