Manual setup: bring your own lab environment

You picked the manual path. Arrive at class with your own pre-built lab environment instead of using the automated launcher that deploys to a fresh AWS sandbox account. This page covers the lab environment shared by the Zero Trust and Application Security courses.

What you need

A Windows client, two Ubuntu servers, a domain, and a Cloudflare Enterprise account with the right entitlements.

• A Windows 11 client (or Windows Server 2022).
• Two Ubuntu 24.04 LTS servers: Ubuntu A (primary origin) and Ubuntu B (backup origin). Ubuntu B is the second pool member for the Application Security Lab 5 Load Balancer and sits idle during the Zero Trust class; if you are only running the Zero Trust class you can skip provisioning it. All three VMs must be on separate subnets that cannot reach each other directly.
• A registered public domain that you own.
• A Cloudflare Enterprise account with the Zero Trust Premier Bundle (Zero Trust class), and Bot Management, API Shield, Advanced Certificate Manager, and Load Balancing add-ons (Application Security class), and that domain added as an active DNS zone on the Enterprise plan.

The Zero Trust Premier Bundle is a single account-level subscription that covers every Zero Trust feature the labs use:

• Access: applications, infrastructure targets, service tokens, short-lived SSH certificates
• Browser Isolation
• CASB
• Device management: posture, profiles, enrollment
• DEX: synthetic tests, remote diagnostics
• DLP: profiles, detection entries, payload encryption
• Gateway: DNS, HTTP, and Network firewall policies, TLS decryption, proxy endpoints
• Internal DNS
• Mesh
• Tunnel

You do not need Dedicated Egress IPs, Email Security, Cloudflare WAN, Magic Transit, or Magic Firewall.

Virtual machine specifications

Windows 11 client

Pre-installed software: a web browser, PowerShell, Notepad (runnable as Administrator), Computer Management (lusrmgr.msc), and the OpenSSH client (Settings → Apps → Optional Features → OpenSSH Client).

Local user account: cloudflare with password #Savetheinternet, member of the Administrators group.

Do not pre-install Cloudflare One Client (formerly WARP). You install it from scratch during Lab 1.

Ubuntu 24.04 LTS servers (Ubuntu A and Ubuntu B)

Build two Ubuntu servers with identical specs and configuration. The only behavioral difference is the /status endpoint covered below: Ubuntu A advertises "origin":"primary" and Ubuntu B advertises "origin":"backup". Ubuntu B is the second pool member for the Application Security Lab 5 Load Balancer; if you are only running the Zero Trust class you can skip provisioning it.

Local user account: cloudflare with password #Savetheinternet, member of sudo, with PasswordAuthentication yes enabled in /etc/ssh/sshd_config. Same on both Ubuntus.

Pre-installed software: nginx (or another web server), OpenSSH Server, OpenSSL, curl, dig (dnsutils), and a text editor. Same on both Ubuntus.

Web services running before class:

Two nginx vhosts pointing at separate static HTML directories is the simplest setup for website + intranet. curl http://localhost must return one set of content and curl http://localhost:8000 must return visibly different content. For /status, add a location = /status block to the port-80 vhost that returns application/json with the appropriate JSON for that VM.

Do not pre-install cloudflared or Cloudflare Mesh. Both are installed during labs via commands generated by the dashboard.

Network architecture

All three VMs must be on separate subnets with no direct route between any pair. All three VMs need outbound internet access (the Ubuntus for the Lab 2 / Lab 5 install endpoints; Windows for the Cloudflare One Client download and dashboard browsing). Labs 2-5 (Zero Trust) and Lab 5 (Application Security) build connectivity between the VMs using Cloudflare Tunnel, Access, Mesh, and Load Balancing. If they can already reach each other directly across your network, the labs lose their purpose.

+----------------------+   +-------------------------+   +-------------------------+
|   Windows 11 Client  |   |   Ubuntu A (primary)    |   |   Ubuntu B (backup)     |
|   Subnet A           |   |   Subnet B              |   |   Subnet C              |
|   (e.g. 10.90.0.0/24)|   |   (e.g. 10.91.0.0/24)   |   |   (e.g. 10.92.0.0/24)   |
|   Has internet       |   |   Has internet          |   |   Has internet          |
+----------------------+   +-------------------------+   +-------------------------+
       NO direct route between any pair. Connectivity is via Cloudflare.

For the simplest path that matches the lab guides verbatim, use Windows private IP 10.90.0.90, Ubuntu A (primary origin) private IP 10.91.0.91, and Ubuntu B (backup origin; Application Security Lab 5 Load Balancer second pool member) private IP 10.92.0.92. If you use different IPs, substitute your actual values wherever the lab guides reference specific IPs.

Cloudflare account: what to request

Tell your Cloudflare account team or partner manager you need:

You must own a registered public domain and add it to the account as the Enterprise DNS zone. The labs use this domain to publish internal services through Cloudflare Tunnel (web.yourdomain.com, ssh.yourdomain.com, intranet.yourdomain.com). The domain name does not matter (a cheap TLD from any registrar works); it must be a real, publicly resolvable domain with its nameservers pointed to Cloudflare.

The account should be provisioned but otherwise clean -- no tunnels, no policies, no Access apps, no enrolled devices.

Your Cloudflare account has a team name auto-assigned -- it's never blank. Find it in the Cloudflare One dashboard at Settings (gear icon at the bottom of the left sidebar): the first card on the page is Team name and domain, showing your team name and the full Team domain URL. If you'd prefer a shorter, easier-to-type name, click Edit next to the team name and pick a new one. The new value must be globally unique across all of Cloudflare (common words are usually taken). Confirm by checking that https://<your-team-name>.cloudflareaccess.com loads a Cloudflare sign-in page.

External URLs your Windows VM must reach

Corporate firewalls or proxy policies must allow these:

Pre-class verification checklist

Run through this a week before class. Fix anything that fails before Day 1.

FAQ

Can I use a cloud provider for the VMs?
Yes. Any platform works: cloud VMs, VMware, Hyper-V, VirtualBox. Just meet the OS versions, software requirements, and network isolation.

Can two students share one Cloudflare account?
No. Each student needs their own account and team name. Shared accounts cause policy conflicts and log confusion.

What if I cannot get an Enterprise account in time?
You will not be able to complete the labs. Browser Isolation, DLP, DEX, Infrastructure Access, Mesh, and Gateway proxy endpoints all require the Premier Bundle. Start the provisioning request as early as possible.

Why is the automated path the recommended path?
Because creating two correctly-isolated VMs with the right firewall rules, local user accounts, web content, and SSH configuration by hand takes a couple of hours and is easy to get wrong. A fresh AWS sandbox account costs a few dollars and the bootstrap script gets you to a verified starting point in under 10 minutes.