Keystone Cloud Tunnel (Cloudflare)

Introduction

The Keystone Cloud Tunnel (Cloudflare) is a reverse-proxy that allows Keystone Online and third parties to securely access the resources provided by KServer without requiring one or more ports to be opened through the customer's firewall. It is a direct replacement for the previous Keystone Relay which has been deprecated and will eventually be phased out entirely.

Because Keystone Cloud Tunnel is based on Cloudflare Tunnels, some preparation steps must be done when setting up Keystone Cloud Tunnel on a customer system for the first time.

Preparation

Creating a New Tunnel

Creating a new tunnel requires several steps. These steps have been consolidated into a single Windows Command Batch file. Currently, this resides on the Keystone Internal Build Testing server (192.168.2.232)

1. Connect to the internal build testing server (you can TeamViewer or RDP.)
2. Open a Windows Command prompt.
3. Type: CD \CCGH\CFTUNNEL
4. Type: MAKECT ##### (where ##### is the Keystone serial number for the customer.)
5. When complete, you will see something similar to this:

   

   • The "Tunnel Name" is the name assigned to the tunnel.
   • The "Tunnel ID" is a unique identifier for the tunnel assigned by Cloudflare.
   • The "Output Dir" is the folder created by the batch file that holds the two configuration files (config.yml and KSTunnel.json.)
   • The "DNS Name" is the URL (will be prefixed with "https://") that will be used by external clients to make KServer requests for this customer.

Recording the Tunnel Configuration

It is extremely important to record in Keeper the information created by the previous step.

1. Download the two configuration files from the "Output Dir" created in the previous step.
2. Open a browser and login to Keeper.
3. Locate the customer you are working on.
4. Click on the "API Credentials" folder (create a new folder if this doesn't already exist.)

   

5. Click the 3 dots to the right of "API Credentials", select "New Record", select "Cloudflare Tunnel" as the record type and enter "Cloudflare Tunnel" as the name:

   

6. On the record screen, enter the "Tunnel Name" and "Tunnel ID" from the previous step (cut & paste from your command prompt window.) For the KSTunnel.json box, you need to open the KSTunnel.json file that you downloaded and cut & paste the contents of this file into the box:

   

Installation & Configuration of Customer Server

New Customer Setup

Perform the standard Keystone installation process. When the screen appears where you select which services to install, be sure that Keystone Cloud Tunnel is checked. When you click Next, you will see the following prompt:

image goes here

At this point, upload the two files downloaded after the tunnel was created into the C:\ProgramData\GivenHansco\Keystone\Settings folder (this folder should already have been created by the setup program). Once the files are uploaded, click Next and proceed normally.

Existing Customer Setup

1. Transfer Keystone update to the server.
2. Install the update on the server using the EXE. This will show the services screen during the update where Keystone Cloud Tunnel can be selected.
3. Make sure the files are in the settings folder before you install the service.
4. C:\ProgramData\GivenHansco\Keystone\Settings folder
5. Once the update is complete and Cloudflare is setup. Load the update via system maintenance -> Updates -> Load Update.
   1. This will release the update to all other workstations.

Website Setup

1. Navigate to Manage Business
2. Access the Business
3. Change the Following:
4. Keystone Connection String = DNS Name from the Cloudflare Setup (https://ksXXXXXX.ghapi.net -- see example below)
5. Keystone Port = 443
6. Keystone API Key = (Using the Support Tool) (If existing API key is present you can leave alone)
7. Remove Keystone Relay Connection field

Last Steps

1. Make sure Paul is aware of the customers that are moved from Keystone Relay
2. (If a customer has a third party interface do not remove the relay at this time -- 8.6.26) Make sure the relay is disabled or uninstalled Command prompt - (sc delete ksrelay_service)