Keystone Cloud Tunnel (Cloudflare)

Introduction

The Keystone Cloud Tunnel (Cloudflare) is a reverse-proxy that allows Keystone Online and third parties to securely access the resources provided by KServer without requiring one or more ports to be opened through the customer's firewall. It is a direct replacement for the previous Keystone Relay which has been deprecated and will eventually be phased out entirely.

Because Keystone Cloud Tunnel is based on Cloudflare Tunnels, some prepartion steps must be done when setting up Keystone Cloud Tunnel on a customer system for the first time.

Preparation

Creating a New Tunnel

Creating a new tunnel requires several steps. These steps have been consolidated into a single Windows Command Batch file. Currently, this resides on the Keystone Internal Build Testing server (192.168.2.232.)

1. Connect to the internal build testing server (you can teamviewer or RDP.)
2. Open a Windows Command prompt.
3. Type: CD \CCGH\CFTUNNEL
4. Type: MAKECT ##### (where ##### is the Keystone serial number for the customer.)
5. When complete, you will see something similar to this:

• The "Tunnel Name" is the name assigned to the tunnel.
• The "Tunnel ID" is a unique identifier for the tunnel assigned by Cloudflare.
• The "Output Dir" is the folder created by the batch file that holds the two configuration files (config.yml and KSTunnel.json.)
• The "DNS Name" is the URL (will be prefixed with "https://") that will be used by external clients to make KServer requests for this customer.

Recording the Tunnel Configuration

1. Download the two configuration files from the "Output Dir" created in the previous step.
2. Open a browser and login to Keeper.
3. Locate the customer you are working on.
4. Click on the "API Credentials" folder (create a new folder if this doesn't already exist.)

1. Click the 3 dots to the right of "API Credentials", select "New Record", select "Cloudflare Tunnel" as the record type and enter "Cloudflare Tunnel" as the name:

1. On the record screen, enter the "Tunnel Name" and "Tunnel ID" from the previous step (cut & paste from your command prompt window.) For the KSTunnel.JSON box, you need to open the KSTunnel.json file that you downloaded and cut & paste the contents of this file into the box:

Installation & Configuration of Customer Server

New Customer Setup

Perform the standard Keystone installation process. When the screen appears where you select which services to install, be sure that Keystone Cloud Tunnel is checked. When you click Next, you will see the following prompt:

image goes here

At this point, upload the two files downloaded after the tunnel was created into the C:\ProgramData\GivenHansco\Keystone\Settings folder (this folder should already have been created by the setup program.) Once the files are uploaded, click Next and proceed normally.

Existing Customer Setup

(TBD - the idea is to download the web update and release it so workstations will update, but install the update on the server using the EXE. This will show the services screen during the update where Keystone Cloud Tunnel can be selected.)