What is a Cloudflare Argo Tunnel Argo Tunnel provides a secure way to expose web servers to the Internet without opening firewall ports or configuring ACLs. Argo Tunnel also ensures that requests are routed through Cloudflare before reaching your origin web server, ensuring that attack traffic is stopped by Cloudflare’s WAF and Unmetered DDoS mitigation, and can be authenticated through Access if enabled on the account.

Why use Argo instead of a normal CDN? Because using a CDN requires opening port 60000 in the security group, and leaks the IP address of the C&C server, increasing the risk of being traced back. With ArgoTunnel, there’s no need to open the backend port. Plus you get an official Cloudflare certificate.

Also, Cloudflare now routes through the Hong Kong node by default, so access from mainland China isn’t slow either.

Why did I go this route? Actually, at first I just wanted to hide the panel, so I used the host to install nginx as a reverse proxy, but it was too much hassle. Eventually I remembered that Argo can avoid opening ports, bind a domain, and hide the address, so I jumped on Argo right away.

1
docker ps #Check container name
2
docker exec -i -t viper-c /bin/bash
3
#The following operations are inside the container
4
cd /root/viper/Docker/
5
nano viper.conf

1
.......
2
server {
3
        include /root/viper/Docker/nginxconfig/viper.conf;
4
        ssl off;    #Change this from on to off
5
        ssl_certificate /root/viper/Docker/nginxconfig/server.crt;
6
.......

1
nginx -s reload
2
exit #Exit the container

1
cloudflared tunnel login #First log in, and select the example.com domain
2
cloudflared tunnel create viper
3
cloudflared tunnel route dns viper vip #Through the vip tunnel, automatically add a CNAME record pointing to vip.example.com in Cloudflare

1
cloudflared tunnel --name viper --url http://127.0.0.1:60000

1
sudo cloudflared service install
2
nano /etc/cloudflared/config.yml

1
tunnel: <Tunnel-UUID>
2
credentials-file: /root/.cloudflared/<Tunnel-UUID>.json
3

4
ingress:
5
  - hostname: vip.example.com
6
    service: http://127.0.0.1:60000
7
  - service: http_status:404

1
sudo systemctl restart cloudflared && sudo systemctl enable cloudflared