Cloudflare ZTNA tunnel - agents don't connect

[frogweh]

I'm pretty new to a lot of this. I have a home server setup with mesh central. I use wireguard for access to most of my things, but since I'm attempting to use mesh central as an alternative to TeamViewer, I don't want to just connect to people when the VPN is working (what if it's not?). I bought a google domain and am currently using cloudflare ZTNA tunnel to my server to access the web portal which is great, however I can't get it to work with the agents (except through wireguard). I've been researching all of this for about 2 days now, and I think I'm just out of my element. Is there a way for me to achieve my result utilizing the cloudflare ZTNA tunnel, or am I better off just using it in conjunction with wireguard? Thanks in advance!

[si458]

What is your config.json?

[frogweh]

{ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json", "comment1": "This is a simple configuration file, all values and sections that start with underscore (_) are igno> "comment2": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.", "settings": { "cert": "", "_WANonly": true, "_LANonly": true, "_sessionKey": "MyReallySecretPassword1", "port": 443, "aliasPort": 443, "_redirPort": 80, "_redirAliasPort": 80, "trustedproxy": "CloudFlare", }, "domains": { "": { "_title": "MyServer", "_title2": "Servername", "_minify": true, "_newAccounts": false, "_userNameIsEmail": true } }, "_letsencrypt": { "comment": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.", "email": "email@gmail.com", "names": "", "production": false } }

[thermionic]

If it works over a wg tunnel from the agent to the server, but doesn;t over the CF ztna tunnel, it rather points the finger at the CF ztna tunnel, and I'd hazard a guess that DNS would be the reason, but not being a CF ztna user, I don't know if they manipulate any traffic going through ztna (such as via a proxy).

Granted having access to MC only over an existing authenticated "tunnel" is always going to be more secure than having access to MC over the Internet, but what problem are you trying to solve as both wg and CF ztna have the same issue, if it is down, then you don't have connectivity...