I came across this blog post by Cloudflare https://blog.cloudflare.com/a-free-argo-tunnel-for-your-next-project/ which caught my attention to solve an issue in my home lab! If you want to provide remote access for your Horizon Clients, VMware provides the Unified Access Gateway, which is a great appliance for the job; however, it must listen on port 443. This was a problem as my ISP will not allow inbound port 443 for my residential service and would force me to upgrade to a business account. The Argo Tunnel by Cloudflare allowed me to expose my Horizon Connection Server on the internet without opening any ports! Instead we run a lightweight service on our Windows server that creates an outbound tunnel to the Cloudflare network which you can run free of charge for testing or very inexpensive for production. Here are the steps to follow for your Horizon Connection Server:
- From your Horizon Connection Server, launch your computer certificate manager (certlm.msc) and locate the certificate being used (hint: friendly name = vdm)
- Export your certificate (do not export the private key) in Base-64 encoded format
- Rename your <certificatename>.cer file to <certificatename>.pem
- From your Horizon Connection Server with the Argo Tunnel downloaded (https://developers.cloudflare.com/argo-tunnel/downloads/ ) run the following command “./cloudflared.exe tunnel –url https://horizon.domain.com:443 –origin-ca-pool c:\pathtoyourcertificate\certificatename.pem”
- If you want to run as a service it will cost $5/month plus 10 cents per GB. Cloudflare only charges for Argo routing; there is no charge for the count of tunnels used. You can find details here https://developers.cloudflare.com/argo-tunnel/reference/service/
This is a great way to solve my home lab challenge and to showcase a quick test of remote access to customers without having to open firewall ports etc…Thanks again to Cloudflare for saving the day!