Short answer
A small connector inside your network opens an outbound-only link to Cloudflare, so private apps are reachable without a VPN or open ports.
In detail: How Cloudflare Tunnel replaces VPN access
How it works:
- The connector runs on a server, virtual machine or container next to the app, in your office, data centre or cloud
- It dials out to Cloudflare, so no inbound firewall rules or public IP addresses are needed for the app
- Cloudflare Access checks each request against identity, device posture and policy before it reaches the app
- Users connect through the Cloudflare One Client, or through a browser for web apps, including contractors on unmanaged devices
Because each app is published on its own, users reach only the apps they are allowed to use, not the whole network, which limits what a stolen password can reach.
FirstNet installs and monitors the connectors, usually two per site for resilience, and rolls apps across one at a time, starting with a pilot group. See whether Cloudflare can replace your VPN for the wider picture.