Cloudflare Tunnel on QNAP TS-659 Pro (QTS 4.2.6)

[ccb056]

Successfully tested on a TS-659 Pro (Intel Atom K510, x86_64) running QTS 4.2.6 using a dashboard-managed tunnel and token authentication.

1. Download cloudflared

Download the current Linux AMD64 binary on another machine and copy it to the NAS:

Code: Select all

https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64

Code: Select all

scp cloudflared-linux-amd64 admin@NAS:/share/Public/

2. Install cloudflared

Code: Select all

mkdir -p /share/Public/cloudflared
mkdir -p /share/Public/cloudflared/creds

mv /share/Public/cloudflared-linux-amd64 \
   /share/Public/cloudflared/cloudflared

chmod +x /share/Public/cloudflared/cloudflared

Verify:

Code: Select all

/share/Public/cloudflared/cloudflared --version

3. Create a dashboard-managed tunnel

In Cloudflare Zero Trust:

Code: Select all

Networks
  -> Tunnels
      -> Create a tunnel
          -> Cloudflared
              -> Linux

Copy the generated tunnel token.

Create:

Code: Select all

vi /share/Public/cloudflared/creds/token.txt

Paste the token into the file and save.

4. Create startup script

Code: Select all

cat >/share/Public/cloudflared/start-cloudflared.sh <<'EOF'
#!/bin/sh

sleep 60

TOKEN=$(cat /share/Public/cloudflared/creds/token.txt)

/share/Public/cloudflared/cloudflared \
  tunnel \
  --no-autoupdate \
  run \
  --token "$TOKEN" \
  >> /share/Public/cloudflared/cloudflared.log 2>&1 &
EOF

chmod +x /share/Public/cloudflared/start-cloudflared.sh

5. Test manually

Code: Select all

/share/Public/cloudflared/start-cloudflared.sh

Wait about a minute and verify:

Code: Select all

ps | grep cloudflared

6. Configure autorun

Mount the QNAP configuration partition:

Code: Select all

mount -t ext2 /dev/sdx6 /tmp/config

Create autorun.sh:

Code: Select all

cat >/tmp/config/autorun.sh <<'EOF'
#!/bin/sh

/share/Public/cloudflared/start-cloudflared.sh
EOF

chmod +x /tmp/config/autorun.sh

Verify:

Code: Select all

ls -l /tmp/config/autorun.sh

Save changes:

Code: Select all

umount /tmp/config

7. Reboot and verify

After reboot, wait 2-3 minutes and check:

Code: Select all

ps | grep cloudflared

or verify that the connector shows online in the Cloudflare dashboard.

Advantages of the dashboard-managed method

- Public Hostnames managed in the Cloudflare dashboard
- Private Network Routes managed in the Cloudflare dashboard
- No dependency on cert.pem
- No dependency on tunnel credential JSON files
- Tunnel survives QNAP reboots
- Auto-update disabled for maximum compatibility with older hardware

Notes

- The TS-659 Pro successfully runs the current cloudflared AMD64 binary despite its age.
- The QNAP's built-in OpenSSL is too old to download directly from GitHub.
- Token authentication stored on the data volume proved reliable across reboots.
- Dashboard-managed tunnels are much easier to administer than locally-managed tunnels on older QNAP systems.