One Access - Private Tunnel

One Access puts a Cloudflare Access client right on your iPhone.

It runs the client half of “cloudflared access tcp” on-device as a secure packet tunnel, so you can reach your Access-protected SSH servers — or any TCP service — with no laptop, no cloudflared binary to install, and nothing exposed to the public internet.

Add a hostname, sign in through Cloudflare Access, and connect from any terminal app on your phone.

FEATURES

• On-device tunnel — the proxy runs inside your iPhone. No companion laptop, no port forwarding, nothing open to the internet. • Cloudflare Access sign-in — authenticate with an interactive browser login. Traffic rides an authenticated WebSocket straight to the Cloudflare edge. • Friendly .internal names — connect to myhost.internal instead of a raw IP. A built-in resolver answers those names inside the tunnel. • Live session stats — watch per-connection uptime and cumulative download / upload totals in real time. • Multiple connections — save every host and toggle each one on or off.

WHAT YOU NEED

• A Cloudflare Zero Trust account. • A hostname fronted by a Cloudflare Access policy that routes to a TCP service — for example, an SSH server behind a Cloudflare Tunnel. • Permission to reach it: your identity must satisfy the host’s Access policy.

HOW IT WORKS

One Access brings up a packet tunnel, dials your Access-fronted hostname over an authenticated WebSocket, and forwards every TCP flow to it. Your SSH client just connects to a local name — the app handles the sign-in and the encrypted tunnel end to end. Because the connection to Cloudflare’s edge uses your device’s real network, the tunnel it carries never loops back on itself.

One Access is an independent client for Cloudflare Access and is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc. “Cloudflare” is a trademark of Cloudflare, Inc.