Home Network Design: Starlink & Cloudflare Zero Trust
Budget: $15 – $25 AUD
Cloudflare Zero Trust & Starlink CGNAT Home Network – Project Summary
This project involves designing a secure home SASE-style network using Starlink Gen 3 (CGNAT) and Cloudflare Zero Trust to protect internal infrastructure while enabling secure remote access. Because Starlink operates behind CGNAT, traditional port forwarding cannot be used. Instead, Cloudflare Tunnel will create encrypted outbound connections to securely expose internal services without opening inbound ports.
The network includes NAS storage, Home Assistant, IoT devices, PTZ/NVR security cameras, UPS monitoring systems, and smart-home integrations (Google Home, Alexa, Apple Home). The architecture must provide secure remote administration while maintaining normal automation functionality.
Security will rely on Cloudflare Access, Gateway, WARP device policies, DNS filtering, and identity-based authentication. The internal network will use VLAN segmentation to isolate trusted devices, servers, IoT systems, and guest networks.
The objective is to deliver enterprise-grade Zero Trust security using Cloudflare’s free-tier features wherever possible, with secure remote access, strong device authentication, and no publicly exposed services.
This project involves designing a secure home SASE-style network using Starlink Gen 3 (CGNAT) and Cloudflare Zero Trust to protect internal infrastructure while enabling secure remote access. Because Starlink operates behind CGNAT, traditional port forwarding cannot be used. Instead, Cloudflare Tunnel will create encrypted outbound connections to securely expose internal services without opening inbound ports.
The network includes NAS storage, Home Assistant, IoT devices, PTZ/NVR security cameras, UPS monitoring systems, and smart-home integrations (Google Home, Alexa, Apple Home). The architecture must provide secure remote administration while maintaining normal automation functionality.
Security will rely on Cloudflare Access, Gateway, WARP device policies, DNS filtering, and identity-based authentication. The internal network will use VLAN segmentation to isolate trusted devices, servers, IoT systems, and guest networks.
The objective is to deliver enterprise-grade Zero Trust security using Cloudflare’s free-tier features wherever possible, with secure remote access, strong device authentication, and no publicly exposed services.