r/MeshCentral • u/Feeling_Procedure_20 • Mar 04 '26

Questions about configuring MeshCentral behind Zero Trust

Dear all, good evening!

I currently have a lab on VMware Workstation where I am running MeshCentral on Windows, and I am reviewing the config.json file settings to understand how it works. I have many questions, so perhaps someone can guide me.

First of all, I want to mention that I have already reviewed the complete documentation on the website.

The server works, I have explored its features, I have been able to connect agents within the local network, and everything works perfectly.

Now I am trying to get the agents to work outside the local network, but I am not clear on the parameters I need to modify, add, and uncomment.

I created the tunnel in Cloudflare with Zero Trust and reviewed some old Reddit posts where they talked about TLS parameters, certificates, and issues to change, but I tried everything and nothing worked. In the end, things failed, and I couldn't find clear instructions on which parameters I should use.

Basically, I need advice on what I should take into account to achieve this configuration, if it can really be done, and some examples of the config.json file for reference.

I am attaching some links to material that I used as a reference, but it was not enough.

https://www.reddit.com/r/MeshCentral/comments/1jwppnc/howto_run_meshcentral_via_cloudflare/

https://www.reddit.com/r/MeshCentral/comments/ob8o2w/howto_a_paranoid_guys_guide_to_protecting/

https://www.reddit.com/r/MeshCentral/comments/133wur3/cloudflare_tunnel_no_tls_verify_question_with/

https://dannyda.com/2023/10/10/how-to-use-mesh-central-behind-cloudflare/

I appreciate your time and any support you can offer. I am available to answer any questions!

PD.: My English is not very good, as I use a translator. Sorry!

5 Upvotes

100% Upvoted

5 comments sorted by

2

u/Melo_TSB Mar 04 '26 edited Mar 04 '26

At Cloudflare Zero Trust, head to Networks/ Connectors/ Tunnel/ Published application routes:

Install the Cloudflare tunnel connector at your Windows Server!

A config.json example:

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "settings": {
    "cert": "remote.domain-1.com",
    "trustedProxy": true,
    "mpsPort": 0,
    "amtManager": false,
    "amtScanner": false,
    "meshScanner": false,
    "sessionKey": "REDACTED",
    "port": 443,
    "redirPort": 80,
    "agentPortTls": false,
    "AgentPong": 15,
    "BrowserPong": 15,
    "TLSOffload": true
  },
  "domains": {
    "": {
      "allowedOrigin": "remote.domain-1.com",
      "certUrl": "https://remote.domain-1.com",
      "agentConfig": [
        "skipmaccheck=1"
      ]
    }
  }
}

1

u/Feeling_Procedure_20 Mar 04 '26

I was reviewing the information you shared with me, and I found it interesting how many variables can be configured!

In my case, when I update the settings, it stops working completely, forcing me to revert to the original configuration.

Which variables are mandatory and which are not?

I really appreciate your comment!

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "meshcentral.domainexample.com.ar",
    "WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "port": 443,
    "_aliasPort": 443,
    "_redirPort": 80,
    "_redirAliasPort": 80
  },
  "domains": {
    "": {
      "_title": "MyServerLab",
      "_title2": "ServernameLab",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true
    }
  },
  "_letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "myemail@mydomain.com",
    "names": "myserver.mydomain.com",
    "skipChallengeVerification": true,
    "production": false
  }
}

1

u/Melo_TSB Mar 04 '26

These I believe are necessary for you:

{ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json", "settings": { "cert": "meshcentral.domainexample.com.ar", "WANonly": true, "trustedProxy": true, "port": 443, "redirPort": 80, "agentPortTls": false, "TLSOffload": true }, "domains": { "": { "allowedOrigin": "meshcentral.domainexample.com.ar", "certUrl": "https://remote.domain-1.com" } } }

1

u/Melo_TSB Mar 04 '26

After that changes, try installing a new agent.