Manual setup: bring your own lab environment

You picked the manual path. Arrive at class with your own pre-built lab environment instead of using the automated launcher that deploys to a fresh AWS sandbox account. This page covers the environment used by the Cloudflare PS Bootcamp Application Security course.

The automated path (go back) is the recommended path. Building three correctly-isolated VMs with the right firewall rules, user accounts, web content, the public-api service, and SSH configuration by hand takes a couple of hours and is easy to get wrong. The manual path exists for students who cannot use a fresh AWS account. Choose this path only if you really need to.

What you need

An Ubuntu workstation, two Ubuntu origin servers, a domain, and a Cloudflare Enterprise account with the right Application Security add-ons.

An Ubuntu 24.04 LTS workstation: the client you drive every lab from. No web server runs on it.
Two Ubuntu 24.04 LTS origin servers: Origin A (primary) and Origin B (backup). Each runs the AcmeCorp website on nginx (:80) and the Node public-api (:443). Origin B is the second pool member for the Load Balancer lab. All three VMs must be on separate subnets that cannot reach each other directly.
A registered public domain that you own.
A Cloudflare Enterprise account with the Bot Management, API Shield, Advanced Certificate Manager, Load Balancing, and Advanced Rate Limiting add-ons, and that domain added as an active DNS zone on the Enterprise plan.

These add-ons enable every Application Security feature the labs use:

WAF: managed rulesets, custom rules, and rule exceptions (ships with every Enterprise zone)
Advanced Rate Limiting: rate-limit rules keyed on response code and other attributes
API Shield: endpoint discovery and management, schema validation, JWT validation, sequence analytics
Bot Management: bot score, managed and custom bot rules
Load Balancing: pools, monitors (health checks), and steering across the two origins
Advanced Certificate Manager and the SSL/TLS controls (edge certificates, origin server settings)
Page Shield / content security rules and DDoS protection

You do not need the Zero Trust Premier Bundle, Magic Transit, Magic WAN, or Email Security for this course.

Virtual machine specifications

Ubuntu 24.04 LTS workstation

The workstation is the box you run every lab command from. It needs no web server; it just needs a full toolbelt and outbound internet.

Requirement	Value
Operating system	Ubuntu 24.04 LTS (Server or Desktop)
CPU	2 vCPU minimum
RAM	2 GB minimum
Disk	20 GB minimum
Internet access	Required throughout the class. You browse proxied lab hostnames and run curl/dig/openssl against Cloudflare's edge from here.

Local user account: cloudflare with password #Savetheinternet, member of sudo, with PasswordAuthentication yes enabled in /etc/ssh/sshd_config.

Pre-installed software: curl, dig (dnsutils), openssl, jq, python3, node, docker, git, and nmap.

Ubuntu 24.04 LTS origin servers (Origin A and Origin B)

Build two Ubuntu origins with identical specs and configuration. The only behavioral differences are the identity signals covered below: Origin A reports "origin":"primary" on /status and sets X-Origin: origin-1 on the public-api; Origin B reports "origin":"backup" and sets X-Origin: origin-2. Origin B is the second pool member for the Load Balancer lab.

Requirement	Value
Operating system	Ubuntu 24.04 LTS (Server)
CPU	2 vCPU minimum
RAM	2 GB minimum
Disk	20 GB minimum
Internet access	Required. Needed to install nginx and Node, and to pull the AcmeCorp content and public-api at build time. The origin-to-origin isolation the labs assume comes from the no-route-between-subnets topology, not from blocking egress.

Local user account: cloudflare with password #Savetheinternet, member of sudo, with PasswordAuthentication yes enabled in /etc/ssh/sshd_config. Same on both origins.

Pre-installed software: nginx, Node.js (for the public-api), OpenSSH Server, OpenSSL, curl, and dig (dnsutils). Same on both origins.

Services running before class (each origin):

Service	Port	Purpose
AcmeCorp website	80/tcp	nginx serving the static AcmeCorp site. Both origins serve identical content.
`/admin`	80/tcp	nginx `location` protected with HTTP Basic auth (`admin` / `AcmeAdmin123`). Returns `401` when unauthenticated. Target for the WAF / Access exercises.
`/status`	80/tcp	nginx location returning `{"status":"healthy","origin":"primary"}` on Origin A and `{"status":"healthy","origin":"backup"}` on Origin B. The Load Balancer health check matches `"status":"healthy"` on both pool members; the `"origin"` field is the visible curl-level signal of which member served the request.
Cache-test assets	80/tcp	A few static files under a known path so the Caching lab can observe `cf-cache-status` HIT/MISS behavior.
Node public-api	443/tcp	A dependency-free Node service over self-signed TLS (use `curl -k`). Implements the lab API contract (`/status`, `/v1/orders`, `/order`, `/api/v1/auth`, `/api/v1/register`, `/api/v1/checkout`, `/api/products`, `/v1/partners`, a shadow endpoint, and a static `/openapi.json`). Sets `X-Origin`, a strict CSP, `X-Content-Type-Options: nosniff`, and a random `session-id` header.

The simplest build is a single nginx vhost on :80 with location blocks for /, /admin (Basic auth), /status (returns application/json), and the cache-test assets, plus a systemd unit that runs the Node public-api on :443 with a self-signed certificate. curl http://localhost must return the AcmeCorp homepage, curl http://localhost/status the correct JSON for that VM, curl -o /dev/null -w "%{http_code}" http://localhost/admin a 401, and curl -k https://localhost/status the public-api health JSON.

Network architecture

All three VMs must be on separate subnets with no direct route between any pair. All three VMs need outbound internet access. In the labs, all traffic to the origins flows through Cloudflare's edge (the proxied lab hostnames); the origins never talk to each other directly. If the workstation can reach the origins directly across your network, or the origins can reach each other, the labs lose their purpose.

+-------------------------+   +-------------------------+   +-------------------------+
|   Ubuntu workstation    |   |   Origin A (primary)    |   |   Origin B (backup)     |
|   Subnet A              |   |   Subnet B              |   |   Subnet C              |
|   (e.g. 10.90.0.0/24)   |   |   (e.g. 10.91.0.0/24)   |   |   (e.g. 10.92.0.0/24)   |
|   Has internet          |   |   nginx :80 + api :443  |   |   nginx :80 + api :443  |
+-------------------------+   +-------------------------+   +-------------------------+
       NO direct route between any pair. Traffic reaches the origins via Cloudflare.

For the simplest path that matches the lab guides verbatim, use workstation private IP 10.90.0.90, Origin A (primary) private IP 10.91.0.91, and Origin B (backup) private IP 10.92.0.92. If you use different IPs, substitute your actual values wherever the lab guides reference specific IPs.

Cloudflare account: what to request

Tell your Cloudflare account team or partner manager you need:

Subscription	Scope	Notes
Enterprise account	Account	Required account type. Includes WAF managed rules and custom rules.
Bot Management	Zone	Bot score, managed and custom bot rules
API Shield	Zone	Endpoint management, schema validation, JWT validation, sequences
Advanced Rate Limiting	Zone	Rate-limit rules keyed on response code and request attributes
Load Balancing	Account/Zone	Pools, health-check monitors, and steering across the two origins
Advanced Certificate Manager	Zone	Custom edge certificates and SSL/TLS controls
Enterprise DNS zone	Zone	Your registered domain added on the Enterprise plan

You must own a registered public domain and add it to the account as the Enterprise DNS zone. The labs proxy the AcmeCorp site and public-api through Cloudflare on hostnames like www.yourdomain.com and api.yourdomain.com. The domain name does not matter (a cheap TLD from any registrar works); it must be a real, publicly resolvable domain with its nameservers pointed to Cloudflare on the Enterprise plan.

The account should be provisioned but otherwise clean -- no existing WAF custom rules, rate-limit rules, API Shield operations, load balancers, or bot rules on the lab zone.

Pre-class verification checklist

Run through this a week before class. Fix anything that fails before Day 1.

Virtual machines

Workstation boots; you SSH as cloudflare / #Savetheinternet
curl, dig, openssl, jq, python3, node, docker, git, nmap all present on the workstation
Origin A boots; you SSH as cloudflare / #Savetheinternet
Origin B boots; you SSH as cloudflare / #Savetheinternet
curl http://localhost on each origin returns the AcmeCorp website HTML
curl http://localhost/status on Origin A returns {"status":"healthy","origin":"primary"}
curl http://localhost/status on Origin B returns {"status":"healthy","origin":"backup"}
curl -o /dev/null -w "%{http_code}" http://localhost/admin returns 401 on each origin
curl -k https://localhost/status on each origin returns the public-api health JSON (with X-Origin: origin-1 on A, origin-2 on B)
The workstation cannot reach either origin's private IP directly; Origin A cannot reach Origin B

Cloudflare account

Sign in to https://dash.cloudflare.com and open Account → Domains → Overview
Your lab domain shows Active status and Enterprise plan (the plan pill also shows next to the domain name once you open it)
Click the domain, then Security → Security rules loads (Custom rules, Advanced rate limiting rules, Managed rules, API JWT validation rules all listed) with no upsell
Security → Web assets (API Shield) loads with the Operations, Sequences, Schema validation, and Client-side resources tabs
Security → Settings loads with the Bot traffic / Bot management controls
Traffic → Load Balancing loads (and Health Checks is present) with no upsell
SSL/TLS → Edge Certificates loads (Advanced Certificate Manager)

FAQ

Can I use a cloud provider for the VMs?
Yes. Any platform works: cloud VMs, VMware, Hyper-V, VirtualBox. Just meet the OS version, software requirements, and network isolation.

Can two students share one Cloudflare account?
No. Each student needs their own account and lab zone. Shared zones cause rule conflicts and analytics confusion.

What if I cannot get an Enterprise account in time?
You will not be able to complete the labs. Bot Management, API Shield, Load Balancing, Advanced Rate Limiting, and Advanced Certificate Manager all require Enterprise plus the add-ons. Start the provisioning request as early as possible.

Why is the automated path the recommended path?
Because creating three correctly-isolated VMs with the right firewall rules, local user accounts, web content, the public-api service, and SSH configuration by hand takes a couple of hours and is easy to get wrong. A fresh AWS sandbox account costs a few dollars and the bootstrap script gets you to a verified starting point in under 10 minutes.