Windows - cloudflared as a service (starts on user login) for DoH don't work

[arnaud-devops]

Windows - cloudflared as a service (starts on user login) for DoH don't work

[YipYup]

When cloudflared is installed as a windows service, it wants to read the YAML file from this hardcoded location...

When running as a service, Argo Tunnel expects its configuration at C:\Windows\system32\config\systemprofile\.cloudflared\config.yml (assuming Windows is installed to C:). You can copy your local configuration from %UserProfile%\.cloudflared\config.yml.

Taken from https://developers.cloudflare.com/argo-tunnel/reference/service/

[YipYup]

I can also confirm that I have the issue described. Some attributes in my YAML file are being read, others are being ignored, despite following documented syntax.

For example, My config.yml file at C:\Windows\system32\config\systemprofile.cloudflared\ is being read. The upstream servers are being read and applied, but my local binding IP and port are not.

My config.yml

address: 127.0.0.2
port: 5353
proxy-dns: true
proxy-dns-upstream:
 - https://1.1.1.1/dns-query
 - https://1.0.0.1/dns-query
 - https://2606:4700:4700::1111/dns-query
 - https://2606:4700:4700::1001/dns-query

Here's what I'm running and seeing:

C:\Windows\System32\config\systemprofile\.cloudflared>cloudflared.exe --config config.yml
INFO[0000] Build info: {GoOS:windows GoVersion:go1.9.3 GoArch:amd64}
INFO[0000] Version 2018.11.0
INFO[0000] Flags map[config:config.yml proxy-dns:true]
INFO[0000] Adding DNS upstream                           url="https://1.1.1.1/dns-query"
INFO[0000] Adding DNS upstream                           url="https://1.0.0.1/dns-query"
INFO[0000] Adding DNS upstream                           url="https://2606:4700:4700::1111/dns-query"
INFO[0000] Adding DNS upstream                           url="https://2606:4700:4700::1001/dns-query"
INFO[0000] Starting DNS over HTTPS proxy server          addr="dns://localhost:53"
ERROINFO[0000] Cannot start the DNS over HTTPS proxy server  [error0000] cloudflared will not auto="failed to create a UDP listener: listen udp 127.0.maticallyupdate on Windows systems.0.1:53: bind: Only one usage of each socket address (protocol/network address/port) is normally permitted."
INFO[0000] Starting metrics server                       addr="127.0.0.1:55487"
ERRO[0000] Quitting due to error                         error="Cannot start the DNS over HTTPS proxy server: failed to create a UDP listener: listen udp 127.0.0.1:53: bind: Only one usage of each socket address (protocol/network address/port) is normally permitted."
INFO[0000] Metrics server stopped

You can see that it did not use the IP or port numbers in my config.yml. It is trying to use 127.0.0.1 and port 53, despite my explicit configuration of 127.0.0.2, and 5353.

A similar but unrelated bug... this is CloudFlare staff acknowledging that the --config parameter was not being obeyed. https://community.cloudflare.com/t/windows-service-multiple-tunnels/21611/4

[elig0n]

Just to make it easier for people who end up here, the solution is to either create your own custom copy of the service or use the corresponding command-line parameters (from --help if you only need proxy-dns) and append them to the registry value of ImagePath at the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cloudflared

i.e.
%FULL_PATH%\cloudflared.exe proxy-dns --address IP.IP.IP.IP --port PORT

Where %FULL_PATH% is the full path to the cloudflared.exe executable, and IP.IP.IP.IP and PORT are for the IP and port respectively.