SSH into private machines from anywhere using Cloudflare Tunnel

jgrahamc wrote: post #3

Can also use our auditable terminal so no need for an SSH client: https://blog.cloudflare.com/ssh-raspberry-pi-400-cloudflare-...

Thank you for the link.

Do you have a Cloudflare on first page of HN alert?

And will Cloudflare Tunnel stay free and included for free accounts?

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#5

Post by marginalia_nu » Thu, Feb 10, 2022, 11:18 AM UTC

> Each port is also limited to a single machine, so you'd have to choose a different port for a different machine.

I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus:

  ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz

It's a lot less work to lock down one machine really tight enough to expose them to the public Internet than to do it on the entire network.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#6

Post by jgrahamc » Thu, Feb 10, 2022, 11:19 AM UTC

punnerud wrote: post #4

jgrahamc wrote: post #3

Can also use our auditable terminal so no need for an SSH client: https://blog.cloudflare.com/ssh-raspberry-pi-400-cloudflare-...

Thank you for the link. Do you have a Cloudflare on first page of HN alert? And will Cloudflare Tunnel stay free and included for free accounts?

I have code that monitors Hacker News comments for mentions of various things (including cloudflare, my username). It runs once a minute and uses https://hn.algolia.com/ to find new comments. I actually saw this was on Hacker New via Twitter.

https://blog.cloudflare.com/tunnel-for-everyone/

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#7

Post by jgtrosh » Thu, Feb 10, 2022, 11:20 AM UTC

marginalia_nu wrote: post #5

> Each port is also limited to a single machine, so you'd have to choose a different port for a different machine. I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus: ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz It's a lot less work to lock down one machine…

Use -J or ProxyJump in .SSH/config for a modern equivalent

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#8

Post by marginalia_nu » Thu, Feb 10, 2022, 11:21 AM UTC

jgtrosh wrote: post #7

marginalia_nu wrote: post #5

> Each port is also limited to a single machine, so you'd have to choose a different port for a different machine. I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus: ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz It's a lot less work to lock down one machine…

Use -J or ProxyJump in .SSH/config for a modern equivalent

I guess my bash aliases are a bit oldfashioned :P

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#9

Post by jdrc » Thu, Feb 10, 2022, 11:22 AM UTC

Can we stop posting stuff that makes even more people give the keys of their house to the BigCorp cartel?

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#10

Post by password4321 » Thu, Feb 10, 2022, 11:22 AM UTC

> Question: do you use a different tool which require no maintenance or cost to run?

Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android

I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it.

IIRC, I tried both ZeroTier and Tailscale but at the time Tailscale did not yet have a simple setup to run as an unattended Windows service (and still does not have the equivalent for Mac). Being able to access a machine without staying logged in was table stakes so I decided Tailscale needed more time to bake.

Downsides I'm aware of:

- Less attention to their encryption implementation than the current hotness (WireGuard).

- Did not work with minimal effort from the local public library.

- Mac Activity Monitor shows unexpectedly high amounts of traffic even though I use it very rarely, it's not clear what's going on within that network. As in currently 100's of MB's I can't think of why would have passed through.

- It's 50 hosts + 1 admin per network for free, unlimited networks (unless you setup your own "controller"/proxy).

Re: access control brought up in another comment contrasting exposing only SSH vs. VPN connections, ZeroTier includes some off-puttingly complex access control configuration mechanism I will probably never look into.

Hope this detailed anecdata helps someone, I'm glad to be in a position to try to give back to the community by sharing my experience. Any other ZeroTier gotchas would be appreciated in case I have to dodge something in the future. I debated setting it up as permanent "route-all-internet-access-back-through-home-internet" VPN on my phone but was scared off by the complexity of setting up routing/bridging on the endpoint at home.