Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

81–90 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#81

Post by mistrial9 »

TownLake wrote: post #33
pabs3 wrote: post #14

Unfortunately the cloudflared software, while the source is available on GitHub, and there are pull requests open and accepted for it, is not under an open source license, and the license it is under does not allow modifications, so any modifications (including the aformentioned pull requests) are contrary to the license and thus copyright law and thus illegal. The issue I filed about this is still waiting for action…

Hello from the Cloudflare team - thanks for the nudge. We're in the process of migrating away from the proprietary license to an Apache license. We'll update the GitHub issue too; should be wrapped up in the next couple of weeks but likely sooner.

everyone believes that statement because?

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#82

Post by zikduruqe »

password4321 wrote: post #10

> Question: do you use a different tool which require no maintenance or cost to run? Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it…

> Question: do you use a different tool which require no maintenance or cost to run?

I run Wireguard, Tailscale and Yggdrasil on my home network.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#83

Post by jgrahamc »

codingpanic wrote: post #79

I'm under the impression that this is against CloudFlare's ToS, otherwise I'd probably be doing it myself. See section 2.8 "Limitation on Serving Non-HTML Content." of their subscriber agreement: use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our S…

That's for Cloudflare's CDN/reverse-proxy service.

This is the correct one for Cloudflare Tunnel: https://developers.cloudflare.com/cloudflare-one/connections...

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#84

Post by jgrahamc »

mistrial9 wrote: post #81
TownLake wrote: post #33

Earlier quoted context omitted.

Hello from the Cloudflare team - thanks for the nudge. We're in the process of migrating away from the proprietary license to an Apache license. We'll update the GitHub issue too; should be wrapped up in the next couple of weeks but likely sooner.

everyone believes that statement because?

Because in two weeks time if it's not done you can come back here and yell at me.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#85

Post by password4321 »

jatone wrote: post #71
beckler wrote: post #39

Earlier quoted context omitted.

I love Tailscale, but it’s not really designed for public tunnels. You can do it, but you typically need to provision some kind of proxy with a static IP (most likely cloud based) to handle your public stuff.

what do you mean by public channels? if I was trying to ssh into my machines it works wonderfully for dns resolution.

Cloudflare tunnels expose ports publicly.

Tailscale must be properly configured on your client machine to access machines/ports on their respective private Tailscale network(s), setup of which typically requires administrative intervention. Without bridging to a public network, services exposed to the Tailscale network are not accessible publicly.

Tailscale does offer user-mode clients so it can be used similarly to SSH by those allowed to connect (I don't know how difficult user-mode Tailscale is without admin setup on various operating systems).

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#86

Post by robbomacrae »

codingpanic wrote: post #79

I'm under the impression that this is against CloudFlare's ToS, otherwise I'd probably be doing it myself. See section 2.8 "Limitation on Serving Non-HTML Content." of their subscriber agreement: use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our S…

It was strange reading this comment on Hacker News..

You will also find comments from CloudFlare folks here which suggests this use-case is sanctified.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#87

Post by 72deluxe »

Why not just run Wireguard on a raspberry pi, set up DDNS to send your home IP to a Dynamic DNS provider (if you're on a dynamic IP), and then SSH to your machines at home using keys (instead of passwords)?

Setting up a Pi and running the Wireguard install script is about half an hour of work.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#88

Post by lillecarl »

viraptor wrote: post #21
password4321 wrote: post #10

> Question: do you use a different tool which require no maintenance or cost to run? Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it…

Same, zerotier on everything. Router, laptops, servers, phone. It makes things very easy to connect without public addresses.

I want to love ZeroTier, but after wanting to contribute and reading some code I decided I'd rather use another VPN tech. Not saying it isn't good, but it was very incomprehensible and didn't look modern and nice, which the product should be.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#89

Post by jgrahamc »

girvo wrote: post #61
jgrahamc wrote: post #6

Earlier quoted context omitted.

I have code that monitors Hacker News comments for mentions of various things (including cloudflare, my username). It runs once a minute and uses https://hn.algolia.com/ to find new comments. I actually saw this was on Hacker New via Twitter. https://blog.cloudflare.com/tunnel-for-everyone/

Genuine question; I’ve got a static IP (v4) to my only server that I run at home. Are there any real benefits I gain to using tools like this one (or Tailscale et al)?

No firewall holes.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#90

Post by api »

password4321 wrote: post #57
api wrote: post #54

Earlier quoted context omitted.

The crypto part of ZeroTier is getting some love soon but we are taking our time to get it right and get peer review. Implementing ideas from WireGuard and Signal. Also the pricing is for our controller SaaS. If you want to self host controllers you can for free. There is a free community developed control panel somewhere.

Managing expectations re:v2 is not going well for me. I wasn't really aware WireGuard-ish crypto improvements were happening (hire the personalities™ freelance ASAP or at least for review), and timeline is basically a punchline at this point... I recommend just owning both (edit: start today!) as 'when it's finished' on the front page if you want to appeal to techs. I updated re:free, thanks. Their appear to be two (…

Managing expectations re:v2 has been a total failure on our part. We put far too many things in one basket. But the work is still happening.

Learning moment for us: don't give timelines and don't reveal too much. Just say "when it's finished." Only Elon Musk can use Elon Time(tm). :)

Edit: we also promised some things that are just brutally hard, like fully decentralizing the root backplane via full data set replication. We are still working on that but it proved tougher than we originally thought, especially in light of scaling needs and security concerns. Some interesting technology in development but still in private repos.

Our competition just builds SaaS with a single controller run by a single entity. That's easy. We make it hard on ourselves by trying to keep going on the decentralization and control your own security boundary mission. Part of why everything is getting centralized into silos is that that's just so easy to engineer.

Post reply on HN