Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

101–110 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#101

Earlier quoted context omitted.

This seems to be the license for cloudflared. But when you use cloudflared to create a tunnel via cloudflare network, aren't you also bound to Cloudflare's ToS because the software itself is useless without using the service provided by Cloudflare?

I am literally Cloudflare's CTO. I'm pretty sure I know that using Cloudflare Tunnel for SSH isn't a violation of our service.

Ah, good to know. Thanks!

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#102

Earlier quoted context omitted.

This seems to be the license for cloudflared. But when you use cloudflared to create a tunnel via cloudflare network, aren't you also bound to Cloudflare's ToS because the software itself is useless without using the service provided by Cloudflare?

I am literally Cloudflare's CTO. I'm pretty sure I know that using Cloudflare Tunnel for SSH isn't a violation of our service.

Thanks for the clarification! Might want to educate your support staff a bit more so they can provide the same clarification.

This was my assumption as well given the tutorials and such available on your site. I was confused though and so reached out for clarification.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#103
post #48

Earlier quoted context omitted.

Please explain? I've googled your sentiment and have found some links but not many answers. Breaking a contract is just as illegal (~ against the law) as breaking the law? This follows trivially from contract law being a part of law. More substantive: Both contracts and laws proscribe actions. One can find remedy for breaking either via the legal system. (Obviously the severity of punishment can differ several orders…

> This follows trivially from contract law being a part of law That does not follow trivially. Contracts themselves are not articles of contract law.

Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds.

'Illegal' ~ 'against the law'. What is doing something against the law? Doing something the law states you are not allowed to do. So in practice under continental law (Napoleonic / Germanic) a law states "do X" or "leave Y" and doing the opposite is illegal. Then, if the law states "you must (under good faith) fulfill your contract" and you do not fulfill your contract ... that's illegal. A legally binding contract has the force of law for the signing parties.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#105

Earlier quoted context omitted.

Same, zerotier on everything. Router, laptops, servers, phone. It makes things very easy to connect without public addresses.

I want to love ZeroTier, but after wanting to contribute and reading some code I decided I'd rather use another VPN tech. Not saying it isn't good, but it was very incomprehensible and didn't look modern and nice, which the product should be.

Thanks for sharing this insight, it's good to have even an inkling of how the sausage is made.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#106

> Each port is also limited to a single machine, so you'd have to choose a different port for a different machine. I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus: ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz It's a lot less work to lock down one machine…

Unfortunately it doesn't work if you're behind a NAT due to shitty ISP, like me. I use AutoSSH instead to expose my local machine's ssh port on a high port in the gateway machine: `autossh -M 0 -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -v -N -R 22222:localhost:22 user@my-vps-domain`

ServerAliveInterval 30 is important because my ISP often drop idle connections, often not even 1 minute idle. Can probably tweak it to listen to a localhost only port instead of exposing them to internet.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#107

> Question: do you use a different tool which require no maintenance or cost to run? Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it…

I tried using Zerotier a few years ago for personal devices/homenet (~10ish devices) and it frequently dropped/disconnected to the point I uninstalled. The Windows client was buggy/quirky and would get into a weird state where I couldn't click on a network to connect/disconnect properly and the app would have to be closed and client restarted before it would work properly again.

Ive since set up wireguard and use nginx for reverse proxy and haven't looked back. This has been rock solid, set and forget.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#109

Wow, that commenting system is so nice. I was looking for something like that! Amazing :) Edit: it sees https://utteranc.es/ is used.

Hey mono-bob :), it really is cool, I only added it last night. I used to use utteranc.es, but now I use https://giscus.app. It's like utterances, but allows comment threads and reactions to the page (likes/emojis).

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#110

> By the end of this post, you'll be able to run: ssh $machine_name from anywhere ... a service by Cloudflare ... will filter traffic to your machines through Cloudflare's network, including authenticating you ... your machines won't directly be exposed to threat actors and "1337 haxors". Won't they be exposed to CloudFlare? CloudFlare CEO has personally said: https://www.bizjournals.com/sanjose/news/2013/09/12/cloud…

I use an SSH key to connect, so I assumed the traffic itself is end-to-end encrypted. However, I would like to be surer of this.
Post reply on HN