Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

121–130 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#121

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

You can also get a domain name for $4/year and completely own your content, but nobody does that either.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#122
post #90

Earlier quoted context omitted.

Managing expectations re:v2 has been a total failure on our part. We put far too many things in one basket. But the work is still happening. Learning moment for us: don't give timelines and don't reveal too much. Just say "when it's finished." Only Elon Musk can use Elon Time(tm). :) Edit: we also promised some things that are just brutally hard, like fully decentralizing the root backplane via full data set replicat…

FWIW your "decentralize until it hurts, then centralize until it works" is one of my favorite slogans, and I appreciate y'all making the effort.

It's nice to hear that someone cares about this. I feel like a lunatic howling at the moon. We think decentralization (actual decentralization) is a good thing, but it would be so easy to just run a cloud silo. Everything becomes totally straightforward and simple.

I also hate the way scammy cryptocurrency shonk has sucked all the air out of the room on this topic, especially since most of "web3" is not even decentralized. Most of it goes through a few companies' centralized hubs. Total hot air. I'm thinking about trying to coin a new term for actual decentralization.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#123

Earlier quoted context omitted.

This seems to be the license for cloudflared. But when you use cloudflared to create a tunnel via cloudflare network, aren't you also bound to Cloudflare's ToS because the software itself is useless without using the service provided by Cloudflare?

I am literally Cloudflare's CTO. I'm pretty sure I know that using Cloudflare Tunnel for SSH isn't a violation of our service.

Nobody thought you were figuratively cloudflares CTO.

“I’m literally never going to stop misusing this word.”

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#124
post #9

Can we stop posting stuff that makes even more people give the keys of their house to the BigCorp cartel?

Why is it always the free software people who are the most judgemental about what I do with my software and who I trust with my time and money? AWS and Microsoft never gave a shit about what other vendors I'm in bed with. I like your GNU license, I do not like your GNU license people.

The crazy thing the OSS people have been right about the invasion of privacy and money grab of the modern internet.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#125

Earlier quoted context omitted.

This seems to be the license for cloudflared. But when you use cloudflared to create a tunnel via cloudflare network, aren't you also bound to Cloudflare's ToS because the software itself is useless without using the service provided by Cloudflare?

I am literally Cloudflare's CTO. I'm pretty sure I know that using Cloudflare Tunnel for SSH isn't a violation of our service.

Hold up. I follow this space closely (I maintain the list of tunneling tools linked in OP). Everybody I've communicated with has been operating under the assumption that section 2.8 applies to Cloudflare Tunnel. See for example my post on another thread yesterday [0]. Are you saying this isn't the case? Is it even possible to use Tunnel without going through the CDN?

[0]: https://news.ycombinator.com/item?id=30259902

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#126

Why not just run Wireguard on a raspberry pi, set up DDNS to send your home IP to a Dynamic DNS provider (if you're on a dynamic IP), and then SSH to your machines at home using keys (instead of passwords)? Setting up a Pi and running the Wireguard install script is about half an hour of work.

If you're using ddns why do you need WireGuard at all?

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#127
post #76

shameless self-promotion: https://sshreach.me We have a ssh reverse-forwarding based solution. And unlike the Cloudflare solution you don't need to "give the keys of your house" (as someone here commented) to reach your private machines. You can remotely open and close the tunnels through our web interface or our web API. Plus, we have web API-based automated deployment solution if you have many clients.

“Your server creates a forwarding ssh tunnel to one of our publicly visible forwarding servers” seems like a huge risk for somebody else to own these “forwarding servers”. Worse than giving keys to your house? I dunno.

Your internal computer is still protected by password and/or public/private key-pairs, so even when the tunnel is open nobody can enter your computer without having those.

It is _your_ computer that makes connection to our servers, so you are in control of everything and there is literally nothing on our forwarding servers that would allow anybody to enter your computer.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#128

Personally I’m happier to use wireguard to access my network. I don’t know when I’d ever want a pure SSH tunnelling solution.

Cloudflare Tunnel uses Wireguard under the hood.

I believe they use WireGuard internally but the client connections are terminated over HTTP/2 frames, with QUIC support in the works.

https://blog.cloudflare.com/getting-cloudflare-tunnels-to-co...

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#129

I'm under the impression that this is against CloudFlare's ToS, otherwise I'd probably be doing it myself. See section 2.8 "Limitation on Serving Non-HTML Content." of their subscriber agreement: use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our S…

That's for Cloudflare's CDN/reverse-proxy service. This is the correct one for Cloudflare Tunnel: https://developers.cloudflare.com/cloudflare-one/connections...

It's not clear to me what is allowed. Would I risk a termination if I used the service to proxy ~500 GB per month of video content?

(I'm looking for a way to get around bad traffic shaping I get in the afternoon between two locations streaming live TV.)

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#130

Personally I’m happier to use wireguard to access my network. I don’t know when I’d ever want a pure SSH tunnelling solution.

WireGuard is great and is not too difficult to setup on something like a RPi. I have one running on my home network which lets me access my local network remotely, including access to my local media server. I have another one running at my parents' house for times when I need to RDS into their windows machines for troubleshooting, or if I need to tweak settings on their router. You can also configure your clients (phone, laptop) to forward all traffic through the tunnel, which then secures your connection for when you're over an untrusted/public wifi.
Post reply on HN