Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

141–150 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#141

Post by lftl »

yewenjie wrote: post #135

How do I achieve the following related task with minimal effort? I have a domain and VPS. I want to expose a local dev server running on my laptop to something like mydomain.xyz/something temporarily. I want to host it myself and would prefer open-source tools.

SSH into the VPS from the laptop with port-forwading:

ssh -R 8000:localhost:80 mydomain.xyz

Now you should be able to access your local laptop on port 8000 of the VPS. There are a few easy steps you can add if you want to make it a bit more ergonomic or permanent. If you don't want to use an alternate port, you can just forward the port on the VPS with iptables.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000

If you want the link to be more permanent, I'd suggest using wireguard instead of ssh. That's a little more effort, but not ridiculous.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#142

Post by anderspitman »

api wrote: post #122
anderspitman wrote: post #120

Earlier quoted context omitted.

FWIW your "decentralize until it hurts, then centralize until it works" is one of my favorite slogans, and I appreciate y'all making the effort.

It's nice to hear that someone cares about this. I feel like a lunatic howling at the moon. We think decentralization (actual decentralization) is a good thing, but it would be so easy to just run a cloud silo. Everything becomes totally straightforward and simple. I also hate the way scammy cryptocurrency shonk has sucked all the air out of the room on this topic, especially since most of "web3" is not even decentra…

It's important work. I wish we had better infrastructure for incentivizing things that are beneficial in the long term.

And don't even get me started on web3.

I went ahead and beefed up the ZT entry in the list[0] a bit.

[0]: https://github.com/anderspitman/awesome-tunneling

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#144

Post by LoveGracePeace »

morelish wrote: post #24

Personally I’m happier to use wireguard to access my network. I don’t know when I’d ever want a pure SSH tunnelling solution.

There was a Cloudflare article posted a couple of days ago, I'll post my comment which agrees with you, Wireguard and a cheap VPS are hard to beat: "Similar, I use a cheap AWS Lightsail VPS $3.50 (Lightsail has DDOS protection)-> Wireguard -> Apache Reverse Proxy mod -> my local services."

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#145

Post by anderspitman »

rank0 wrote: post #143

I feel like CF is conducting a guerrilla marketing campaign on HN. I've seen so many posts about tunnel in the past few weeks.

I think tunneling is going to be the core of the real web3 over the next 10 years, and my current primary side project is banking on it.

Imagine if you could take an old Android phone, install a Nextcloud app, do a quick OAuth2 flow to set up a tunnel, and now you have 100GB of cloud storage, sync, calendar, etc all running from a desk drawer.

Port forwarding is too hard. DNS is too hard. IPv6 is going to take another 10-100 years and people will still have to figure out how to manage firewalls.

IMO web3 is going to come by lowering the barrier of entry to self-hosting.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#146

Post by anderspitman »

jatone wrote: post #71
beckler wrote: post #39

Earlier quoted context omitted.

I love Tailscale, but it’s not really designed for public tunnels. You can do it, but you typically need to provision some kind of proxy with a static IP (most likely cloud based) to handle your public stuff.

what do you mean by public channels? if I was trying to ssh into my machines it works wonderfully for dns resolution.

A core offering of Cloudflare Tunnel is the ability to host web servers through tunnels. Tailscale requires you to run your own reverse proxy on a publicly-accessible node in order to accomplish this.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#147

Post by pmarreck »

jatone wrote: post #115
password4321 wrote: post #85

Earlier quoted context omitted.

Cloudflare tunnels expose ports publicly. Tailscale must be properly configured on your client machine to access machines/ports on their respective private Tailscale network(s), setup of which typically requires administrative intervention. Without bridging to a public network, services exposed to the Tailscale network are not accessible publicly. Tailscale does offer user-mode clients so it can be used similarly to…

not sure where you're getting the idea you need admin intervention for tailscale. I've never needed to do anything beyond authenticate the machine with my account. tailscale has NAT traversal built into it. If your network firewall is preventing the tunneling process, then that's on you. and if its not on you and its a company decision then its VERY unlikely they'd be okay with cloudflare's publicly exposed ports.

tailscale user here.

the tailscale devices you see are only accessible by other devices on the same tailscale network.

S/he's talking about accessing those machines from OUTSIDE that network. That's what would require admin intervention. So for example if I have a webserver on my home LAN that has Tailscale installed and authenticated, then sure, I can access that webserver from any of my other Tailscale devices from anywhere. But if I want a friend to be able to access that webserver without first being authenticated to the Tailscale network... Do you see the problem, yet?

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#148

Post by throw3838 »

square_usual wrote: post #50
throw3838 wrote: post #46

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

If they upgrade to premium tier, set up your virtual server then. Your total cost, $0 for the duration it's free + $4 * the rest is still lower than $4 * lifetime, and the cost for switching is only going to be marginal.

I can use virtual server for many things (backup, vpn, webservices...) not just port forwarding.

Cost of my time for reading contract and learning new proprietary tool is not worth it for several years.

Cloudflare is arguably better from big tech. But cost of deployment some binary package on confidential server, keeping up with their marketing bs, etc is simply not worth it.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#149

Post by beckler »

jatone wrote: post #71
beckler wrote: post #39

Earlier quoted context omitted.

I love Tailscale, but it’s not really designed for public tunnels. You can do it, but you typically need to provision some kind of proxy with a static IP (most likely cloud based) to handle your public stuff.

what do you mean by public channels? if I was trying to ssh into my machines it works wonderfully for dns resolution.

I mean if I wanted to host a public blog on my private infrastructure, Tailscale alone isn’t going to cut it. I would have to make a instance on a cloud provider to allow public ingress, and I have to setup and configure Tailscale on it to allow it to punch a hole into my walled garden. If I just want plain VPN access to my instances from wherever, then that’s when Tailscale really shines.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#150

Post by pmarreck »

jdrc wrote: post #9

Can we stop posting stuff that makes even more people give the keys of their house to the BigCorp cartel?

Sure. Just make IPv6 work everywhere flawlessly, and then all of our devices can easily access all of our other devices, we can use whatever DNS scheme we want to return the IPv6 addresses to those devices, and then we won't need to punch through NAT firewalls and routers to reflect off corp-owned servers just to access machines trapped behind NAT firewalls! What could possibly go wrong?
Post reply on HN