Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

151–160 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#151

Post by Skunkleton »

anderspitman wrote: post #126
72deluxe wrote: post #87

Why not just run Wireguard on a raspberry pi, set up DDNS to send your home IP to a Dynamic DNS provider (if you're on a dynamic IP), and then SSH to your machines at home using keys (instead of passwords)? Setting up a Pi and running the Wireguard install script is about half an hour of work.

If you're using ddns why do you need WireGuard at all?

I use a similar setup. The VPN is needed because it is the only port accessible outside my network. Wireguard is easy to setup right, and I already need it for accessing other stuff on my home network.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#153

Post by skazazes »

anderspitman wrote: post #146
jatone wrote: post #71

Earlier quoted context omitted.

what do you mean by public channels? if I was trying to ssh into my machines it works wonderfully for dns resolution.

A core offering of Cloudflare Tunnel is the ability to host web servers through tunnels. Tailscale requires you to run your own reverse proxy on a publicly-accessible node in order to accomplish this.

This is not my experience having recently set up web servers in a cloud virtual network with no inbound ports open. I can tailscale in and connect to web servers behind traefik configured to use the dns-01 challenge. The only way to access these webaps is through tailscale.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#154

Post by anderspitman »

skazazes wrote: post #153
anderspitman wrote: post #146

Earlier quoted context omitted.

A core offering of Cloudflare Tunnel is the ability to host web servers through tunnels. Tailscale requires you to run your own reverse proxy on a publicly-accessible node in order to accomplish this.

This is not my experience having recently set up web servers in a cloud virtual network with no inbound ports open. I can tailscale in and connect to web servers behind traefik configured to use the dns-01 challenge. The only way to access these webaps is through tailscale.

Sorry I meant specifically public web servers, ie hosting a website or sharing a Jellyfin server with your family without requiring them to have Tailscale accounts.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#155

Post by jatone »

pmarreck wrote: post #147
jatone wrote: post #115

Earlier quoted context omitted.

not sure where you're getting the idea you need admin intervention for tailscale. I've never needed to do anything beyond authenticate the machine with my account. tailscale has NAT traversal built into it. If your network firewall is preventing the tunneling process, then that's on you. and if its not on you and its a company decision then its VERY unlikely they'd be okay with cloudflare's publicly exposed ports.

tailscale user here. the tailscale devices you see are only accessible by other devices on the same tailscale network. S/he's talking about accessing those machines from OUTSIDE that network. That's what would require admin intervention. So for example if I have a webserver on my home LAN that has Tailscale installed and authenticated, then sure, I can access that webserver from any of my other Tailscale devices from…

I clearly understand that problem. but I'm just going to assert its not what you actually want. nor is it related to accessing ssh where you most definitely don't want to expose the port.

for starters, what you're describing is a load balancer. those already exist and are trivial to setup.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#156

Post by jatone »

beckler wrote: post #149
jatone wrote: post #71

Earlier quoted context omitted.

what do you mean by public channels? if I was trying to ssh into my machines it works wonderfully for dns resolution.

I mean if I wanted to host a public blog on my private infrastructure, Tailscale alone isn’t going to cut it. I would have to make a instance on a cloud provider to allow public ingress, and I have to setup and configure Tailscale on it to allow it to punch a hole into my walled garden. If I just want plain VPN access to my instances from wherever, then that’s when Tailscale really shines.

you want a load balancer for that use case. not a VPN. this article is about SSH not a public blog.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#158

Post by philjohn »

anderspitman wrote: post #126
72deluxe wrote: post #87

Why not just run Wireguard on a raspberry pi, set up DDNS to send your home IP to a Dynamic DNS provider (if you're on a dynamic IP), and then SSH to your machines at home using keys (instead of passwords)? Setting up a Pi and running the Wireguard install script is about half an hour of work.

If you're using ddns why do you need WireGuard at all?

Wireguard needs an endpoint

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#159

Post by lxgr »

jgtrosh wrote: post #7
marginalia_nu wrote: post #5

> Each port is also limited to a single machine, so you'd have to choose a different port for a different machine. I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus: ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz It's a lot less work to lock down one machine…

Use -J or ProxyJump in .SSH/config for a modern equivalent

Yes, please only use this!

The big advantage of this (over ssh user@host1 ssh user@host2) is that the jump host only sees the encrypted inner connection – it doesn't get access to the client's SSH agent/keychain, nor to the target host (host2) or data transmitted over the connection.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#160

Post by samhw »

wjnc wrote: post #103
gmfawcett wrote: post #75

Earlier quoted context omitted.

> This follows trivially from contract law being a part of law That does not follow trivially. Contracts themselves are not articles of contract law.

Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds. 'Illegal' ~ 'against the law'. What is doing something against the law? Doing something the law states you are not allowed to do. So in practice under continental law (Napoleonic / Germanic) a law states "do X" or "leave Y" and doing the opposite is illegal. Then, if the law states "you must (under good faith)…

> Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds.

Of 'inheritance'? What does this mean? Are you trying to apply the rules of OOP to contract law, as if an individual contract were an instance of contract law...?

Post reply on HN