Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

161–170 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#161

Post by taftster »

trinovantes wrote: post #80
marginalia_nu wrote: post #5

> Each port is also limited to a single machine, so you'd have to choose a different port for a different machine. I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus: ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz It's a lot less work to lock down one machine…

I use this alias in my .ssh/config to connect through a gateway machine: Host myserver User user ProxyCommand ssh -q public-server nc -q0 private-server 22 I can't remember what these flags actually do but they seem to get the job done

ProxyJump is slightly preferred in modern SSH. Does what you're doing, but with simpler syntax. Take a look.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#162

Post by anderspitman »

philjohn wrote: post #158
anderspitman wrote: post #126

Earlier quoted context omitted.

If you're using ddns why do you need WireGuard at all?

Wireguard needs an endpoint

If I understand GP correctly, the goal is to SSH into an RPi on a home network. Since they mention DDNS, it's implied that they're connecting directly to their home router. What I'm saying is why not port forward directly to the RPi?

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#163

Post by password4321 »

jatone wrote: post #115
password4321 wrote: post #85

Earlier quoted context omitted.

Cloudflare tunnels expose ports publicly. Tailscale must be properly configured on your client machine to access machines/ports on their respective private Tailscale network(s), setup of which typically requires administrative intervention. Without bridging to a public network, services exposed to the Tailscale network are not accessible publicly. Tailscale does offer user-mode clients so it can be used similarly to…

not sure where you're getting the idea you need admin intervention for tailscale. I've never needed to do anything beyond authenticate the machine with my account. tailscale has NAT traversal built into it. If your network firewall is preventing the tunneling process, then that's on you. and if its not on you and its a company decision then its VERY unlikely they'd be okay with cloudflare's publicly exposed ports.

I'm talking about the one-time initial setup of the Tailscale client software.

Can you download and run Tailscale on a Windows client without Administrative access to install the software (setup the virtual NIC)? An SSH client is just a user-space app.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#164

Post by leaded_syrinx »

api wrote: post #54
password4321 wrote: post #10

> Question: do you use a different tool which require no maintenance or cost to run? Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it…

The crypto part of ZeroTier is getting some love soon but we are taking our time to get it right and get peer review. Implementing ideas from WireGuard and Signal. Also the pricing is for our controller SaaS. If you want to self host controllers you can for free. There is a free community developed control panel somewhere.

Please add webhooks for ZeroTier network endpoints coming online or going offline! I think some existing formal feature requests for this already exist?

Absolutely love ZeroTier!

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#165

Post by rank0 »

anderspitman wrote: post #145
rank0 wrote: post #143

I feel like CF is conducting a guerrilla marketing campaign on HN. I've seen so many posts about tunnel in the past few weeks.

I think tunneling is going to be the core of the real web3 over the next 10 years, and my current primary side project is banking on it. Imagine if you could take an old Android phone, install a Nextcloud app, do a quick OAuth2 flow to set up a tunnel, and now you have 100GB of cloud storage, sync, calendar, etc all running from a desk drawer. Port forwarding is too hard. DNS is too hard. IPv6 is going to take anothe…

I actually am familiar with takingnames.io and boring proxy! I found it the other day when I was searching for the easiest way to self-host my own side project. I think you've got something promising and I encourage you to keep working on it. Ultimately, for my use case I went with fly.io just because it was so damn easy to use.

I am hesitant to commit to a tunnel-based approach because where I live I get frequent power/internet outages. I feel that tunneling is something I would explore if my application grows to the point where I would need to rent space in a colocation.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#166

Post by password4321 »

leaded_syrinx wrote: post #164
api wrote: post #54

Earlier quoted context omitted.

The crypto part of ZeroTier is getting some love soon but we are taking our time to get it right and get peer review. Implementing ideas from WireGuard and Signal. Also the pricing is for our controller SaaS. If you want to self host controllers you can for free. There is a free community developed control panel somewhere.

Please add webhooks for ZeroTier network endpoints coming online or going offline! I think some existing formal feature requests for this already exist? Absolutely love ZeroTier!

https://github.com/zerotier/ZeroTierOne/issues/1143

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#167

Post by anderspitman »

rank0 wrote: post #165
anderspitman wrote: post #145

Earlier quoted context omitted.

I think tunneling is going to be the core of the real web3 over the next 10 years, and my current primary side project is banking on it. Imagine if you could take an old Android phone, install a Nextcloud app, do a quick OAuth2 flow to set up a tunnel, and now you have 100GB of cloud storage, sync, calendar, etc all running from a desk drawer. Port forwarding is too hard. DNS is too hard. IPv6 is going to take anothe…

I actually am familiar with takingnames.io and boring proxy! I found it the other day when I was searching for the easiest way to self-host my own side project. I think you've got something promising and I encourage you to keep working on it. Ultimately, for my use case I went with fly.io just because it was so damn easy to use. I am hesitant to commit to a tunnel-based approach because where I live I get frequent po…

Right on. fly.io is awesome.

I don't think tunneling is necessarily a great for hosting large-scale things or businesses that need to stay online 24/7. Self-hosted services for friends and family or maybe small communities seems like the best use case.

It's annoying but ok if your media server goes down once in a while.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#168

Post by gen220 »

morelish wrote: post #24

Personally I’m happier to use wireguard to access my network. I don’t know when I’d ever want a pure SSH tunnelling solution.

Wireguard, with dynamically-updated DNS resolution to a residential IP is very solid for a free tier and has the key benefit of zero third-party (i.e. not controlled by you) dependencies, other than the IP provider and the DNS resolver, which is a commodities business with low switching costs. Cloudflare is very nice and will be around for a long time, but it's still a third party dependency.

As it boils down, the OP's solution is "free" as in money but not as in freedom for a certain set of requirements.

Basically, going with CF trades-off some freedom for the considerable/legitimate protection benefits of being under the "cloudflare umbrella". It's probably a good trade for this moment in time. But rational people can disagree about whether it's a good trade when you broaden the time horizon to 5, 10, etc. years.

Like all things, it depends on the requirements you're building for.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#169

Post by i_am_mike »

No one uses Nebula [1] developed by Slack?

> Nebula is a mutually authenticated peer-to-peer software defined network based on the Noise Protocol Framework.

It's self-hosted and I think it's a great alternative to ZeroTier, or Tailscale.

I believe its been powering Slack's overlay network for ~5+ years.

[1]: https://github.com/slackhq/nebula

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#170

Post by hotpotamus »

drawfloat wrote: post #139
hotpotamus wrote: post #47

Earlier quoted context omitted.

You mean, like just login to a server without going through layers of cloud providers? How would that work? For real, I can't imagine running a straight port 22 ssh service on the modern internet, but I'm usually happy just moving it to an unprivileged port for obscurity on personal equipment (plus some other common sense hardening of course). For work stuff, I'd feel naked without some sort of VPN and it seems that'…

With passwords disabled and just using key authentication, is there a big risk of just doing a straight port 22 ssh? Genuine question, my knowledge of server security is low-to-middle.

I've seen servers get hit with so many ssh login attempts that it runs out of resources to respond, effectively DOSing ssh at least. Moving it to a high port usually cuts out all the chatter.
Post reply on HN