Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

171–180 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#171

Post by iakov »

i_am_mike wrote: post #169

No one uses Nebula [1] developed by Slack? > Nebula is a mutually authenticated peer-to-peer software defined network based on the Noise Protocol Framework. It's self-hosted and I think it's a great alternative to ZeroTier, or Tailscale. I believe its been powering Slack's overlay network for ~5+ years. [1]: https://github.com/slackhq/nebula

I used it for a while, but found it to be unreliable. Sometimes my Raspberry Pi’s became unavailable through the nebula network. I had to ssh into the Raspberry from home network and restart the nebula service. This happened once a week or so on Zero W, so I tried Tailscale. It was much easier to set up than Nebula and works better for me so far (3 months).

YMMV, of course.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#172

Post by aaaaaaaaata »

neurostimulant wrote: post #97
password4321 wrote: post #10

> Question: do you use a different tool which require no maintenance or cost to run? Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it…

I also use ZeroTier for a few years now. Very useful. Unfortunately my current ISP use NAT instead of giving their subscribers routable ip address. This means ZeroTier reverts to using an external relay when accessing my machine from outside, which is very slow and has very high latency from my country. So in addition to ZeroTier, I use AutoSSH [1] to setup and maintain a persistent ssh tunnel on a high port on my vp…

What about mosh?

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#173

Post by jatone »

password4321 wrote: post #163
jatone wrote: post #115

Earlier quoted context omitted.

not sure where you're getting the idea you need admin intervention for tailscale. I've never needed to do anything beyond authenticate the machine with my account. tailscale has NAT traversal built into it. If your network firewall is preventing the tunneling process, then that's on you. and if its not on you and its a company decision then its VERY unlikely they'd be okay with cloudflare's publicly exposed ports.

I'm talking about the one-time initial setup of the Tailscale client software. Can you download and run Tailscale on a Windows client without Administrative access to install the software (setup the virtual NIC)? An SSH client is just a user-space app.

no but you also wouldn't want to allow that. just like you wouldn't want to expose a SSH socket to the world in most cases.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#174

Post by Jenda_ »

perakojotgenije wrote: post #49

shameless self-promotion: https://sshreach.me We have a ssh reverse-forwarding based solution. And unlike the Cloudflare solution you don't need to "give the keys of your house" (as someone here commented) to reach your private machines. You can remotely open and close the tunnels through our web interface or our web API. Plus, we have web API-based automated deployment solution if you have many clients.

This seems to be a cool service, I was actually thinking of creating something similar (but was deterred by the hassle of setting up billing and user management apart from the interesting technical stuff). I sometimes get asked by someone not owning a server/account they can use for ssh -R 0.0.0.0:1234:localhost:22, who are behind NAT and need to publish some service on the internet.

Why is the traffic rather limited? You seem to be hosting it on Linode and they offer like $5/TB traffic, I think you could easily offer several times more traffic, at least with the bigger plans.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#175

Post by hashimotonomora »

samhw wrote: post #160
wjnc wrote: post #103

Earlier quoted context omitted.

Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds. 'Illegal' ~ 'against the law'. What is doing something against the law? Doing something the law states you are not allowed to do. So in practice under continental law (Napoleonic / Germanic) a law states "do X" or "leave Y" and doing the opposite is illegal. Then, if the law states "you must (under good faith)…

> Contracts themselves are not articles of contract law. - This is true, but the concept of inheritance holds. Of 'inheritance'? What does this mean? Are you trying to apply the rules of OOP to contract law, as if an individual contract were an instance of contract law...?

In civil law countries, a contract is the law between parties.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#176

Post by Jenda_ »

lftl wrote: post #141
yewenjie wrote: post #135

How do I achieve the following related task with minimal effort? I have a domain and VPS. I want to expose a local dev server running on my laptop to something like mydomain.xyz/something temporarily. I want to host it myself and would prefer open-source tools.

SSH into the VPS from the laptop with port-forwading: ssh -R 8000:localhost:80 mydomain.xyz Now you should be able to access your local laptop on port 8000 of the VPS. There are a few easy steps you can add if you want to make it a bit more ergonomic or permanent. If you don't want to use an alternate port, you can just forward the port on the VPS with iptables. iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80…

You can directly expose the port to the internet, not only localhost, with ssh:

- put "GatewayPorts clientspecified" into /etc/ssh/sshd_config, restart sshd

- ssh -R 0.0.0.0:8000:localhost:80 (the first parameter is the address where the tunnel should listen -- you can also pass something like 192.168.0.123 and expose it only to LAN etc.)

It's then reachable on your_vps:8000.

If you need it on the "correct" port and you are already running some other webserver (so you need to share that port), you need to set up a reverse proxy based on hostname or URL. I personally use haproxy, but for example nginx can do it too.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#177

Post by Jenda_ »

vdfs wrote: post #59
throw3838 wrote: post #46

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

Why use a virtual server if you want to connect to your home network?

Because in some countries, like .cz, it is pretty common that your home network is behind NAT, the ISP does not want to forward a port for you, and there is either no option to get a public IP or it costs $5 to $10/month and is a lengthy process to obtain (typical internet connection costs $20 to $30/month here).

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#178

Post by freedomben »

lizknope wrote: post #114
throw3838 wrote: post #46

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

My virtual server is $1.67 a month (buyvm.net) My home firewall blocks all traffic except for incoming SSH from 3 IP addresses in the world. One of those is my virtual server. If I'm in a hotel with my laptop I run the first command to set up an SSH tunnel to my "home" computer through the cloud virtual server. That listens on my laptop to port 8888 and forwards it through the cloud virtual server to my home computer…

I do the same thing! I'm hoping that some day hotels won't send every wireguard packet they see straight to the bit bucket. Until then I'm really grateful for ssh.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#179

Post by freedomben »

square_usual wrote: post #50
throw3838 wrote: post #46

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

If they upgrade to premium tier, set up your virtual server then. Your total cost, $0 for the duration it's free + $4 * the rest is still lower than $4 * lifetime, and the cost for switching is only going to be marginal.

If I have to spend an hour or two setting up each solution, I could pay $4 a month many years before I'd feel like it was worth doing that twice. You're not wrong, but I would gladly pay the monthly to only have to set it up once.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#180

Post by freedomben »

nexuist wrote: post #118
throw3838 wrote: post #46

You can get virtual server for $4/month. Installing proprietary software and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

You can build a physical server for $500 once. Relying on proprietary hardware and registering to some service, that may "upgrade" to premium tier anytime, is pretty off-putting.

not trying to be difficult, but $500 seems like an odd price tier to end up in. If I was going cheap, I'd do something between a rock64/raspberry pi and an Intel Nuc. If I was going powerful, it would be north of $1,500 for sure. That decision would probably be based on what I was running on it. If it's a VPN, the rock64 would be plenty. < $50
Post reply on HN