Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tunnelmole, an ngrok alternative (open source)

softwareengineeringstandard.com

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Tunnelmole, an ngrok alternative (open source)

#61

Post by apitman »

jszymborski wrote: post #55
apitman wrote: post #8

I maintain a list of similar tools here: https://github.com/anderspitman/awesome-tunneling I'm not sure there's a single class of software that's been implemented more times than ngrok-style tunneling. I keep finding more and more. Honestly it's a really fun exercise. Fairly challenging, but well within the reach of a single developer. I believe I'm currently working on my 5th incarnation.

I used your list recently, thanks! Ended up using boringproxy for my case.

Glad you found it useful. boringproxy fills a pretty nice niche, but it has some rough edges. I'm working on its successor now.

Re: Tunnelmole, an ngrok alternative (open source)

#62

Post by pavon »

ctrw wrote: post #51
Banditoz wrote: post #41

Earlier quoted context omitted.

Dynamic DNS is a good alternative. A free one I like is https://www.duckdns.org/

Or just doing a bit of research on which ISP provides static ips with the ability to serve continent. Not everything has to be Google scale.

Most of them require you upgrading to a business account, and are generally quite a bit more expensive than standard residential internet service plus a VPS.

Re: Tunnelmole, an ngrok alternative (open source)

#63

Post by aussieguy1234 »

Banditoz wrote: post #41
ctrw wrote: post #36

Or hire a static ip and expose whatever ports you feel like. Its amazing how far we've fallen from the internet of the 90s when you could get this done on most ISPs with all of a phone call.

Dynamic DNS is a good alternative. A free one I like is https://www.duckdns.org/

I used to do this. It requires configuring your router to set up port forwarding. That's assuming you have access to your router.

Re: Tunnelmole, an ngrok alternative (open source)

#64

Post by aussieguy1234 »

apitman wrote: post #60
aussieguy1234 wrote: post #22

Earlier quoted context omitted.

In the early days there where several attempts to use Tunnelmole for phishing. When you think about it, a service that hides your IP under a domain that is not yours means you can do whatever you want without risking your own server or domain being taken down for abuse, instead risking my server. So I added code to forward an X-Forwarded-For header, which contains the real IP address of the client. Also random URLs h…

I know what the X-Forwarded-For is, but I'm confused by what you mean here. Can you go into a bit more detail as to what you implemented and how it prevents phishing?

It's a header that contains the IP address of the machine that ran the Tunnelmole client, which ensures it can't be used anonymously. My theory here is that phishers and other nefarious actors are attracted to this type of service so they can hide their origin server.

I haven't had alot of phishing issues since introducing that header and the IP address in random domains.

I'll see if I can get tunnelmole.net added to that public suffix list.

One reason tunnels go through tunnelmole.net instead of tunnelmole.com is to protect the reputation of the main domain.

Re: Tunnelmole, an ngrok alternative (open source)

#65

Post by CGamesPlay »

apitman wrote: post #56
CGamesPlay wrote: post #38

Is there any stand-alone open source version of the VS Code port forwarder? That’s what I really want. Not so much public access, just local access to ports on the remote machine that I can easily manage. SSH port forwards don’t work inside docker dev environments (and docker containers have to be rebuilt to export new ports natively), so some extra software is needed.

I haven't tried vscode forwarding. What features does it have that are missing from most of the options on the list[0]? If you want a nice GUI for remote managing maybe check out one of my tools, boringproxy [0]: https://github.com/anderspitman/awesome-tunneling

I've got your list saved in my notes :) The main thing is many of these are, well, ngrok alternatives: put my localhost on the internet. I am looking for something that puts remote ports into my local machine, and in particular which don't require configuring network interfaces (insecure to do in Docker containers) and don't require a centralized control plane.

Re: Tunnelmole, an ngrok alternative (open source)

#66

Post by apitman »

CGamesPlay wrote: post #65
apitman wrote: post #56

Earlier quoted context omitted.

I haven't tried vscode forwarding. What features does it have that are missing from most of the options on the list[0]? If you want a nice GUI for remote managing maybe check out one of my tools, boringproxy [0]: https://github.com/anderspitman/awesome-tunneling

I've got your list saved in my notes :) The main thing is many of these are, well, ngrok alternatives: put my localhost on the internet. I am looking for something that puts remote ports into my local machine, and in particular which don't require configuring network interfaces (insecure to do in Docker containers) and don't require a centralized control plane.

Ah interesting. What's a typical use case for something like this? I could probably thing of a couple but I'm curious what people actually use it for.

Re: Tunnelmole, an ngrok alternative (open source)

#67

Post by apitman »

aussieguy1234 wrote: post #64
apitman wrote: post #60

Earlier quoted context omitted.

I know what the X-Forwarded-For is, but I'm confused by what you mean here. Can you go into a bit more detail as to what you implemented and how it prevents phishing?

It's a header that contains the IP address of the machine that ran the Tunnelmole client, which ensures it can't be used anonymously. My theory here is that phishers and other nefarious actors are attracted to this type of service so they can hide their origin server. I haven't had alot of phishing issues since introducing that header and the IP address in random domains. I'll see if I can get tunnelmole.net added to…

Interesting. I see what you mean by the random domains now. Creative idea!

> One reason tunnels go through tunnelmole.net instead of tunnelmole.com is to protect the reputation of the main domain.

Definitely recommend you keep it that way. There's not saying what various orgs will do. I believe at one point Facebook messenger blocked links to .xyz TLD domains entirely. Maybe they still do.

Re: Tunnelmole, an ngrok alternative (open source)

#68

Post by CGamesPlay »

apitman wrote: post #66
CGamesPlay wrote: post #65

Earlier quoted context omitted.

I've got your list saved in my notes :) The main thing is many of these are, well, ngrok alternatives: put my localhost on the internet. I am looking for something that puts remote ports into my local machine, and in particular which don't require configuring network interfaces (insecure to do in Docker containers) and don't require a centralized control plane.

Ah interesting. What's a typical use case for something like this? I could probably thing of a couple but I'm curious what people actually use it for.

Devcontainers in Docker. With Docker, you cannot add a port forward to an existing container; you have to rebuild the container. With devcontainers, this at a minimum requires a few minutes of rebuilding time (an excessive price to pay for changing a port forward).

Re: Tunnelmole, an ngrok alternative (open source)

#69

Post by apitman »

CGamesPlay wrote: post #68
apitman wrote: post #66

Earlier quoted context omitted.

Ah interesting. What's a typical use case for something like this? I could probably thing of a couple but I'm curious what people actually use it for.

Devcontainers in Docker. With Docker, you cannot add a port forward to an existing container; you have to rebuild the container. With devcontainers, this at a minimum requires a few minutes of rebuilding time (an excessive price to pay for changing a port forward).

So you have a devcontainer running on your local machine, and you start up a service inside it and want to access it from outside?

Re: Tunnelmole, an ngrok alternative (open source)

#70

Post by aborsy »

apitman wrote: post #53
aborsy wrote: post #45

Earlier quoted context omitted.

I still haven’t found an ideal solution, despite a variety of options. Cloudflare tunnels are good, but Cloudflare terminates TLS certificates, and scans the traffic. People host on premise for privacy, which is moot if using Cloudflare. FRP is simple and works, but it takes inbound traffic from open Internet. A vulnerability in it could compromise your environment. The transport encryption is customized (probably us…

Can you clarify what you mean by inbound vs outbound? Pretty much all of these tools work the same way. You have a machine (usually a VPS) with a public IP address that runs the server, you connect to it with a client, and it tunnels traffic sent to the server to the client and other machines that would otherwise only be visible to the client. There are several options on the list that do e2ee, including commercial s…

Yes, sorry, I was sloppy in my comment. I meant, say in the case of Cloudflare or Tailscale, I don’t need to open any ports, or operate any server. The server, its firewall and security are outsourced to those companies. They take care of configuring and securing the internet-facing component. The clients make outbound connections, and the company takes care of handling inbound.

This is similar to running your own VPN server, vs using what’s called zero trust network access with services provided by companies such as Cloudflare.

Cloudflare tunnels are simple, robust and include a range of features: various authentication options, a secure internet-facing webpage in Cloudflare Access, DDoS mitigation, IP hiding, DNS and domain setup, etc . If they don’t decrypt and scan the traffic, that’s how an ideal solution would look like.

Post reply on HN