Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

github.com

Post reply on HN
Print view View original

51–60 of 132 posts

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#51

Post by dizhn »

djlameche wrote: post #29

Sorry if this is a noobish question, but would this allow me to access services on a VPS, that I do not want publicly accessible on the internet? In other words: Let's say I have a VPS with eg. Keycloak running on it. I want to be able to access it for management purposes but don't want it exposed to other people on the internet. Would Pangolin be a way for me to do this?

Don't you use Keycloak for SSO? The ports needed for that needs to be accessible so services can talk to it. If there's a dedicated port for management you can still use it with software like pangolin. Run the management service on only a local port and access using this software or wireguad.

I use authentik and as far as I know the management is on the same web port so I have to allow some paths to be accessible to the world.

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#52

Post by djlameche »

dizhn wrote: post #51
djlameche wrote: post #29

Sorry if this is a noobish question, but would this allow me to access services on a VPS, that I do not want publicly accessible on the internet? In other words: Let's say I have a VPS with eg. Keycloak running on it. I want to be able to access it for management purposes but don't want it exposed to other people on the internet. Would Pangolin be a way for me to do this?

Don't you use Keycloak for SSO? The ports needed for that needs to be accessible so services can talk to it. If there's a dedicated port for management you can still use it with software like pangolin. Run the management service on only a local port and access using this software or wireguad. I use authentik and as far as I know the management is on the same web port so I have to allow some paths to be accessible to…

I'm not using anything YET. I am thinking about hosting a pepper variety database I am developing on a VPS for public use. I want to use Keycloak for authentication and also some other services alongside (eg. a headless CMS for writing some of the content).

The thing is, I don't have any prior experience with hosting at all. So I am wondering if I can reduce attack surface by making "management" services (Keycloak admin console, the headless CMS admin interface etc.) accessible only to me...

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#54

Post by rb666 »

resiros wrote: post #45
LucidLynx wrote: post #34

What is the difference between Pangolin and NetBird, which is also a self-hosted and fully open-source solution? https://github.com/netbirdio/netbird

Would love to understand it better too. It looks like the use cases are similar but the tech is different. NetBird is an alternative to Tailscale that uses Wireguard under the hood while these seem to use Traefik under the hood. I am personally a user of NetBird and love it. The design of the UI is very similar though :)

Pangolin also uses WireGuard and does not lock features behind a paywall.

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#56

Post by dizhn »

djlameche wrote: post #52
dizhn wrote: post #51

Earlier quoted context omitted.

Don't you use Keycloak for SSO? The ports needed for that needs to be accessible so services can talk to it. If there's a dedicated port for management you can still use it with software like pangolin. Run the management service on only a local port and access using this software or wireguad. I use authentik and as far as I know the management is on the same web port so I have to allow some paths to be accessible to…

I'm not using anything YET. I am thinking about hosting a pepper variety database I am developing on a VPS for public use. I want to use Keycloak for authentication and also some other services alongside (eg. a headless CMS for writing some of the content). The thing is, I don't have any prior experience with hosting at all. So I am wondering if I can reduce attack surface by making "management" services (Keycloak ad…

> So I am wondering if I can reduce attack surface by making "management" services (Keycloak admin console, the headless CMS admin interface etc.) accessible only to me...

The answer to this is YES. Of course there are a variety of ways to implement. In your case I would start simple with something like wireguard. Keycloak won't be easy to install and configure as a beginner. If your needs are simple, check out https://github.com/lldap/lldap for authentication (and user management).

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#57

Post by paffdragon »

This looks really nice.

I have set up something similar just recently with an OPNSense box running DNS, the WireGuard instance and getting a wildcard Let's Encrypt cert that it pushes to my Synology reverse proxy (Nginx). So from my clients I can enable the WG tunnel only on my internal IP range, setting the internal DNS, so I don't have to have my public cert pointing to my IP. It works once setup for my home net. But for multi-site, Pangolin looks very polished and probably easier to set up.

Is Newt a custom implementation of a WireGuard server? Has it been security audited in some way?

Re: Show HN: Pangolin – Open source alternative to Cloudflare Tunnels

#59

Post by j45 »

noduerme wrote: post #5

This seems really interesting for managing a lot of remote dev boxes or something like that... so, kind of an uneducated question (from someone who isn't heavily involved in actual infrastructure)... I haven't used CF tunnels, and the extent of my proxying private services has pretty much been either reverse proxy tunnels over SSH, or Tailscale. Where pretty much any service I want to test privately is located on som…

Tailscale (and headscale) is great for internal access to something that night not have public internet access. Others have mentioned an example of keeping a NAS off the public internet.

Cloudflare tunnels help expose a service to the internet with a bit more protection.

I have seen folks use both tailscale to access the backend and the public side is only Cloudflare tunnels.

It’s not unreasonable to point Cloudflare tunnels to a central and internal nginx proxy manager.

Tailscale can route the public internet into your services too can do this too but the protections in Cloudflare are likely a little more robust.

Panagolin looks interesting enough to try out, it could sit run behind Cloudflare tunnels while testing and then moved out.

Post reply on HN