Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

131–140 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#131

Post by carride »

throw14082020 wrote: post #116

I've just spent a few hours trying to use Cloudflare Tunnels to connect to my machine through SSH after reading this post. Unfortunately, I then found that SSH keys are not supported: https://github.com/cloudflare/cloudflared/issues/319 so I cannot disable Password authentication.

Yes, I use SSH keys, not password authentication, as well as PAM 2FA which is my normal SSH configuration. So the traffic is e2ee from my client to my server. Perhaps that issue refers to using personal SSH keys instead of the ~/.cloudflared/cert.pem which is used to encrypt the tunnel

Re: Exposing a web service with Cloudflare Tunnel

#132

Post by ziml77 »

I just started using Cloudflare Tunnel this weekend to expose a service hosted at home. I love that I don't have to open any ports up, that my home IP isn't exposed, and that I don't need to worry about maintaining my own reverse proxy to host multiple sites on the standard ports.

I know there's other ways to do this, but Tunnel made it extremely easy.

Re: Exposing a web service with Cloudflare Tunnel

#133

Post by qeternity »

janto wrote: post #100
qeternity wrote: post #83

Earlier quoted context omitted.

I understand that. That doesn't mean you don't have to worry about security. Most stacks would crumble under a relatively small L7 ddos that Cloudflare would not likely mitigate.

https://www.cloudflare.com/learning/ddos/glossary/web-applic...

We are die hard Cloudflare customers, I am speaking from experience. They are phenomenal, but they aren’t magic.

Re: Exposing a web service with Cloudflare Tunnel

#134

Post by Karrot_Kream »

rank0 wrote: post #101
superkuh wrote: post #96

Earlier quoted context omitted.

"Walking around covered in body armor and allowing the military to drive me to work in a tank" is nice protection but it's also very restrictive. I don't think the argument against this is so much that Cloudflare doesn't provide nice features as that those features are entirely unneeded for 99.99% of people hosting from home. The downsides of heavy protection are vastly increased complexity and dependence on a non-'d…

Lmao your response made me chuckle. You're entirely right! Probably nothing bad will happen. Especially if you partition your network like I mentioned in my OP. I would get worried about somehow enabling access to defects in my router by opening some inbound ports. I realize that's a little paranoid...but recently I have been playing around with https://github.com/threat9/routersploit and routinely find defects in co…

> Here's my other beef with cloudflare: Once I gotta pay 200+/mo for their security services or whatever, I could just rent out a private rack in a colocation and throw some old beefy lga-2011 xeon hosts. Now I don't need anything on my LAN exposed and I have dedicated IPs, physical security, and backup generators...etc.

Yeah but now you need to source the hardware for the rack, make sure it stays up and there's no hardware failures, etc, etc. Even simpler is to grab a Linode dedicated box which comes with v4 and v6 IPs and you get all the benefits for only $30 / mo instead.

Re: Exposing a web service with Cloudflare Tunnel

#135

Post by ylk »

janto wrote: post #100
qeternity wrote: post #83

Earlier quoted context omitted.

I understand that. That doesn't mean you don't have to worry about security. Most stacks would crumble under a relatively small L7 ddos that Cloudflare would not likely mitigate.

https://www.cloudflare.com/learning/ddos/glossary/web-applic...

https://www.cloudflare.com/plans/#overview

The WAF is $20/month and as far as I know you don't get it automatically for free by using Cloudflare Tunnel, though feel free to correct me. There was the case of them enabling mitigations for the log4j vulnerabilities for anyone on Cloudflare, but that was an exception.

Re: Exposing a web service with Cloudflare Tunnel

#136

Post by mdoms »

I'm a little confused about hostname routing. You set up a config file with hostname values like either of the two below:

  ingress:
    - hostname: myapp1.examples.com
      service: http://localhost:8080
    - hostname: myapp2.example.com
      service: http://localhost:8081
    - service: http_status:404

  ingress:
    - service: http://localhost:80
Then later you explicitly route to a subdomain for the simple case (the second one above):

  $ cloudflared tunnel route dns mytunnel test.example.com
Now you're on a subdomain, how would I handle this routing case for the more complex case from above?

Re: Exposing a web service with Cloudflare Tunnel

#138

Post by LoveGracePeace »

aborsy wrote: post #127
LoveGracePeace wrote: post #113

Earlier quoted context omitted.

Similar, I use a cheap AWS Lightsail VPS $3.50 (Lightsail has DDOS protection)-> Wireguard -> Apache Reverse Proxy mod -> my local services.

Why not having clients and local services meet on a Wireguard concentrator on VPs? Thus no need for Apache reverse proxy. Problem is, 3.5$/month has only 500MB RAM which is very little to run Apache + other services.

There's lots of ways to work it. I prefer retaining control over the service plane for ultimate flexibility and so I can easily switch public access point (the VPS) if needed. This also reduces the need for more powerful cloud hardware, more cloud costs, etc. On Apache, I've run Apache for decades for static web, reverse proxy, etc., I have no plans to change that.

Re: Exposing a web service with Cloudflare Tunnel

#139

Post by NicoJuicy »

anderspitman wrote: post #119
NicoJuicy wrote: post #118

Earlier quoted context omitted.

Cloudflare already has the bandwidth. I suppose tunnel doesn't cost much ( or even anything) compared to the rest since they pay for the size of the pipe. When someone uses the tunnel, they never have to go outside of cloudflare. Since the traffic ( i suspect) would stay very local. Perhaps it could be even cheaper in the end for them.

Good point, but they do still have to pay development costs for Cloudflare Tunnel.

That's why i explicitly mentioned the cost of the bandwidth.

I wasn't talking about the development/maintenance.

Re: Exposing a web service with Cloudflare Tunnel

#140

Post by lappet »

anderspitman wrote: post #130
lappet wrote: post #129

Earlier quoted context omitted.

sigh, thanks for the response. I think I may move onto RaspberryPi instead. Boringproxy looks like an interesting tool.

Honestly for technical users the RPi should be preferred IMO. The reason I want to get Android working is to bring self-hosting to the masses. Turning an old Android phone into a personal cloud by installing a couple apps and putting it in a corner would be huge. Android is such a pain we might have to settle for shipping custom SD cards for RPi's though.

> an old Android phone into a personal cloud by installing a couple apps and putting it in a corner would be huge.

That's not a bad idea. It does seem like things have to be absolutely app driven. I wonder how backups would work with that? Multiple phones?

Post reply on HN