Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

161–170 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#161

Post by hombre_fatal »

moontear wrote: post #125
hombre_fatal wrote: post #58

Earlier quoted context omitted.

Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare. Your users don't really care about decentralized utopia when your service doesn't work.

Help me understand what you mean: my service ok particular wouldn’t be ddosed because nobody cares. I guess bots are hitting CF IPs at large and therefore services might be disrupted?

Well, every service that gets ddosed was once a service that nobody cared about.

But if your service is in a category that attracts ddos (like a forum or game) and you ever get enough traction for someone to care (doesn’t take much), it might surprise you how cheap it is to take you down and how limited your options are against a simple volumetric attack.

Re: Exposing a web service with Cloudflare Tunnel

#162

Post by Slix »

throw14082020 wrote: post #116

I've just spent a few hours trying to use Cloudflare Tunnels to connect to my machine through SSH after reading this post. Unfortunately, I then found that SSH keys are not supported: https://github.com/cloudflare/cloudflared/issues/319 so I cannot disable Password authentication.

Huh? Cloudflare Access supports SSH. My windows ssh prompts me for my SSH keypair's password, so I assume my server is checking my keypair.

Re: Exposing a web service with Cloudflare Tunnel

#163

Post by fomine3 »

api wrote: post #66
hombre_fatal wrote: post #58

Earlier quoted context omitted.

Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare. Your users don't really care about decentralized utopia when your service doesn't work.

The only decentralization that's going to work is actual decentralization where there's not really anything to DDOS, or rather the entire system is itself a botnet.

Ultimately big CDN is the only way to win for DDoS.

Re: Exposing a web service with Cloudflare Tunnel

#165

Post by superkuh »

rank0 wrote: post #101
superkuh wrote: post #96

Earlier quoted context omitted.

"Walking around covered in body armor and allowing the military to drive me to work in a tank" is nice protection but it's also very restrictive. I don't think the argument against this is so much that Cloudflare doesn't provide nice features as that those features are entirely unneeded for 99.99% of people hosting from home. The downsides of heavy protection are vastly increased complexity and dependence on a non-'d…

Lmao your response made me chuckle. You're entirely right! Probably nothing bad will happen. Especially if you partition your network like I mentioned in my OP. I would get worried about somehow enabling access to defects in my router by opening some inbound ports. I realize that's a little paranoid...but recently I have been playing around with https://github.com/threat9/routersploit and routinely find defects in co…

You don't have to enable port forwarding to get your router exploited. I'd argue that port forwarding has neither positive nor negative effect on your router's security.

I've been hosting from home for 20+ years and I've never been troubled. But I only run static websites.

Re: Exposing a web service with Cloudflare Tunnel

#166

Post by vineyardmike »

babagabooj wrote: post #104
apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

What about Slack's Nebula? Tailscale is not fully open source. I believe there is also headscale which is attempting to replace the closed-source parts of Tailscale. But I am curious about Slack's Nebula. Has anyone used it for anything like this?

Never used it, but it seems more complex and doesn't use standard tunneling (eg. wireguard).

You should also check out Innernet if you're interested in this space. Wiretrustee is similar to TS in that it mixes OS/Closed source.

Re: Exposing a web service with Cloudflare Tunnel

#167

Post by c0npr »

I used v2ray+nginx on a linode instance to expose NAT-ed port. I have tried cloudflared before but it seems to not able to proxy the cockpit GUI well. And the credentials (for the whole domain) will have to stay with the device, that make me a little nervous.

Re: Exposing a web service with Cloudflare Tunnel

#168

Post by blaise-pabon »

sascha_sl wrote: post #72
anderspitman wrote: post #64

Earlier quoted context omitted.

There are lots of other open source options[0]. Whether you would consider any mature is a bit more subjective. [0]: https://github.com/anderspitman/awesome-tunneling

I did go through this list a few months ago and found most options lacking. But Cloudflare tunnel was still bound to having an Argo subscription back then. (To be fair, their pricing page is still very confusing on this)

Ok, I'm confused... you went through a bunch of awesome solutions and you found them lacking; but the modest price of inlets is unacceptable? If Tailscale works for you, then you don't need Inlets.

I like to have several environments on my laptop, each with a different Ingress and Let's Encrypt certificate, accessible from the public Internet whether I am at home or at Starbucks. If Grandma's mac has 4G of ram, she can do it too!

Re: Exposing a web service with Cloudflare Tunnel

#169

Post by Karrot_Kream »

anderspitman wrote: post #106
freediver wrote: post #102

Earlier quoted context omitted.

The goal is to host a html page and/or share a file.

I'm not aware of a good solution to this currently, but it's a space I'm very interested in. The main problem is that the devices most people use these days (phones and laptops) are constantly being connected and disconnected from networks. So even if you solve the software problem and make a nice GUI program for your grandma to use which automatically handles TLS certs and tunneling, if she closes her laptop her blo…

Overlay networks could offer a good solution here. Today if you have software on OP's grandma's laptop that starts a Wireguard tunnel to a relay host, the laptop can have a stable IPv6 address to which you can connect to. ZeroTier and Tailscale enable this as well.

Re: Exposing a web service with Cloudflare Tunnel

#170

Post by sascha_sl »

blaise-pabon wrote: post #168
sascha_sl wrote: post #72

Earlier quoted context omitted.

I did go through this list a few months ago and found most options lacking. But Cloudflare tunnel was still bound to having an Argo subscription back then. (To be fair, their pricing page is still very confusing on this)

Ok, I'm confused... you went through a bunch of awesome solutions and you found them lacking; but the modest price of inlets is unacceptable? If Tailscale works for you, then you don't need Inlets. I like to have several environments on my laptop, each with a different Ingress and Let's Encrypt certificate, accessible from the public Internet whether I am at home or at Starbucks. If Grandma's mac has 4G of ram, she c…

That you’d think 20 dollars a month is an acceptable price for this tells me that you’re either in the valley, are Alex Ellis or both.

Either way, I’ve built my own solution in go and if that doesn’t work out I also have cloudflared now. inlets is cool, but it is not revolutionary tech that can not be replicated and 20 dollars a month is mighty much for convenience, which would be hampered again by me having to throw a license key at every instance and being unable to share my config easily and reproducibly. And that ultimately matters a lot to me.

Post reply on HN