Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

171–180 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#171

Post by sascha_sl »

blaise-pabon wrote: post #144
anderspitman wrote: post #64

Earlier quoted context omitted.

There are lots of other open source options[0]. Whether you would consider any mature is a bit more subjective. [0]: https://github.com/anderspitman/awesome-tunneling

Ummm... you haven't used Inlets, have you? But seriously, folks who use Inlets have typically tried a bunch of the obvious solutions and end up there when all else has failed them. First of all, it's not "a" tunnel. It's however many you need to access the applications on your private network... which could be your laptop. It's not for everyone, but if you're running lots of apps on, say, your laptop and you want to…

Cloudflare tunnels is free now though.

Re: Exposing a web service with Cloudflare Tunnel

#172

Post by vinayakpandey »

sickill wrote: post #120
amiga-workbench wrote: post #16

Earlier quoted context omitted.

I've just done the same thing at work. I've got a little Dell Optiplex running bookstack here, and a AWS Graviton2 box running a wireguard server and reverse proxying web traffic over it.

Upvoted you for your username :)

No post body was provided.

Re: Exposing a web service with Cloudflare Tunnel

#173

Post by divbzero »

An alternative to using cloudflared is using TLS client certificates to authenticate that requests to your origin server come from Cloudflare [1]. This is not quite as airtight as Cloudflare Tunnel because you expose a port for TLS but it comes close.

[1]: https://developers.cloudflare.com/ssl/origin-configuration/a... "Set up authenticate origin pulls"

Re: Exposing a web service with Cloudflare Tunnel

#174

Post by fennecfoxen »

Does anyone have experience with software you can self-host a dial-out tunnel to achieve the same? I'm looking into a similar setup (connecting from an internal site to a private cloud, rather than to the Internet) and would prefer not to write the software myself if I can avoid it: network programming is tricky; network programming with failover, doubly so.

It's a real system with various security and compliance concerns; Cloudflare and dev-focused services like Inlet or simple SSH forwarding are unfortunately not going to work.

Re: Exposing a web service with Cloudflare Tunnel

#175

Post by newusertoday »

apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

I found this to be good as well, maybe you can add it to your list https://github.com/ferama/rospo

Re: Exposing a web service with Cloudflare Tunnel

#176

Post by mlangenberg »

jck wrote: post #47
mlangenberg wrote: post #39

I'm using a Cloudflare tunnel to expose Home Assistant protected by Google Auth and use it anywhere from my personal devices.

Does the home assistant Android app allow you to login with your public url?

Unfortunately not. It opens Chrome to authenticate with Google but never redirects back to the native app. So I 'installed' Home Assistant as a PWA and found there is practically no need for me to use the app. On iOS it does work with the native app thought.

Note that if you are not using Cloudflare Access as additional authentication layer and only rely on Home Assistant authentication, the Cloudflare tunnel obviously works with the Android app. It's just that I was too paranoid for this.

Maybe I'm overly cautious. Home Assistant does have two-factor as options as well, doesn't it?

Re: Exposing a web service with Cloudflare Tunnel

#177

Post by EVa5I7bHFq9mnYK »

freediver wrote: post #92
anderspitman wrote: post #86

Earlier quoted context omitted.

In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI. It also has basic e2ee. The TLS certs never leave the client devices by default. Even so I agree with you that…

If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?

Dropbox? The steps would be:

1) Copy folder to Dropbox subfolder

OR

1a) Go to Preferences->Sync->select which folders to sync -> add the folder that you want to share

2) right-click on it and select Share Dropbox Link

3) copy the link and send it via email/whatsapp

Re: Exposing a web service with Cloudflare Tunnel

#178

Post by janto »

qeternity wrote: post #133
janto wrote: post #100

Earlier quoted context omitted.

https://www.cloudflare.com/learning/ddos/glossary/web-applic...

We are die hard Cloudflare customers, I am speaking from experience. They are phenomenal, but they aren’t magic.

What do you then mean by a "relatively small L7 ddos that Cloudflare would not likely mitigate"? It seems to me that their WAF would mitigate that and I can worry even less about threats.

Re: Exposing a web service with Cloudflare Tunnel

#179

Post by janto »

ylk wrote: post #135
janto wrote: post #100

Earlier quoted context omitted.

https://www.cloudflare.com/learning/ddos/glossary/web-applic...

https://www.cloudflare.com/plans/#overview The WAF is $20/month and as far as I know you don't get it automatically for free by using Cloudflare Tunnel, though feel free to correct me. There was the case of them enabling mitigations for the log4j vulnerabilities for anyone on Cloudflare, but that was an exception.

Yes, WAF is one of the features you get if you're not on their free app service plan. I think having the option of simply upgrading and turning it on if it becomes necessary, makes the free offering quite attractive.

I haven't used CF in anger, so can't vouch for it more than that.

Re: Exposing a web service with Cloudflare Tunnel

#180

Post by rank0 »

superkuh wrote: post #165
rank0 wrote: post #101

Earlier quoted context omitted.

Lmao your response made me chuckle. You're entirely right! Probably nothing bad will happen. Especially if you partition your network like I mentioned in my OP. I would get worried about somehow enabling access to defects in my router by opening some inbound ports. I realize that's a little paranoid...but recently I have been playing around with https://github.com/threat9/routersploit and routinely find defects in co…

You don't have to enable port forwarding to get your router exploited. I'd argue that port forwarding has neither positive nor negative effect on your router's security. I've been hosting from home for 20+ years and I've never been troubled. But I only run static websites.

Yeah like I said I realize I am being paranoid but there are far fetched scenarios where serving static sites from home could compromise my home network.

Take the recent log4j vulnerabilities. Serving static content and logging trivial fields like request headers would lead to RCE. If that box can route to my home router, and my router has a defect available through routersploit, my network is completely pwned.

A network isolated VM with a tunnel to a remote vps would stop that particular attack.

All that being said…if a sophisticated adversary is targeting me I have to concede there are much easier routes to take.

I’m a security engineer at my day job so I may have conditioned myself into excessive fear.

Post reply on HN