Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH into private machines from anywhere using Cloudflare Tunnel

orth.uk

Post reply on HN
Print view View original

21–30 of 197 posts

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#21

Post by viraptor »

password4321 wrote: post #10

> Question: do you use a different tool which require no maintenance or cost to run? Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it…

Same, zerotier on everything. Router, laptops, servers, phone. It makes things very easy to connect without public addresses.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#22

Post by pabs3 »

pabs3 wrote: post #14

Unfortunately the cloudflared software, while the source is available on GitHub, and there are pull requests open and accepted for it, is not under an open source license, and the license it is under does not allow modifications, so any modifications (including the aformentioned pull requests) are contrary to the license and thus copyright law and thus illegal. The issue I filed about this is still waiting for action…

PS: I note cloudflared uses some form of telemetry, although I have not looked at what data is transmitted and didn't try to remove it after seeing the above license.

PPS: I wish cloudflared were split up into client and server instead of one binary for both, it would be easier to audit and understand that way.

PPPS: I noted while auditing that cloudflared embeds its dependencies instead of depending on them and uses some golang libraries that are obsoleted.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#25

Post by matthewmacleod »

punnerud wrote: post #18
matthewmacleod wrote: post #12

Tailscale ( https://tailscale.com ) is a great solution for this use-case. It's also just an absolutely excellent experience overall and I can't say enough nice things about it.

Can be used for the same, but serve kind of a different usecase. Tailscale scan your host for all open ports and open a WireGuard connection between the installed machines. Like every machine is on the same network, even if they are not. Way harder to have a good access control compared to plain SSH. And you don't need extra SW for just SSH.

This article is specifically about using cloudflared to implement a tunnel without exposing anything to the public internet, which is definitionally extra software. Agreed however that Tailscale offers a much wider feature set—while also covering the basic "I want to access my machine from anywhere" use-case—at the cost of exposing an entire machine instead of a single port.

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#27

Post by blibble »

pabs3 wrote: post #22
pabs3 wrote: post #14

Unfortunately the cloudflared software, while the source is available on GitHub, and there are pull requests open and accepted for it, is not under an open source license, and the license it is under does not allow modifications, so any modifications (including the aformentioned pull requests) are contrary to the license and thus copyright law and thus illegal. The issue I filed about this is still waiting for action…

PS: I note cloudflared uses some form of telemetry, although I have not looked at what data is transmitted and didn't try to remove it after seeing the above license. PPS: I wish cloudflared were split up into client and server instead of one binary for both, it would be easier to audit and understand that way. PPPS: I noted while auditing that cloudflared embeds its dependencies instead of depending on them and uses…

hearing this I'm not sure I want cloudflared inside my network at all

it's already vast... and telemetry always seems to be the thin end of the wedge

a minimal version, not maintained by the company, under a proper open source license with no bullshit and a vastly smaller attack service would seem like a easy win...

(and even better if it supported more service providers than just cloudflare... killing their lock-in)

Re: SSH into private machines from anywhere using Cloudflare Tunnel

#30

Post by heliodor »

pabs3 wrote: post #14

Unfortunately the cloudflared software, while the source is available on GitHub, and there are pull requests open and accepted for it, is not under an open source license, and the license it is under does not allow modifications, so any modifications (including the aformentioned pull requests) are contrary to the license and thus copyright law and thus illegal. The issue I filed about this is still waiting for action…

Breaking a contract is not illegal. Seems to be a common misconception.
Post reply on HN