Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare has made it too easy to access your homelab on the internet

kibibyte.in

Post reply on HN
Print view View original

21–26 of 26 posts

Re: Cloudflare has made it too easy to access your homelab on the internet

#21

Post by icedchai »

arjvik wrote: post #15
icedchai wrote: post #7

Earlier quoted context omitted.

I have a VPS running BGP, along with my own ASN and a /24 block. My home network is tunneling out to the VPS from a VM and routing the /24 over wireguard. The /24 is then made available on its own VLAN. No doubt all this stuff is a violation of residential TOS agreements.

How did you acquire an ASN, how much did it cost you, and how much ongoing maintenance/cost is it?

With the right paperwork, anyone can get one. I am using a RIPE LIR and it costs about $150/year.

Re: Cloudflare has made it too easy to access your homelab on the internet

#22

Post by fragmede »

Dowwie wrote: post #16

Cloudflare tunnels is a nightmare to work with. I had the famous experience of "it worked fine at my home, I don't know why it's not working in the lab" and couldn't ever resolve the problem, running on Ubuntu. As of March 2024, Cloudflare tunnels was very, very unrefined (on Ubuntu). QUIC doesn't work and you have to read through forums to find how to change protocol to http2. The logs are insufficient to pinpoint i…

You probably don't need Tailscale ssh - you can just install the Tailscale client on your devices, setup a regular ssh server like the one baked into your distro, and just use regular ssh keys to get into machines.

Re: Cloudflare has made it too easy to access your homelab on the internet

#23

Post by icedchai »

move-on-by wrote: post #20
icedchai wrote: post #7

Earlier quoted context omitted.

I have a VPS running BGP, along with my own ASN and a /24 block. My home network is tunneling out to the VPS from a VM and routing the /24 over wireguard. The /24 is then made available on its own VLAN. No doubt all this stuff is a violation of residential TOS agreements.

How does someone go about doing something like this? Do you have a blog? I would love to read more.

I don't have a blog, but if you google "personal ASN" you'll find a few!

Re: Cloudflare has made it too easy to access your homelab on the internet

#24

Post by ricktdotorg »

stavros wrote: post #9

Unfortunately, you can't use this to tunnel multiple subdomains, unless you tunnel an entire domain. That's because Cloudflare won't let you issue third-level wildcard certificates, so you can't proxy *.lab.mydomain.com. Maybe I should just get my homelab a domain and be done with it, but right now running everything over Tailscale seems like a better solution.

FYI you can get third-level certs wildcard or not if you subscribe to their Advanced Certificate Manager product.

Re: Cloudflare has made it too easy to access your homelab on the internet

#26

Post by znpy »

shadeslayer wrote: post #3
bhaney wrote: post #2

Call me crazy, but I don't think "tunnel all your traffic through a third party corporation's service" is the correct solution to "my IP changes sometimes." Maybe just set up DDNS instead? If you really are trying to run a server behind a CGNAT, then I guess you have no other options, but I'd consider this kind of thing to be a last resort.

Not quite, some ISPs lock down their routers and you can't expose the relevant ports publically. That's when Cloudflare Tunnels combined with a reverse proxy save the day. Another really useful service is being able to protect everything behind a SSO like Github, allowing at least the most basic form of intrusion prevention that would secure your homelab from the majority of attacks.

> Not quite, some ISPs lock down their routers and you can't expose the relevant ports publically.

Here in Italy our public Communications Regulatory Authority (AGCOM) has sentenced that ISPs cannot mandate a specific router type and MUST provide technical details so that any subscriber can be able to use a modem/router of choice. This was after quite a bit of lobbying by the "Free Modem Alliance (https://www.freemodemalliance.it/)

So I guess that at the end of the day i guess it's mostly a matter of political activism.

I love this, and run my own WRT3200ACM with OpenWRT

Post reply on HN