Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

31–40 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#31

Post by LibertyBeta »

napkin wrote: post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

Do you have any guides on the same level as simplicity as this one? It seems while we always bring up wireguard, its a big topic with few good places to get hand hold on.

Re: Exposing a web service with Cloudflare Tunnel

#33

Post by wink »

> No port forward headache, no complex configuration.

That's on page 10 of 12 on the print preview... It has another service running though, I find that adds a lot of complexity to the setup, but as usual, this has pros and cons.

Don't get me wrong, it's a good tutorial but I'm not sure I find port forwarding more complex - but I would argue that that strengths of this setup are different.

Re: Exposing a web service with Cloudflare Tunnel

#34

Post by qeternity »

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to worry about a thing when it comes to the security of your web service.

Well, a port is exposed, it's just exposed on Cloudflare's reverse proxies. And I think this is probably a dramatic overstatement of the security that Cloudflare provides...

Re: Exposing a web service with Cloudflare Tunnel

#35

Post by amluto »

If only there was a straightforward way to manage the credentials used by cloudflared for tunnels, bind them to specific websites, and revoke them.

In principle, there is no reason at all to use TLS inside the tunnel — the tunnel itself is authenticated and encrypted. Unfortunately, cloudflare tunnels feel a bit like a cute 20% project that was never quite finished and is barely integrated with the rest of cloudflare’s offering.

Hey jgc et all, if you’re reading this, maybe the cloudflare console UI could have a pane for managing tunnels. And the pane for managing website origin servers could let you choose between the traditional cloudflare-initiated connection and a tunnel, and the tunnel mode could give some controls for how the origin server is protected, whether connections load balance across multiple tunnels, etc. And maybe even really open-source the tunnel client for real, because it would be quite nice to have the actual origin server connect via a plugin instead of a separate daemon.

In other words, the hard part of this offering is done. Do the boring bits so it can be even better than the primary offering.

Re: Exposing a web service with Cloudflare Tunnel

#37

Post by jgrahamc »

amluto wrote: post #35

If only there was a straightforward way to manage the credentials used by cloudflared for tunnels, bind them to specific websites, and revoke them. In principle, there is no reason at all to use TLS inside the tunnel — the tunnel itself is authenticated and encrypted. Unfortunately, cloudflare tunnels feel a bit like a cute 20% project that was never quite finished and is barely integrated with the rest of cloudflare…

Feel free to email me jgc@cloudflare with complaints, ideas, etc.

The team that works on Tunnel just pinged me with the internal ticket where they are working on the management UI you are looking for. So... soon!

Re: Exposing a web service with Cloudflare Tunnel

#40

Post by h4waii »

qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

No no, it's encrypted so you can just completely ignore the security of your web service.

* Broken auth? Doesn't matter, encrypted.

* IDOR? Encryption takes care of it!

* Blind SQL or something from the 90s? EEENNNNCCCRRYYPPPTTIIOOONN!

Post reply on HN