Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

51–60 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#51

Post by judge2020 »

schemescape wrote: post #41

Does anyone know if you can use a Cloudflare tunnel on a single subdomain without using Cloudflare on everything else? It seemed like I had to run everything on the domain through Cloudflare when I looked into this in the past. That might be fine in the end, but I just wanted to try tunnels out first without committing to anything else. Edit: thanks, everyone! This was just going to be a tiny web site for hobby purpo…

Unless you want to pay for the business plan with a CNAME Setup[0], you do need to use their DNS offering, even if the rest of your site's DNS records are 'unproxied'. If you just want to try tunnels at all, with a non-descript hostname, Tunnel gives out subdomains that end in trycloudflare.com[1].

If you're referring to the TOS issue that is often discussed here, it depends on what that subdomain is, since Cloudflare doesn't just want to be pushing binary data for free. If the subdomain is some website that is primarily used in the browser, CF will generally be fine leaving it up even if you push TBs a day, but if it's just a file host CF has been known to flag that for abuse and disable proxying for the domain[2]. As for why they bother with a free plan with such cryptic rules, their S1 explains it[3].

0: https://support.cloudflare.com/hc/en-us/articles/36002034883...

1: https://developers.cloudflare.com/cloudflare-one/connections...

2: https://community.cloudflare.com/t/the-way-you-handle-bandwi...

3: https://l.judge.sh/85EH

(I am not a CF employee nor your lawyer)

Re: Exposing a web service with Cloudflare Tunnel

#52

Post by piaste »

judge2020 wrote: post #26
piaste wrote: post #18

It's not obvious to me from the blogpost where TLS termination happens in this scenario. I would want it to happen on my local machine, so that (a) Cloudflare can't read my plaintext traffic, and (b) I can manage subdomain certificates more easily via Caddy. Is that possible with the cheapo free tunnels or does Cloudflare want to handle the domain and TLS certificates, too?

All this changes is how CF connects to the server. Like the rest of CF, outside of using Spectrum Enterprise (which enables TCP 443 tunneling), CF removes TLS at their servers and inspects the traffic so all of its caching/firewall/etc features can be applied. It does add it back when talking to a tunnel, so it’s non plaintext on the wire.

Thank you. Yes, I assumed that the tunnel was encrypted, but I was interested in using Cloudflare only as an untrusted reverse proxy / bastion server in front of my personal homeserver, no traffic inspection or caching or anything else.

Your comment and u/pedrogpimenta's give very different answers, I guess I'll need to verify for myself.

Re: Exposing a web service with Cloudflare Tunnel

#54

Post by bob1029 »

I am keeping an eye on this offering. In a B2B setting, this is a compelling way to expose certain sensitive services to the public web without forcing our customers to make complex/problematic firewall changes. Not everyone is sitting on a fat stack of public IPv4s they can just point at their infra. Many of the businesses we work with can't even accurately describe their own technology circumstances.

Reducing the conversation to "Can that server ping google?" would make my life 1000% easier.

Re: Exposing a web service with Cloudflare Tunnel

#55

Post by gmadsen »

johnhenry wrote: post #49
h4waii wrote: post #40

Earlier quoted context omitted.

No no, it's encrypted so you can just completely ignore the security of your web service. * Broken auth? Doesn't matter, encrypted. * IDOR? Encryption takes care of it! * Blind SQL or something from the 90s? EEENNNNCCCRRYYPPPTTIIOOONN!

> ... you can just completely ignore the security of your web service Be weary of such absolute statements -- especially when it comes to security.

you are replying to a sarcastic comment that agrees with you..

Re: Exposing a web service with Cloudflare Tunnel

#56

Post by carride »

schemescape wrote: post #41

Does anyone know if you can use a Cloudflare tunnel on a single subdomain without using Cloudflare on everything else? It seemed like I had to run everything on the domain through Cloudflare when I looked into this in the past. That might be fine in the end, but I just wanted to try tunnels out first without committing to anything else. Edit: thanks, everyone! This was just going to be a tiny web site for hobby purpo…

You can have cloudflare handle your DNS, though nothing more. Each DNS record has an extra setting to Proxy. For the tunneled CNAME the proxy must be turned on. For anything else to be pass though traditional DNS then set the Proxy setting off.

*edit: Learned here in this discussion that moving NS servers to Cloudflare is not even required. I’ll need to test that.

Re: Exposing a web service with Cloudflare Tunnel

#57

Post by [deleted] »

qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

[deleted]

Re: Exposing a web service with Cloudflare Tunnel

#58

Post by hombre_fatal »

api wrote: post #42
reilly3000 wrote: post #25

I just set up a Cloudflare Tunnel this weekend to my homelab. I was able to connect it up with a container within minutes. I also was able to set up their zero trust offering and had route based RBAC against two domains w/ Google OAuth2 login. I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic and saved me quite a bit of trouble with messing with my RouterOs conf…

> I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic Superior UI/UX offered by centralized systems is why everything is being centralized. People will trade everything including privacy and security for ease of use. The market has shown this time and time again.

Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare.

Your users don't really care about decentralized utopia when your service doesn't work.

Re: Exposing a web service with Cloudflare Tunnel

#59

Post by sascha_sl »

h4waii wrote: post #40
qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

No no, it's encrypted so you can just completely ignore the security of your web service. * Broken auth? Doesn't matter, encrypted. * IDOR? Encryption takes care of it! * Blind SQL or something from the 90s? EEENNNNCCCRRYYPPPTTIIOOONN!

To be fair, this feature is part of Cloudflare's ZeroTrust offering, so you're meant to put a policy in front of it and forget it. This is great for getting extremely old legacy services that previously relied on VPN network trust onto an actual SSO provider instead.

Re: Exposing a web service with Cloudflare Tunnel

#60

Post by judge2020 »

qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

The point is that it's connected via NAT, so you don't have to worry about port scanners hitting your origin IP and seeing any info about your web server (potentially exposing it to DDOS), and it's overall easier when you don't have to touch your inbound firewall.
Post reply on HN