Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

71–80 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#71

Post by xfer »

napkin wrote: post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

ipv4 costs will keep increasing, so if you want cheap vpses ipv6 will be the only option and this will allow you to use cloudflare network to serve the v4 users.

Re: Exposing a web service with Cloudflare Tunnel

#72

Post by sascha_sl »

anderspitman wrote: post #64
sascha_sl wrote: post #62

Earlier quoted context omitted.

It's unfortunate the only mature open source alternative[1] went on a path to seriously expensive subscriptions, 5x of a tailscale personal subscription. [1]: https://inlets.dev/

There are lots of other open source options[0]. Whether you would consider any mature is a bit more subjective. [0]: https://github.com/anderspitman/awesome-tunneling

I did go through this list a few months ago and found most options lacking. But Cloudflare tunnel was still bound to having an Argo subscription back then. (To be fair, their pricing page is still very confusing on this)

Re: Exposing a web service with Cloudflare Tunnel

#73

Post by apitman »

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server.

Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS, though I haven't heard of that being enforced in practice.

If you're the only one ever using your services then I'd recommend Tailscale instead, which sets up a VPN using WireGuard along with slick auto p2p setup (NAT traversal, relays, etc).

[0]: https://github.com/anderspitman/awesome-tunneling

Re: Exposing a web service with Cloudflare Tunnel

#74

Post by brightball »

judge2020 wrote: post #60
qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

The point is that it's connected via NAT, so you don't have to worry about port scanners hitting your origin IP and seeing any info about your web server (potentially exposing it to DDOS), and it's overall easier when you don't have to touch your inbound firewall.

Could an origin server run a port scanner through the tunnel and hide the origin of the scan?

Re: Exposing a web service with Cloudflare Tunnel

#75

Post by zackbloom »

Cloudflare Tunnel will spin up a free tunnel for you even without a Cloudflare account. If you run `brew install cloudflare/cloudflare/cloudflared` and then `cloudflared tunnel --url http://localhost:8080` you will get a URL you can use to reach that local port from the Internet.

I use it to share in-progress work with co-workers, test webhooks, etc.

Edit: fixed command thanks to comment below :)

Re: Exposing a web service with Cloudflare Tunnel

#76

Post by gonehome »

This is great, I've always found information about how to do this kind of thing to be pretty confusing and not well described. Thanks for adding some more helpful material to the web.

I wrote up a guide [0] for using Nginx on a standard digital ocean droplet, but had I known about cloudflared at the time I think I would have tried that (tailscale was also something I thought about).

There was another recent article about cloudflared I remember seeing (maybe not on HN?), there's not very much good stuff like this about self-hosting. A lot people online just say "use X" without explaining anything helpful.

[0]: https://zalberico.com/essay/2020/06/06/urbit-on-the-cloud.ht...

Re: Exposing a web service with Cloudflare Tunnel

#77

Post by gajus »

Debugging Cloudflare Tunnel is PITA. We are using it in production, and have most random outages that leave us guessing what triggered it. The errors are vague to say the least, and there is not much in terms of existing community. Otherwise, it is easy to setup and works great when it does.

Re: Exposing a web service with Cloudflare Tunnel

#78

Post by anderspitman »

sascha_sl wrote: post #72
anderspitman wrote: post #64

Earlier quoted context omitted.

There are lots of other open source options[0]. Whether you would consider any mature is a bit more subjective. [0]: https://github.com/anderspitman/awesome-tunneling

I did go through this list a few months ago and found most options lacking. But Cloudflare tunnel was still bound to having an Argo subscription back then. (To be fair, their pricing page is still very confusing on this)

If you wouldn't mind opening an issue (or posting on forum.indiebits.io) and sharing anything you learned that's not already in the list it would be very helpful. I don't have time to try them all in depth.

Re: Exposing a web service with Cloudflare Tunnel

#79

Post by judge2020 »

apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

> though I haven't heard of that being enforced in practice.

It happened here[0], and the reasoning for why they allow some free tier content is in their S-1[1]. Typically, even if you blatant file sharing or video streaming application in violation of 2.8, Cloudflare doesn't necessarily care as long as it's not too bandwidth intensive (eg. I wouldn't recommend having a dozen people streaming Plex from the outside internet).

0: https://community.cloudflare.com/t/the-way-you-handle-bandwi...

1: https://l.judge.sh/85EH

Re: Exposing a web service with Cloudflare Tunnel

#80

Post by ErisaDev »

apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

Hi, I'm the author of the blog post being promoted here.

I love that list! I also use Tailscale for a lot of my personal private services as well as Cloudflare Tunnel, I think they're both really great :)

The concern about Cloudflare decrypting the traffic is valid, I just personally feel for a lot of public websites that's often fine especially if the hoster might have been using Cloudflare already anyway. If an individual doesn't want to use Cloudflare for their setup then that's fine and there are lots of cool pieces of tech they can consider!

Post reply on HN