Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free DDNS with Cloudflare and a cronjob

github.com

Post reply on HN
Print view View original

71–80 of 202 posts

Re: Free DDNS with Cloudflare and a cronjob

#71

Post by remram »

clwg wrote: post #69

A bit of a tangent, but something like PowerDNS authoritative server comes with an API[0] that can be leveraged for similar functionality to what Cloudflare provides. Decentralization of the internet has to start with Authoritative DNS. I know it's not free to host an authoritative server like this on a VPS, and there are DDoS considerations. But the flip side is that DNS is a metadata protocol and contains a wealth…

If you're privacy-focused, you should run your own recursive resolver. Running your own authoritative server doesn't help much with privacy if clients still go through centralized recursive resolvers to query your domain.

Re: Free DDNS with Cloudflare and a cronjob

#72

Post by KennyBlanken »

kazinator wrote: post #60
thousand_nights wrote: post #10

Instead of using DDNS, I have been using Cloudflare tunnels to expose my home services to the internet. The setup is much simpler and it seems like it's more secure too You specify a port and point it to a subdomain and it just immediately works, no maintenance necessary. The daemon only needs to be installed once with a simple terminal command

How can you claim it's simpler in the light of the revelations in noname120's comment? Dynamic DNS is literally one little service you run to "phone home" to the dynamic DNS provider. This service is bundled in consumer routers; just find it in the WebUI, put in the credentials and turn it on. You know what could be simple: a periodic job that figures out your public IP address, and if it has changed, generates a hos…

Consumer firewalls, the largest names in open source firewalls, and at least one webserver/reverse proxy that I know of.

There also dozens of existing DDNS daemons out there already with far more developer, testing, and user eyeballs on them.

The firewall solution is preferred because the firewall knows when the external interface changes IP addresses, so there's no system or network overhead from having an agent repeatedly testing if the IP has changed, nor any downtime between when the IP changes and when the next check happens.

Re: Free DDNS with Cloudflare and a cronjob

#73

Post by eat_veggies »

blfr wrote: post #62

I wanted to do this a long time ago but I wouldn't trust my router with a Cloudflare API key. Paranoid or is there a way to limit that key to one domain or, even better, one DNS entry?

As the other commenter says, you can get pretty granular with the permissions. If you want to go even further, you can build a Cloudflare Worker that performs exactly the request that you want to do, and nothing else. Then you can configure your router to hit that instead of the API directly.

Re: Free DDNS with Cloudflare and a cronjob

#74

Post by janwillemb »

KennyBlanken wrote: post #68
vladvasiliu wrote: post #45

Earlier quoted context omitted.

> – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). But on the flip side, this allows you to have a nice certificate on your outside connection without having to fiddle with letsencrypt or…

If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.

Parent did not say it was challenging.

I find fiddling with LE tedious because it has to be repeated too often.

Re: Free DDNS with Cloudflare and a cronjob

#75

Post by codetrotter »

tcfhgj wrote: post #54
codetrotter wrote: post #44

Earlier quoted context omitted.

I’d pick the one that supports IPv6 and then make two separate requests to it. One request over IPv4 and one over IPv6. curl -4 https://www.cloudflare.com/cdn-cgi/trace curl -6 https://www.cloudflare.com/cdn-cgi/trace Also the reason that the 1.1.1.1 one shows only IPv4 address is because 1.1.1.1 is itself an IPv4 address. So any connection to it will have to be using IPv4.

could you not retrieve your ipv6 directly from the system?

Yes, but getting it in a response from an external server means I don’t have to be specific about which interface to get the IPv6 address of and so on.

Re: Free DDNS with Cloudflare and a cronjob

#76

Post by clwg »

remram wrote: post #71
clwg wrote: post #69

A bit of a tangent, but something like PowerDNS authoritative server comes with an API[0] that can be leveraged for similar functionality to what Cloudflare provides. Decentralization of the internet has to start with Authoritative DNS. I know it's not free to host an authoritative server like this on a VPS, and there are DDoS considerations. But the flip side is that DNS is a metadata protocol and contains a wealth…

If you're privacy-focused, you should run your own recursive resolver. Running your own authoritative server doesn't help much with privacy if clients still go through centralized recursive resolvers to query your domain.

You should run both.

Consider Cloudflare (and large scale infrastructure providers like TLD operators) point of view on the traffic: If your private resolver is using root hints, it's IP is now correlated with the lookup of that domain even if they don't proxy the website. That's you and your users, and they can do that at scale - So it's important to point queries for your assets directly to your authoritative servers or rewrite inline without ever querying a internet source.

dnsdist[0] (also PowerDNS) allows you to load balance and apply rules across upstream resolvers which opens up allot of possibilities on the recursive side.

Trusted resolvers with a healthy number of users originating iterative queries from non-descript and changing IP's is probably the best way to anonymize your recursive traffic.

[0] https://dnsdist.org/

Re: Free DDNS with Cloudflare and a cronjob

#77

Post by pxx »

blooalien wrote: post #40
godzillabrennus wrote: post #27

Earlier quoted context omitted.

No one sunsets products like Google. I’m in the middle of transferring all my domains from Squarespace thanks to Googles sale of that business to that incredibly lousy vendor.

May I inquire who you're moving to, and where I might browse to in order to follow you away from Squarespace / Google Domains? :)

the correct answer I think is cloudflare? I'm a little wary of internet homogenization like this but I haven't the time to worry about this sort of thing for my spare one-off domains

Re: Free DDNS with Cloudflare and a cronjob

#78

Post by tcfhgj »

codetrotter wrote: post #75
tcfhgj wrote: post #54

Earlier quoted context omitted.

could you not retrieve your ipv6 directly from the system?

Yes, but getting it in a response from an external server means I don’t have to be specific about which interface to get the IPv6 address of and so on.

the same specific interface used to contact the external server

Re: Free DDNS with Cloudflare and a cronjob

#79

Post by tcfhgj »

WarOnPrivacy wrote: post #61
stkdump wrote: post #56

Earlier quoted context omitted.

For me it changes reliably on every reconnect, but there are no forced reconnects, and I now have my router not restarting basically ever since I am on openwrt and am done with setting everything up.

> For me it changes reliably on every reconnect, What kind of reconnect?

router to provider network

Re: Free DDNS with Cloudflare and a cronjob

#80

Post by vladvasiliu »

KennyBlanken wrote: post #68
vladvasiliu wrote: post #45

Earlier quoted context omitted.

> – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). But on the flip side, this allows you to have a nice certificate on your outside connection without having to fiddle with letsencrypt or…

If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.

Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records.

Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance.

I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.

Post reply on HN