Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

81–90 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#81

Post by Spivak »

LibertyBeta wrote: post #31
napkin wrote: post #15

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives…

Do you have any guides on the same level as simplicity as this one? It seems while we always bring up wireguard, its a big topic with few good places to get hand hold on.

I can't share the code since it's internal but here's the broad strokes.

* Start with a "gateway" managing your WireGuard "PKI". Basically a group of Wireguard servers with an API that have synced configs.

    /proxies - Your frontend servers.
    /endpoints - Your backend servers.
    /gateways - WireGuard servers that your frontend and backend can reach.
* Gateway authenticates your proxies and endpoints and they both hit a /config endpoint to pull something that can be shoved into wg-quick. AllowedIPs restricts what the proxy is allowed to reach.

* Proxies handle user-auth like any web service and then act as a reverse proxy to the endpoints using the Wireguard internal address.

Nothing at all fancy except that in a normal deployment your frontend and backend would be live in the same datacenter and so you don't need any WireGuard BS.

This provides a model where our devs can hit a public endpoint that reverse proxies to their laptops.

Re: Exposing a web service with Cloudflare Tunnel

#82

Post by ErisaDev »

gonehome wrote: post #76

This is great, I've always found information about how to do this kind of thing to be pretty confusing and not well described. Thanks for adding some more helpful material to the web. I wrote up a guide [0] for using Nginx on a standard digital ocean droplet, but had I known about cloudflared at the time I think I would have tried that (tailscale was also something I thought about). There was another recent article a…

Hi, I'm the author of the blog post being promoted here.

Thank you for your kind words!

> I've always found information about how to do this kind of thing to be pretty confusing and not well described.

This is the main reason I made this post, there is a lot of documentation but most of it is quite dense and doesn't walk through a simple use-case. When I've recommended Tunnel to my friends I usually have to baby them through the process because of the lack of clear information. This post was made so I have something to point to when I recommend people to use Tunnel for their-usecase. I didn't expect it to blow up this much!

Re: Exposing a web service with Cloudflare Tunnel

#83

Post by qeternity »

judge2020 wrote: post #60
qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

The point is that it's connected via NAT, so you don't have to worry about port scanners hitting your origin IP and seeing any info about your web server (potentially exposing it to DDOS), and it's overall easier when you don't have to touch your inbound firewall.

I understand that. That doesn't mean you don't have to worry about security.

Most stacks would crumble under a relatively small L7 ddos that Cloudflare would not likely mitigate.

Re: Exposing a web service with Cloudflare Tunnel

#84

Post by freediver »

apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

This still feels too cumbersome even for a technical person.

An “easy” solution would be something that gets your local content online in one click or less.

Re: Exposing a web service with Cloudflare Tunnel

#85

Post by gonehome »

ErisaDev wrote: post #82
gonehome wrote: post #76

This is great, I've always found information about how to do this kind of thing to be pretty confusing and not well described. Thanks for adding some more helpful material to the web. I wrote up a guide [0] for using Nginx on a standard digital ocean droplet, but had I known about cloudflared at the time I think I would have tried that (tailscale was also something I thought about). There was another recent article a…

Hi, I'm the author of the blog post being promoted here. Thank you for your kind words! > I've always found information about how to do this kind of thing to be pretty confusing and not well described. This is the main reason I made this post, there is a lot of documentation but most of it is quite dense and doesn't walk through a simple use-case. When I've recommended Tunnel to my friends I usually have to baby them…

Thanks! Yeah it's great - this kind of thing is super helpful and will be helping random people searching the web for years to come :)

Re: Exposing a web service with Cloudflare Tunnel

#86

Post by anderspitman »

freediver wrote: post #84
apitman wrote: post #73

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS,…

This still feels too cumbersome even for a technical person. An “easy” solution would be something that gets your local content online in one click or less.

In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI.

It also has basic e2ee. The TLS certs never leave the client devices by default.

Even so I agree with you that this is still too much. I think a non-technical person should be able to write some content, go through a quick OAuth2 flow to point a domain name at that content, and have it just work. I'm currently working on building something more like that.

Re: Exposing a web service with Cloudflare Tunnel

#87

Post by rank0 »

brightball wrote: post #74
judge2020 wrote: post #60

Earlier quoted context omitted.

The point is that it's connected via NAT, so you don't have to worry about port scanners hitting your origin IP and seeing any info about your web server (potentially exposing it to DDOS), and it's overall easier when you don't have to touch your inbound firewall.

Could an origin server run a port scanner through the tunnel and hide the origin of the scan?

Well sure the scan would appear to come from cloudflare. But it’d be pretty easy for cloudflare to then identify the tunnel user as the source of the scans.

Re: Exposing a web service with Cloudflare Tunnel

#88

Post by ErisaDev »

carride wrote: post #12

Easy to expose ssh server too. Use the .ssh/config ProxyCommand at the client. Cloudflare handles the authentication with the default OTP emailed. They explain towards the end of this tutorial https://developers.cloudflare.com/cloudflare-one/tutorials/s...

Hi, I'm the author of the blog post being promoted here.

This is really cool too!! I use Tunnels with SSH a ton. I was considering making a follow-up post going through the SSH setup too, but I felt it was a bit redundant considering that docs page existed. My post was because of the lack of a clear guide for a simple HTTP webserver.

Re: Exposing a web service with Cloudflare Tunnel

#89

Post by rank0 »

qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

Well their WAF and dos protection are pretty nice.

An easy secure setup would be to spin up a guest VM and isolate it in its own subnet.

Disable routing between your guest and the rest of your lan and you can sleep easy at night so long as your app doesn’t serve any crazy dynamic content.

Post reply on HN