Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exposing a web service with Cloudflare Tunnel

erisa.dev

Post reply on HN
Print view View original

91–100 of 186 posts

Re: Exposing a web service with Cloudflare Tunnel

#91

Post by hoherd »

zackbloom wrote: post #75

Cloudflare Tunnel will spin up a free tunnel for you even without a Cloudflare account. If you run `brew install cloudflare/cloudflare/cloudflared` and then `cloudflared tunnel --url http://localhost:8080 ` you will get a URL you can use to reach that local port from the Internet. I use it to share in-progress work with co-workers, test webhooks, etc. Edit: fixed command thanks to comment below :)

Nice alternative to ngrok! I didn't realize this was possible without a cloudflare account.

FWIW the brew install command is `brew install cloudflare/cloudflare/cloudflared` (via https://developers.cloudflare.com/cloudflare-one/connections...)

Re: Exposing a web service with Cloudflare Tunnel

#92

Post by freediver »

anderspitman wrote: post #86
freediver wrote: post #84

Earlier quoted context omitted.

This still feels too cumbersome even for a technical person. An “easy” solution would be something that gets your local content online in one click or less.

In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI. It also has basic e2ee. The TLS certs never leave the client devices by default. Even so I agree with you that…

If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?

Re: Exposing a web service with Cloudflare Tunnel

#93

Post by anderspitman »

inconshreveable wrote: post #69
kordlessagain wrote: post #8

I would rather use ngrok for these things: https://ngrok.com/ The reason why is because Alan is awesome.

Thanks Kord! Founder of ngrok here, just a quick note of correction for others in this thread: ngrok is absolutely intended for production use cases. There are many customers both hobbyist and enterprise running thousands of production workloads over ngrok's service (including ourselves! we dogfood ngrok for our ingress). We're excited to be sharing more about that with the HN community really soon.

As much as it pains me to say it, Cloudflare seems well positioned to eat ngrok's lunch. AFAIK they offer everything ngrok does plus auto TLS certs, CDN, domain name registration, and tons of other features. They also have way more edge servers for terminating tunnels close to the origin devices. And they can afford to do all this for free as a loss leader product. It's the AWS bundling effect. Oh and the client source code is available.

I don't want to see Cloudflare completely take over this space, but Cloudflare Tunnel is tough to compete with.

One knob ngrok could still turn is adding auto TLS certs which are managed on the client side. Then you can offer e2ee which is something Cloudflare will probably never do.

Re: Exposing a web service with Cloudflare Tunnel

#94

Post by anderspitman »

freediver wrote: post #92
anderspitman wrote: post #86

Earlier quoted context omitted.

In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI. It also has basic e2ee. The TLS certs never leave the client devices by default. Even so I agree with you that…

If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?

What's the goal? Does your grandma want to start a blog and you're talking about hosting the HTML from that folder, or do you want to be able to access the folder to read/write files, or something else?

Re: Exposing a web service with Cloudflare Tunnel

#96

Post by superkuh »

rank0 wrote: post #89
qeternity wrote: post #34

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to wor…

Well their WAF and dos protection are pretty nice. An easy secure setup would be to spin up a guest VM and isolate it in its own subnet. Disable routing between your guest and the rest of your lan and you can sleep easy at night so long as your app doesn’t serve any crazy dynamic content.

"Walking around covered in body armor and allowing the military to drive me to work in a tank" is nice protection but it's also very restrictive. I don't think the argument against this is so much that Cloudflare doesn't provide nice features as that those features are entirely unneeded for 99.99% of people hosting from home. The downsides of heavy protection are vastly increased complexity and dependence on a non-'dumb pipe' non-ISP corporation which kind of defeats the point of hosting from home.

You really can just host your webserver from home network and forward the port using your consumer grade router and consumer home connection most of the time and nothing bad happens. But this kind of tunneling would be great for when you have a bad ISP that blocks port 80 instead of just saying servers aren't allowed.

Re: Exposing a web service with Cloudflare Tunnel

#97

Post by anderspitman »

Tajnymag wrote: post #38
aborsy wrote: post #29

How does it compare with ZeroTier, Tailscale and Nebula?

With Cloudflare Tunnel you don't need a VPN on the client.

You still need to run the cloudflared executable though. Cloudflare Tunnel currently proxies everything over HTTP/2 frames, but they've also started experimenting with QUIC[0]. This means everything runs in userspace. Main advantage here is it doesn't require admin privileges on the client and it doesn't mess with your network configuration.

If you use a VPN like OpenVPN or Tailscale (based on WireGuard), it will require admin in order to configure the network devices. The main advantage of WireGuard solutions is it runs in the kernel and can potentially be much faster, or at least more efficient. For tunneling often your upload throughput and not performance is the bottleneck.

[0]: https://blog.cloudflare.com/getting-cloudflare-tunnels-to-co...

Re: Exposing a web service with Cloudflare Tunnel

#98

Post by anderspitman »

piaste wrote: post #18

It's not obvious to me from the blogpost where TLS termination happens in this scenario. I would want it to happen on my local machine, so that (a) Cloudflare can't read my plaintext traffic, and (b) I can manage subdomain certificates more easily via Caddy. Is that possible with the cheapo free tunnels or does Cloudflare want to handle the domain and TLS certificates, too?

Cloudflare Tunnel doesn't offer an end-to-end encryption option. If this is a must for you, either my own boringproxy or remotemoe[0] both offer this. I'm sure at least a couple others on the list[1] do as well but you'd have to check them individually. If you find any that do please consider opening an issue so I can add that information to the list.

[0]: https://github.com/fasmide/remotemoe

[1]: https://github.com/anderspitman/awesome-tunneling

Re: Exposing a web service with Cloudflare Tunnel

#99

Post by lappet »

A little off topic, but does anyone know the best way to run software on an unused Android phone? For some reason this seems harder than it used to be. My goal is to run Home assistant on it, and I am struggling with issues on Termux right now. There must be a better way.

Re: Exposing a web service with Cloudflare Tunnel

#100

Post by janto »

qeternity wrote: post #83
judge2020 wrote: post #60

Earlier quoted context omitted.

The point is that it's connected via NAT, so you don't have to worry about port scanners hitting your origin IP and seeing any info about your web server (potentially exposing it to DDOS), and it's overall easier when you don't have to touch your inbound firewall.

I understand that. That doesn't mean you don't have to worry about security. Most stacks would crumble under a relatively small L7 ddos that Cloudflare would not likely mitigate.

https://www.cloudflare.com/learning/ddos/glossary/web-applic...
Post reply on HN