8 ms·

Exposing a web service with Cloudflare Tunnel

398 points by geostyx 5y ago

kordlessagain 5y ago
I would rather use ngrok for these things: https://ngrok.com/ https://ngrok.com/ The reason why is because Alan is awesome.
- TIPSIO 5y ago
  Mind elaborating the service trade-offs?
- deweller 5y ago
  ngrok is easy to use. Is there any advantage of using Cloudflare Tunnel over ngrok?
  - cyberpip 5y ago
    Cloudflare tunnels also create multiple connections to Cloudflare for increased reliability. See https://blog.cloudflare.com/argo-tunnels-that-live-forever/ https://blog.cloudflare.com/argo-tunnels-that-live-forever/
  - andrewnyr 5y ago
    ngrok is meant for temporary quick test environments, Cloudflare Tunnel is more of a long-term solution. Although there is https://try.cloudflare.com/ https://try.cloudflare.com/ which is designed to be just as quick and easier as ngrok.
- pedrogpimenta 5y ago
  why?
- mugsie 5y ago
  out of interest - why? They seem to be targeted at different use cases - ngrok for dev work (looking at pricing and the limits on the free tier), and argo tunnels for permanent services
  - deleted 5y ago
    [deleted]
- inconshreveable 5y ago
  Thanks Kord! Founder of ngrok here, just a quick note of correction for others in this thread: ngrok is absolutely intended for production use cases. There are many customers both hobbyist and enterprise running thousands of production workloads over ngrok's service (including ourselves! we dogfood ngrok for our ingress). We're excited to be sharing more about that with the HN community really soon.
  - anderspitman 5y ago
    As much as it pains me to say it, Cloudflare seems well positioned to eat ngrok's lunch. AFAIK they offer everything ngrok does plus auto TLS certs, CDN, domain name registration, and tons of other features. They also have way more edge servers for terminating tunnels close to the origin devices. And they can afford to do all this for free as a loss leader product. It's the AWS bundling effect. Oh and the client source code is available. I don't want to see Cloudflare completely take over this space, but Cloudflare Tunnel is tough to compete with. One knob ngrok could still turn is adding auto TLS certs which are managed on the client side. Then you can offer e2ee which is something Cloudflare will probably never do.
    - joshuarubin 5y ago
      ngrok employee here (and lead on our cert system). Re client side auto certs, it's an interesting idea. We do support auto certs, managed within the ngrok cloud. We also support passing through tls termination to the ngrok agent and/or the user's upstream server so that users can use their own certs (which could be obtained programmatically). We also support end-to-end encryption as well as authentication (via mutual tls). We've got a lot in the works as well.. thoon, real thoon. ;-)
SkeuomorphicBee 5y ago
There is no mention of prices on that page, does anyone know how much it costs? Is it included on their free tier, or it is a "free" added service for customers who already pay for other services? If so, I'm curious what would be the cost of the minimum package to get this working.
- judge2020 5y ago
  Available on the free plan at no extra charge https://blog.cloudflare.com/tunnel-for-everyone/ https://blog.cloudflare.com/tunnel-for-everyone/
- ErisaDev 5y ago
  Hi, I'm the author of the blog post being promoted here. As noted by other commenters, Cloudflare Tunnel is completely free forever and does not cost anything. This was not always the case in the past where it was previously tied with the Argo Smart Routing product that cost money. The announcement of it becoming free is here: https://blog.cloudflare.com/tunnel-for-everyone/ https://blog.cloudflare.com/tunnel-for-everyone/ I didn't mention price in the post because it was free, however from the comments I am thinking perhaps that is an important point to make. I wiill keep this in mind if I make similar posts in the future :)
reilly3000 5y ago
I just set up a Cloudflare Tunnel this weekend to my homelab. I was able to connect it up with a container within minutes. I also was able to set up their zero trust offering and had route based RBAC against two domains w/ Google OAuth2 login. I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic and saved me quite a bit of trouble with messing with my RouterOs config and nginx.
- api 5y ago
  > I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic Superior UI/UX offered by centralized systems is why everything is being centralized. People will trade everything including privacy and security for ease of use. The market has shown this time and time again.
  - hombre_fatal 5y ago
    Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare. Your users don't really care about decentralized utopia when your service doesn't work.
    - api 5y ago
      The only decentralization that's going to work is actual decentralization where there's not really anything to DDOS, or rather the entire system is itself a botnet.
      - acdha 5y ago
        There’s always something to DDoS. It comes down to whether the attacker has more resources than you have server capacity, and these days attacks can be measured in terabits.
      - fomine3 5y ago
        Ultimately big CDN is the only way to win for DDoS.
mlangenberg 5y ago
I'm using a Cloudflare tunnel to expose Home Assistant protected by Google Auth and use it anywhere from my personal devices.
- jck 5y ago
  Does the home assistant Android app allow you to login with your public url?
  - mlangenberg 5y ago
    Unfortunately not. It opens Chrome to authenticate with Google but never redirects back to the native app. So I 'installed' Home Assistant as a PWA and found there is practically no need for me to use the app. On iOS it does work with the native app thought. Note that if you are not using Cloudflare Access as additional authentication layer and only rely on Home Assistant authentication, the Cloudflare tunnel obviously works with the Android app. It's just that I was too paranoid for this. Maybe I'm overly cautious. Home Assistant does have two-factor as options as well, doesn't it?
zackbloom 5y ago
Cloudflare Tunnel will spin up a free tunnel for you even without a Cloudflare account. If you run `brew install cloudflare/cloudflare/cloudflared` and then `cloudflared tunnel --url http://localhost:8080 http://localhost:8080` you will get a URL you can use to reach that local port from the Internet. I use it to share in-progress work with co-workers, test webhooks, etc. Edit: fixed command thanks to comment below :)
- hoherd 5y ago
  Nice alternative to ngrok! I didn't realize this was possible without a cloudflare account. FWIW the brew install command is `brew install cloudflare/cloudflare/cloudflared` (via https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide https://developers.cloudflare.com/cloudflare-one/connections...)
gajus 5y ago
Debugging Cloudflare Tunnel is PITA. We are using it in production, and have most random outages that leave us guessing what triggered it. The errors are vague to say the least, and there is not much in terms of existing community. Otherwise, it is easy to setup and works great when it does.
deleted 5y ago
[deleted]
EGreg 5y ago
How does this compare to ngrok and can we combine them to host sites from our own servers behind a dynamic IP given by our ISP? Could be great for developers showing off their sites for instance.
throw14082020 5y ago
I've just spent a few hours trying to use Cloudflare Tunnels to connect to my machine through SSH after reading this post. Unfortunately, I then found that SSH keys are not supported: https://github.com/cloudflare/cloudflared/issues/319 https://github.com/cloudflare/cloudflared/issues/319 so I cannot disable Password authentication.
- carride 5y ago
  Yes, I use SSH keys, not password authentication, as well as PAM 2FA which is my normal SSH configuration. So the traffic is e2ee from my client to my server. Perhaps that issue refers to using personal SSH keys instead of the ~/.cloudflared/cert.pem which is used to encrypt the tunnel
  - throw14082020 5y ago
    Thanks for your comment. After trying it again, it has worked!
- Slix 5y ago
  Huh? Cloudflare Access supports SSH. My windows ssh prompts me for my SSH keypair's password, so I assume my server is checking my keypair.
  - throw14082020 5y ago
    Thanks for your comment. After trying it again, it has worked!
aborsy 5y ago
How does it compare with ZeroTier, Tailscale and Nebula?
- Tajnymag 5y ago
  With Cloudflare Tunnel you don't need a VPN on the client.
  - anderspitman 5y ago
    You still need to run the cloudflared executable though. Cloudflare Tunnel currently proxies everything over HTTP/2 frames, but they've also started experimenting with QUIC[0]. This means everything runs in userspace. Main advantage here is it doesn't require admin privileges on the client and it doesn't mess with your network configuration. If you use a VPN like OpenVPN or Tailscale (based on WireGuard), it will require admin in order to configure the network devices. The main advantage of WireGuard solutions is it runs in the kernel and can potentially be much faster, or at least more efficient. For tunneling often your upload throughput and not performance is the bottleneck. [0]: https://blog.cloudflare.com/getting-cloudflare-tunnels-to-connect-to-the-cloudflare-network-with-quic/ https://blog.cloudflare.com/getting-cloudflare-tunnels-to-co...
chrisweekly 5y ago
This looks pretty interesting to me. Self-hosting a webapp origin server on hardware in my house, fronted by CloudFlare... hmm. Food for thought.
- jgalt212 5y ago
  much cheaper than EC2 or Heroku.
- stingraycharles 5y ago
  As a matter of fact, I have a 4-node kubernetes cluster running at home which is exposed through a CloudFlare tunnel on the internet. Works like a charm, and you don’t have issues with firewalls, NAT, and/or dynamic IPs.
- warp 5y ago
  One of the limitations that wasn't immediately obvious to me is that you're mapping a single domain with these tunnels. So you cannot easily make *.example.com available via a cloudflare tunnel. (and when I tried it it wasn't possible with ngrok either, perhaps that changed) I ended up switching to a business connection with my ISP, so I could get an extra fixed IPv4 address at my house and not need any of these tunnels. Obviously that is not an option everywhere.
  - cestith 5y ago
    The ingress example with multiple subdomains and a default service seem to suggest one can host more than one subdomain. It would require setting your tunnel DNS on the Cloudflare side to point all of them to the tunnel.
  - caseysoftware 5y ago
    Yes, we made it easier a while back. Now you can map customname.ngrok.io to your tunnel with a command line switch. If you want to use a CNAME, it's a similar switch, a dashboard entry, and an update to your DNS entries. I did it on my own domain in a couple minutes, flushed the DNS records, and had it routable in ~15 minutes. The full docs are here: https://ngrok.com/docs#http-custom-domains https://ngrok.com/docs#http-custom-domains Disclosure: I work at ngrok
davewritescode 5y ago
I use this to expose services running in Kubernetes clusters and have Cloudflare tunnel pointing at my Kube gateways. It makes a ton of things like cluster failover much simpler than they otherwise would be.
- stingraycharles 5y ago
  Yup, and you can even have multiple tunnels that are load balanced, so that you don’t even have to fail over. We have a single API service which is exposed to the internet, and put the CloudFlare tunnel as a sidecar inside the same pods. This way, it’s actually CloudFlare which handles the load balancing, which is surprisingly effective.
- blinkingled 5y ago
  Could you elaborate on the setup a bit - for cluster fail over do you mean that since cloudflare is your frontend ingress you can easily point it to another cluster or is there more to it?
  - ErisaDev 5y ago
    Not the person replying to (but I am the author of the blog post being promoted here) I believe they _may_ be referring to the feature of being able to run a single "tunnel" on multiple hosts, using the same credentials and ID. When you do this, not only will Cloudflare automatically serve from the geographically nearest server if it can, but when one client goes offline (When the tunnel is disconnected, not application error sadly) it will automatically ignore that connection and serve from the others, providing some basic degree of failover with no extra payment or much configuration. I believe you can also easily integrate Tunnels with the paid CF Load Balancer: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb https://developers.cloudflare.com/cloudflare-one/connections...
  - davewritescode 5y ago
    We integrate the tunnels with CFs load balancer service which basically lets us route traffic to one or more kubernetes clusters. Right now it’s just for failover where we can repoint a zone from one cluster to another but we’re also looking to route traffic geographically. One of the great things about cloudflare tunnels is that even without load balancer we can send requests to multiple clusters if we want to. Makes it really easy to replicate stateless services like ingress gateways.
willejs 5y ago
You can also put authentication in front of cloudflare argo tunnels, so you can securely expose internally hosted applications to the internet. A zero trust or BeyondCorp model is usally way easier than VPNs etc. It is a really nice alternative to hosting Buzzfeed SSO or Pomerium too.
maxcan 5y ago
Some issues (and solutions) that I ran into: https://www.maxcantor.com/blog/2021-10-15-ngrok-to-cloudflare https://www.maxcantor.com/blog/2021-10-15-ngrok-to-cloudflar...
deleted 5y ago
[deleted]
carride 5y ago
Easy to expose ssh server too. Use the .ssh/config ProxyCommand at the client. Cloudflare handles the authentication with the default OTP emailed. They explain towards the end of this tutorial https://developers.cloudflare.com/cloudflare-one/tutorials/ssh#connect-from-a-client-machine https://developers.cloudflare.com/cloudflare-one/tutorials/s...
- ErisaDev 5y ago
  Hi, I'm the author of the blog post being promoted here. This is really cool too!! I use Tunnels with SSH a ton. I was considering making a follow-up post going through the SSH setup too, but I felt it was a bit redundant considering that docs page existed. My post was because of the lack of a clear guide for a simple HTTP webserver.
  - carride 5y ago
    Your tutorial is already more thorough than others. Ideal to help anyone get their HTTP site accessible to the public.
napkin 5y ago
If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives to Cloudfare's network dominance, if you can afford it.
- sascha_sl 5y ago
  The real beauty of cloudflared is that you can just throw it into a sidecar for your k8s pod / docker-compose container set and configure the entire thing in one place.
  - sickill 5y ago
    That's a good point, sounds convenient.
- xfer 5y ago
  ipv4 costs will keep increasing, so if you want cheap vpses ipv6 will be the only option and this will allow you to use cloudflare network to serve the v4 users.
- LoveGracePeace 5y ago
  Similar, I use a cheap AWS Lightsail VPS $3.50 (Lightsail has DDOS protection)-> Wireguard -> Apache Reverse Proxy mod -> my local services.
  - aborsy 5y ago
    Why not having clients and local services meet on a Wireguard concentrator on VPs? Thus no need for Apache reverse proxy. Problem is, 3.5$/month has only 500MB RAM which is very little to run Apache + other services.
    - 5y ago
piaste 5y ago
It's not obvious to me from the blogpost where TLS termination happens in this scenario. I would want it to happen on my local machine, so that (a) Cloudflare can't read my plaintext traffic, and (b) I can manage subdomain certificates more easily via Caddy. Is that possible with the cheapo free tunnels or does Cloudflare want to handle the domain and TLS certificates, too?
- judge2020 5y ago
  All this changes is how CF connects to the server. Like the rest of CF, outside of using Spectrum Enterprise (which enables TCP 443 tunneling), CF removes TLS at their servers and inspects the traffic so all of its caching/firewall/etc features can be applied. It does add it back when talking to a tunnel, so it’s non plaintext on the wire.
  - piaste 5y ago
    Thank you. Yes, I assumed that the tunnel was encrypted, but I was interested in using Cloudflare only as an untrusted reverse proxy / bastion server in front of my personal homeserver, no traffic inspection or caching or anything else. Your comment and u/pedrogpimenta's give very different answers, I guess I'll need to verify for myself.
- pedrogpimenta 5y ago
  You can do both or even no TLS if you want. It's easy to choose so on the domain preferences (it's only per domain, AFAIK)
- anderspitman 5y ago
  Cloudflare Tunnel doesn't offer an end-to-end encryption option. If this is a must for you, either my own boringproxy or remotemoe[0] both offer this. I'm sure at least a couple others on the list[1] do as well but you'd have to check them individually. If you find any that do please consider opening an issue so I can add that information to the list. [0]: https://github.com/fasmide/remotemoe https://github.com/fasmide/remotemoe [1]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
andrewnyr 5y ago
Great write up here, helps supplement the docs perfectly.
allisdust 5y ago
One place where this would shine is running compute intensive tasks (especially the ones that involve GPU) that are usually queued. Instead of throwing too much money to the cloud providers, setup this tunnel on your unused/even new machine and throw tasks at it.
wink 5y ago
> No port forward headache, no complex configuration. That's on page 10 of 12 on the print preview... It has another service running though, I find that adds a lot of complexity to the setup, but as usual, this has pros and cons. Don't get me wrong, it's a good tutorial but I'm not sure I find port forwarding more complex - but I would argue that that strengths of this setup are different.
qeternity 5y ago
> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to worry about a thing when it comes to the security of your web service. Well, a port is exposed, it's just exposed on Cloudflare's reverse proxies. And I think this is probably a dramatic overstatement of the security that Cloudflare provides...
- deleted 5y ago
  [deleted]
- h4waii 5y ago
  No no, it's encrypted so you can just completely ignore the security of your web service. * Broken auth? Doesn't matter, encrypted. * IDOR? Encryption takes care of it! * Blind SQL or something from the 90s? EEENNNNCCCRRYYPPPTTIIOOONN!
  - diarrhea 5y ago
    They probably use military-grade hashes too. So you know it is very secure indeed.
  - johnhenry 5y ago
    > ... you can just completely ignore the security of your web service Be weary of such absolute statements -- especially when it comes to security.
    - gmadsen 5y ago
      you are replying to a sarcastic comment that agrees with you..
  - sascha_sl 5y ago
    To be fair, this feature is part of Cloudflare's ZeroTrust offering, so you're meant to put a policy in front of it and forget it. This is great for getting extremely old legacy services that previously relied on VPN network trust onto an actual SSO provider instead.
amluto 5y ago
If only there was a straightforward way to manage the credentials used by cloudflared for tunnels, bind them to specific websites, and revoke them. In principle, there is no reason at all to use TLS inside the tunnel — the tunnel itself is authenticated and encrypted. Unfortunately, cloudflare tunnels feel a bit like a cute 20% project that was never quite finished and is barely integrated with the rest of cloudflare’s offering. Hey jgc et all, if you’re reading this, maybe the cloudflare console UI could have a pane for managing tunnels. And the pane for managing website origin servers could let you choose between the traditional cloudflare-initiated connection and a tunnel, and the tunnel mode could give some controls for how the origin server is protected, whether connections load balance across multiple tunnels, etc. And maybe even really open-source the tunnel client for real, because it would be quite nice to have the actual origin server connect via a plugin instead of a separate daemon. In other words, the hard part of this offering is done. Do the boring bits so it can be even better than the primary offering.
- jgrahamc 5y ago
  Feel free to email me jgc@cloudflare with complaints, ideas, etc. The team that works on Tunnel just pinged me with the internal ticket where they are working on the management UI you are looking for. So... soon!
  - amluto 5y ago
    Will do!
schemescape 5y ago
Does anyone know if you can use a Cloudflare tunnel on a single subdomain without using Cloudflare on everything else? It seemed like I had to run everything on the domain through Cloudflare when I looked into this in the past. That might be fine in the end, but I just wanted to try tunnels out first without committing to anything else. Edit: thanks, everyone! This was just going to be a tiny web site for hobby purposes at first.
- deleted 5y ago
  [deleted]
- carride 5y ago
  You can have cloudflare handle your DNS, though nothing more. Each DNS record has an extra setting to Proxy. For the tunneled CNAME the proxy must be turned on. For anything else to be pass though traditional DNS then set the Proxy setting off. *edit: Learned here in this discussion that moving NS servers to Cloudflare is not even required. I’ll need to test that.
- ejcx 5y ago
  (I work at Cloudflare). You can sign up just a subdomain (sub.foo.xyz) as an enterprise customer and then add an NS records from your DNS provider to Cloudflare for that subdomain. Tunnels also has a testing domain you can use. It should give you a subdomain like xxx-xxx-xxx.trycloudflare.com for basic "How do I get this thing working" testing.
  - hellodear437 5y ago
    helo
- judge2020 5y ago
  Unless you want to pay for the business plan with a CNAME Setup[0], you do need to use their DNS offering, even if the rest of your site's DNS records are 'unproxied'. If you just want to try tunnels at all, with a non-descript hostname, Tunnel gives out subdomains that end in trycloudflare.com[1]. If you're referring to the TOS issue that is often discussed here, it depends on what that subdomain is, since Cloudflare doesn't just want to be pushing binary data for free. If the subdomain is some website that is primarily used in the browser, CF will generally be fine leaving it up even if you push TBs a day, but if it's just a file host CF has been known to flag that for abuse and disable proxying for the domain[2]. As for why they bother with a free plan with such cryptic rules, their S1 explains it[3]. 0: https://support.cloudflare.com/hc/en-us/articles/360020348832-Understanding-a-CNAME-Setup#h_48897892411544043189831 https://support.cloudflare.com/hc/en-us/articles/36002034883... 1: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare https://developers.cloudflare.com/cloudflare-one/connections... 2: https://community.cloudflare.com/t/the-way-you-handle-bandwidth-over-usage/42969/2?u=judge https://community.cloudflare.com/t/the-way-you-handle-bandwi... 3: https://l.judge.sh/85EH https://l.judge.sh/85EH (I am not a CF employee nor your lawyer)
jck 5y ago
I've been running caddy (with the cloudflare addon) to serve local services on a https url. I then set my local dns(Adguard home) to redirect my url to it's lan url. Additionally, I run cloudflare tunnel to expose these services on the internet. This allows me to use the url for internal services both at home or through the internet while having proper auth through cloudflare access when accessed over the internet. It was been working great for me so far
sbaildon 5y ago
Another one for the alternatives list is Kilo[1] It's a wireguard based kubernetes network overlay. I use it to access private services in my homelab cluster from my laptop, phone, etc. [1] https://kilo.squat.ai https://kilo.squat.ai
bob1029 5y ago
I am keeping an eye on this offering. In a B2B setting, this is a compelling way to expose certain sensitive services to the public web without forcing our customers to make complex/problematic firewall changes. Not everyone is sitting on a fat stack of public IPv4s they can just point at their infra. Many of the businesses we work with can't even accurately describe their own technology circumstances. Reducing the conversation to "Can that server ping google?" would make my life 1000% easier.
apitman 5y ago
I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS, though I haven't heard of that being enforced in practice. If you're the only one ever using your services then I'd recommend Tailscale instead, which sets up a VPN using WireGuard along with slick auto p2p setup (NAT traversal, relays, etc). [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
- freediver 5y ago
  This still feels too cumbersome even for a technical person. An “easy” solution would be something that gets your local content online in one click or less.
  - anderspitman 5y ago
    In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI. It also has basic e2ee. The TLS certs never leave the client devices by default. Even so I agree with you that this is still too much. I think a non-technical person should be able to write some content, go through a quick OAuth2 flow to point a domain name at that content, and have it just work. I'm currently working on building something more like that.
    - freediver 5y ago
      If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?
      - 5y ago
gonehome 5y ago
This is great, I've always found information about how to do this kind of thing to be pretty confusing and not well described. Thanks for adding some more helpful material to the web. I wrote up a guide [0] for using Nginx on a standard digital ocean droplet, but had I known about cloudflared at the time I think I would have tried that (tailscale was also something I thought about). There was another recent article about cloudflared I remember seeing (maybe not on HN?), there's not very much good stuff like this about self-hosting. A lot people online just say "use X" without explaining anything helpful. [0]: https://zalberico.com/essay/2020/06/06/urbit-on-the-cloud.html https://zalberico.com/essay/2020/06/06/urbit-on-the-cloud.ht...
- ErisaDev 5y ago
  Hi, I'm the author of the blog post being promoted here. Thank you for your kind words! > I've always found information about how to do this kind of thing to be pretty confusing and not well described. This is the main reason I made this post, there is a lot of documentation but most of it is quite dense and doesn't walk through a simple use-case. When I've recommended Tunnel to my friends I usually have to baby them through the process because of the lack of clear information. This post was made so I have something to point to when I recommend people to use Tunnel for their-usecase. I didn't expect it to blow up this much!
  - gonehome 5y ago
    Thanks! Yeah it's great - this kind of thing is super helpful and will be helping random people searching the web for years to come :)
lappet 5y ago
A little off topic, but does anyone know the best way to run software on an unused Android phone? For some reason this seems harder than it used to be. My goal is to run Home assistant on it, and I am struggling with issues on Termux right now. There must be a better way.
- anderspitman 5y ago
  Good luck, it's a hot mess. I spent considerable time last year porting boringproxy to run on Android. There are countless hoops to jump through for running server software, including: * You have to run it as a foreground service so the user knows it's running. Not a problem in theory but annoying to implement. * DNS name resolution doesn't work by default (with Golang at least) because android doesn't use resolve.conf. I solved this by setting DNS servers manually to 1.1.1.1, 8.8.8.8, etc. * You have to do weird hacks in order to run native applications such as Golang programs. * Android has endless optimizations for battery life that are trying to shut down/throttle your program. One example I would see huge performance differences as soon as I turned the screen off. Overall I consider Android to be a very hostile environment for native applications, and networked apps in particular. iOS is even worse from what I can tell. We need a mobile OS that respects the user's control over their device. I'm fine with sane defaults, but it should be easy to switch them off. I'm hopeful for the Pinephone, but we have a long way to go.
  - lappet 5y ago
    sigh, thanks for the response. I think I may move onto RaspberryPi instead. Boringproxy looks like an interesting tool.
    - anderspitman 5y ago
      Honestly for technical users the RPi should be preferred IMO. The reason I want to get Android working is to bring self-hosting to the masses. Turning an old Android phone into a personal cloud by installing a couple apps and putting it in a corner would be huge. Android is such a pain we might have to settle for shipping custom SD cards for RPi's though.
skrebbel 5y ago
A word of warning wrt hard-relying your service on Cloudflare. They have hidden undocumented limits. When we hit those, they dropped ~10% of our traffic without warning and they did not respond to our support requests with anything other than platitudes, despite us being on their business plan. After ghosting us for 2 weeks they tried to upsell us to the Enterprise plan for more leeway on said undocumented limits (all the while not providing any insights as to what limits we were hitting, nor how). I don't think they were malicious, I suspect growing pains, but it very much didn't match their stellar reputation. After that experience we made sure not to rely on them for anything that we couldn't instantly turn off or switch away from. I'd run a blog behind cloudflare without worries but not sure anymore about nontrivial high-traffic applications.
- jgrahamc 5y ago
  The sounds weird. Please email me (jgc@cloudflare) and tell me what happened.
  - stavros 5y ago
    I come to HN for the articles, but I stay for the customer support.
stavros 5y ago
I do this for our services, it works great and we can easily put SSO in front of them with CF Access. I publish a Docker container that you can use as a sidecar for your Compose deployments: https://gitlab.com/stavros/docker-cloudflared https://gitlab.com/stavros/docker-cloudflared I use this with Harbormaster (https://gitlab.com/stavros/harbormaster https://gitlab.com/stavros/harbormaster) so I can expose containerized stuff without ever forwarding any ports outside of Docker.
- ErisaDev 5y ago
  Hi, I'm the author of the blog post being promoted here. I maintain my own Docker image too for personal use (https://github.com/Erisa/cloudflared-docker https://github.com/Erisa/cloudflared-docker) but I've never ran into a situation where needing everything as an environment variable was required or even desired. I really love the idea of that though, and I love that image!
  - stavros 5y ago
    Yeah, I did it that way because Harbormaster promotes configuration being passed as env vars, so I needed the image to support that. That way, you can deploy cloudflared to a server without touching it beforehand, just by adding the vars to the repo that describes what you want deployed.
watchdogtimer 5y ago
Is it possible to run a mail server behind a Cloudflare tunnel? Our ISP uses CGNAT, making it impossible to port forward.
- ErisaDev 5y ago
  Hi, I'm the author of the blog post being promoted here. No, this is not possible. Cloudflare Tunnel focuses mainly on HTTP traffic but also supports SSH, VNC and generic TCP only in situations where the client also uses the cloudflared client to proxy it back to their localhost. Hosting a mail server with these restrictions is not possible I'm afraid.
  - watchdogtimer 5y ago
    That's what I thought. Thanks.
vngzs 5y ago
Quick word of warning: I found it striking that even Cloudflare's Teams product, which supports Tunnels as a feature, does not make Tunnels private (e.g., by enforcing authentication, or restricting who can reach an exposed tunnel to your organization) by default. Anyone on the Internet with the Cloudflare Warp client can reach a Tunnel configured with default settings, a quirk that is not called out in their official documentation.
ziml77 5y ago
I just started using Cloudflare Tunnel this weekend to expose a service hosted at home. I love that I don't have to open any ports up, that my home IP isn't exposed, and that I don't need to worry about maintaining my own reverse proxy to host multiple sites on the standard ports. I know there's other ways to do this, but Tunnel made it extremely easy.
mdoms 5y ago
I'm a little confused about hostname routing. You set up a config file with hostname values like either of the two below: ingress: - hostname: myapp1.examples.com service: http://localhost:8080 - hostname: myapp2.example.com service: http://localhost:8081 - service: http_status:404 ingress: - service: http://localhost:80 Then later you explicitly route to a subdomain for the simple case (the second one above): $ cloudflared tunnel route dns mytunnel test.example.com Now you're on a subdomain, how would I handle this routing case for the more complex case from above?
- ErisaDev 5y ago
  Hi, I'm the author of the blog post being promoted here. The `clouflared tunnel route dns` command creates thee DNS record mapping the tunnel to the domain. The tunnels config maps the hostname to the local service, and you can have multiple of those for each service. So for the example above, you would create a DNS record for each domain pointing to the same one tunnel, and that tunnel will route based on the ingress rules.
qxmat 5y ago
This appears to be similar to Azure AD Application Proxy. If it is they're one step ahead of MS because their App Proxy Connector clobbers MSAL auth tokens and they can't be bothered to fix the issue a year later.
e12e 5y ago
Nice little write-up. Appreciate the hints on setting up a systemd service. That said, with the service being a system service, I'd probably prefer moving the credentials file: > credentials-file: /home/ubuntu/.cloudflared/ed5bfe1 (...) To either /root, or (more likely) /etc/cloudflared/ and making it readable to root, or a system user especially for cloudflared. I like to think that my services will run regardless of the state of my /home filesystem.
twox2 5y ago
My go to is ngrok.
srhyne 5y ago
I spent way too much time trying to get cloudlfared working for team RBAC/MFA SSH solution. Ended up going with Teleport instead. I really wanted to love CF Teams but is lacking some polish IMO.
c0npr 5y ago
I used v2ray+nginx on a linode instance to expose NAT-ed port. I have tried cloudflared before but it seems to not able to proxy the cockpit GUI well. And the credentials (for the whole domain) will have to stay with the device, that make me a little nervous.
divbzero 5y ago
An alternative to using cloudflared is using TLS client certificates to authenticate that requests to your origin server come from Cloudflare [1]. This is not quite as airtight as Cloudflare Tunnel because you expose a port for TLS but it comes close. [1]: https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull/set-up https://developers.cloudflare.com/ssl/origin-configuration/a... "Set up authenticate origin pulls"
fennecfoxen 5y ago
Does anyone have experience with software you can self-host a dial-out tunnel to achieve the same? I'm looking into a similar setup (connecting from an internal site to a private cloud, rather than to the Internet) and would prefer not to write the software myself if I can avoid it: network programming is tricky; network programming with failover, doubly so. It's a real system with various security and compliance concerns; Cloudflare and dev-focused services like Inlet or simple SSH forwarding are unfortunately not going to work.

398 points by geostyx 5y ago

I would rather use ngrok for these things: https://ngrok.com/ https://ngrok.com/ The reason why is because Alan is awesome.

TIPSIO 5y ago
Mind elaborating the service trade-offs?
deweller 5y ago
ngrok is easy to use. Is there any advantage of using Cloudflare Tunnel over ngrok?
- cyberpip 5y ago
  Cloudflare tunnels also create multiple connections to Cloudflare for increased reliability. See https://blog.cloudflare.com/argo-tunnels-that-live-forever/ https://blog.cloudflare.com/argo-tunnels-that-live-forever/
- andrewnyr 5y ago
  ngrok is meant for temporary quick test environments, Cloudflare Tunnel is more of a long-term solution. Although there is https://try.cloudflare.com/ https://try.cloudflare.com/ which is designed to be just as quick and easier as ngrok.
pedrogpimenta 5y ago
why?
mugsie 5y ago
out of interest - why? They seem to be targeted at different use cases - ngrok for dev work (looking at pricing and the limits on the free tier), and argo tunnels for permanent services
- deleted 5y ago
  [deleted]
inconshreveable 5y ago
Thanks Kord! Founder of ngrok here, just a quick note of correction for others in this thread: ngrok is absolutely intended for production use cases. There are many customers both hobbyist and enterprise running thousands of production workloads over ngrok's service (including ourselves! we dogfood ngrok for our ingress). We're excited to be sharing more about that with the HN community really soon.
- anderspitman 5y ago
  As much as it pains me to say it, Cloudflare seems well positioned to eat ngrok's lunch. AFAIK they offer everything ngrok does plus auto TLS certs, CDN, domain name registration, and tons of other features. They also have way more edge servers for terminating tunnels close to the origin devices. And they can afford to do all this for free as a loss leader product. It's the AWS bundling effect. Oh and the client source code is available. I don't want to see Cloudflare completely take over this space, but Cloudflare Tunnel is tough to compete with. One knob ngrok could still turn is adding auto TLS certs which are managed on the client side. Then you can offer e2ee which is something Cloudflare will probably never do.
  - joshuarubin 5y ago
    ngrok employee here (and lead on our cert system). Re client side auto certs, it's an interesting idea. We do support auto certs, managed within the ngrok cloud. We also support passing through tls termination to the ngrok agent and/or the user's upstream server so that users can use their own certs (which could be obtained programmatically). We also support end-to-end encryption as well as authentication (via mutual tls). We've got a lot in the works as well.. thoon, real thoon. ;-)

SkeuomorphicBee 5y ago

There is no mention of prices on that page, does anyone know how much it costs? Is it included on their free tier, or it is a "free" added service for customers who already pay for other services? If so, I'm curious what would be the cost of the minimum package to get this working.

judge2020 5y ago
Available on the free plan at no extra charge https://blog.cloudflare.com/tunnel-for-everyone/ https://blog.cloudflare.com/tunnel-for-everyone/
ErisaDev 5y ago
Hi, I'm the author of the blog post being promoted here. As noted by other commenters, Cloudflare Tunnel is completely free forever and does not cost anything. This was not always the case in the past where it was previously tied with the Argo Smart Routing product that cost money. The announcement of it becoming free is here: https://blog.cloudflare.com/tunnel-for-everyone/ https://blog.cloudflare.com/tunnel-for-everyone/ I didn't mention price in the post because it was free, however from the comments I am thinking perhaps that is an important point to make. I wiill keep this in mind if I make similar posts in the future :)

reilly3000 5y ago

I just set up a Cloudflare Tunnel this weekend to my homelab. I was able to connect it up with a container within minutes. I also was able to set up their zero trust offering and had route based RBAC against two domains w/ Google OAuth2 login. I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic and saved me quite a bit of trouble with messing with my RouterOs config and nginx.

api 5y ago
> I have my reservations about CloudFlare with regard to centralizing the web, but this tunnel is fantastic Superior UI/UX offered by centralized systems is why everything is being centralized. People will trade everything including privacy and security for ease of use. The market has shown this time and time again.
- hombre_fatal 5y ago
  Getting ddosed by a $5 botnet, which gets cheaper every day, tends to change people's minds about Cloudflare. Your users don't really care about decentralized utopia when your service doesn't work.
  - api 5y ago
    The only decentralization that's going to work is actual decentralization where there's not really anything to DDOS, or rather the entire system is itself a botnet.
    - acdha 5y ago
      There’s always something to DDoS. It comes down to whether the attacker has more resources than you have server capacity, and these days attacks can be measured in terabits.
    - fomine3 5y ago
      Ultimately big CDN is the only way to win for DDoS.

mlangenberg 5y ago

I'm using a Cloudflare tunnel to expose Home Assistant protected by Google Auth and use it anywhere from my personal devices.

jck 5y ago
Does the home assistant Android app allow you to login with your public url?
- mlangenberg 5y ago
  Unfortunately not. It opens Chrome to authenticate with Google but never redirects back to the native app. So I 'installed' Home Assistant as a PWA and found there is practically no need for me to use the app. On iOS it does work with the native app thought. Note that if you are not using Cloudflare Access as additional authentication layer and only rely on Home Assistant authentication, the Cloudflare tunnel obviously works with the Android app. It's just that I was too paranoid for this. Maybe I'm overly cautious. Home Assistant does have two-factor as options as well, doesn't it?

zackbloom 5y ago

Cloudflare Tunnel will spin up a free tunnel for you even without a Cloudflare account. If you run `brew install cloudflare/cloudflare/cloudflared` and then `cloudflared tunnel --url http://localhost:8080 http://localhost:8080` you will get a URL you can use to reach that local port from the Internet. I use it to share in-progress work with co-workers, test webhooks, etc. Edit: fixed command thanks to comment below :)

hoherd 5y ago
Nice alternative to ngrok! I didn't realize this was possible without a cloudflare account. FWIW the brew install command is `brew install cloudflare/cloudflare/cloudflared` (via https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide https://developers.cloudflare.com/cloudflare-one/connections...)

gajus 5y ago

Debugging Cloudflare Tunnel is PITA. We are using it in production, and have most random outages that leave us guessing what triggered it. The errors are vague to say the least, and there is not much in terms of existing community. Otherwise, it is easy to setup and works great when it does.

deleted 5y ago

[deleted]

EGreg 5y ago

How does this compare to ngrok and can we combine them to host sites from our own servers behind a dynamic IP given by our ISP? Could be great for developers showing off their sites for instance.

throw14082020 5y ago

I've just spent a few hours trying to use Cloudflare Tunnels to connect to my machine through SSH after reading this post. Unfortunately, I then found that SSH keys are not supported: https://github.com/cloudflare/cloudflared/issues/319 https://github.com/cloudflare/cloudflared/issues/319 so I cannot disable Password authentication.

carride 5y ago
Yes, I use SSH keys, not password authentication, as well as PAM 2FA which is my normal SSH configuration. So the traffic is e2ee from my client to my server. Perhaps that issue refers to using personal SSH keys instead of the ~/.cloudflared/cert.pem which is used to encrypt the tunnel
- throw14082020 5y ago
  Thanks for your comment. After trying it again, it has worked!
Slix 5y ago
Huh? Cloudflare Access supports SSH. My windows ssh prompts me for my SSH keypair's password, so I assume my server is checking my keypair.
- throw14082020 5y ago
  Thanks for your comment. After trying it again, it has worked!

aborsy 5y ago

How does it compare with ZeroTier, Tailscale and Nebula?

Tajnymag 5y ago
With Cloudflare Tunnel you don't need a VPN on the client.
- anderspitman 5y ago
  You still need to run the cloudflared executable though. Cloudflare Tunnel currently proxies everything over HTTP/2 frames, but they've also started experimenting with QUIC[0]. This means everything runs in userspace. Main advantage here is it doesn't require admin privileges on the client and it doesn't mess with your network configuration. If you use a VPN like OpenVPN or Tailscale (based on WireGuard), it will require admin in order to configure the network devices. The main advantage of WireGuard solutions is it runs in the kernel and can potentially be much faster, or at least more efficient. For tunneling often your upload throughput and not performance is the bottleneck. [0]: https://blog.cloudflare.com/getting-cloudflare-tunnels-to-connect-to-the-cloudflare-network-with-quic/ https://blog.cloudflare.com/getting-cloudflare-tunnels-to-co...

chrisweekly 5y ago

This looks pretty interesting to me. Self-hosting a webapp origin server on hardware in my house, fronted by CloudFlare... hmm. Food for thought.

jgalt212 5y ago
much cheaper than EC2 or Heroku.
stingraycharles 5y ago
As a matter of fact, I have a 4-node kubernetes cluster running at home which is exposed through a CloudFlare tunnel on the internet. Works like a charm, and you don’t have issues with firewalls, NAT, and/or dynamic IPs.
warp 5y ago
One of the limitations that wasn't immediately obvious to me is that you're mapping a single domain with these tunnels. So you cannot easily make *.example.com available via a cloudflare tunnel. (and when I tried it it wasn't possible with ngrok either, perhaps that changed) I ended up switching to a business connection with my ISP, so I could get an extra fixed IPv4 address at my house and not need any of these tunnels. Obviously that is not an option everywhere.
- cestith 5y ago
  The ingress example with multiple subdomains and a default service seem to suggest one can host more than one subdomain. It would require setting your tunnel DNS on the Cloudflare side to point all of them to the tunnel.
- caseysoftware 5y ago
  Yes, we made it easier a while back. Now you can map customname.ngrok.io to your tunnel with a command line switch. If you want to use a CNAME, it's a similar switch, a dashboard entry, and an update to your DNS entries. I did it on my own domain in a couple minutes, flushed the DNS records, and had it routable in ~15 minutes. The full docs are here: https://ngrok.com/docs#http-custom-domains https://ngrok.com/docs#http-custom-domains Disclosure: I work at ngrok

davewritescode 5y ago

I use this to expose services running in Kubernetes clusters and have Cloudflare tunnel pointing at my Kube gateways. It makes a ton of things like cluster failover much simpler than they otherwise would be.

stingraycharles 5y ago
Yup, and you can even have multiple tunnels that are load balanced, so that you don’t even have to fail over. We have a single API service which is exposed to the internet, and put the CloudFlare tunnel as a sidecar inside the same pods. This way, it’s actually CloudFlare which handles the load balancing, which is surprisingly effective.
blinkingled 5y ago
Could you elaborate on the setup a bit - for cluster fail over do you mean that since cloudflare is your frontend ingress you can easily point it to another cluster or is there more to it?
- ErisaDev 5y ago
  Not the person replying to (but I am the author of the blog post being promoted here) I believe they _may_ be referring to the feature of being able to run a single "tunnel" on multiple hosts, using the same credentials and ID. When you do this, not only will Cloudflare automatically serve from the geographically nearest server if it can, but when one client goes offline (When the tunnel is disconnected, not application error sadly) it will automatically ignore that connection and serve from the others, providing some basic degree of failover with no extra payment or much configuration. I believe you can also easily integrate Tunnels with the paid CF Load Balancer: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb https://developers.cloudflare.com/cloudflare-one/connections...
- davewritescode 5y ago
  We integrate the tunnels with CFs load balancer service which basically lets us route traffic to one or more kubernetes clusters. Right now it’s just for failover where we can repoint a zone from one cluster to another but we’re also looking to route traffic geographically. One of the great things about cloudflare tunnels is that even without load balancer we can send requests to multiple clusters if we want to. Makes it really easy to replicate stateless services like ingress gateways.

willejs 5y ago

You can also put authentication in front of cloudflare argo tunnels, so you can securely expose internally hosted applications to the internet. A zero trust or BeyondCorp model is usally way easier than VPNs etc. It is a really nice alternative to hosting Buzzfeed SSO or Pomerium too.

maxcan 5y ago

Some issues (and solutions) that I ran into: https://www.maxcantor.com/blog/2021-10-15-ngrok-to-cloudflare https://www.maxcantor.com/blog/2021-10-15-ngrok-to-cloudflar...

deleted 5y ago

[deleted]

carride 5y ago

Easy to expose ssh server too. Use the .ssh/config ProxyCommand at the client. Cloudflare handles the authentication with the default OTP emailed. They explain towards the end of this tutorial https://developers.cloudflare.com/cloudflare-one/tutorials/ssh#connect-from-a-client-machine https://developers.cloudflare.com/cloudflare-one/tutorials/s...

ErisaDev 5y ago
Hi, I'm the author of the blog post being promoted here. This is really cool too!! I use Tunnels with SSH a ton. I was considering making a follow-up post going through the SSH setup too, but I felt it was a bit redundant considering that docs page existed. My post was because of the lack of a clear guide for a simple HTTP webserver.
- carride 5y ago
  Your tutorial is already more thorough than others. Ideal to help anyone get their HTTP site accessible to the public.

napkin 5y ago

If you have $3-5/month to spare on a VPS, a similar but self hosted solution can be achieved- Tunnel/VPN and reverse proxy- using Wireguard and Caddy. Caddy in particular is extremely easy to configure, with the bonus that HTTPS/Lets Encrypt has never been free'er. Wireguard configuration is also gloriously minimal but admittedly, potentially tricky to get right the first time. It's just good to consider alternatives to Cloudfare's network dominance, if you can afford it.

sascha_sl 5y ago
The real beauty of cloudflared is that you can just throw it into a sidecar for your k8s pod / docker-compose container set and configure the entire thing in one place.
- sickill 5y ago
  That's a good point, sounds convenient.
xfer 5y ago
ipv4 costs will keep increasing, so if you want cheap vpses ipv6 will be the only option and this will allow you to use cloudflare network to serve the v4 users.
LoveGracePeace 5y ago
Similar, I use a cheap AWS Lightsail VPS $3.50 (Lightsail has DDOS protection)-> Wireguard -> Apache Reverse Proxy mod -> my local services.
- aborsy 5y ago
  Why not having clients and local services meet on a Wireguard concentrator on VPs? Thus no need for Apache reverse proxy. Problem is, 3.5$/month has only 500MB RAM which is very little to run Apache + other services.
  - 5y ago

piaste 5y ago

It's not obvious to me from the blogpost where TLS termination happens in this scenario. I would want it to happen on my local machine, so that (a) Cloudflare can't read my plaintext traffic, and (b) I can manage subdomain certificates more easily via Caddy. Is that possible with the cheapo free tunnels or does Cloudflare want to handle the domain and TLS certificates, too?

judge2020 5y ago
All this changes is how CF connects to the server. Like the rest of CF, outside of using Spectrum Enterprise (which enables TCP 443 tunneling), CF removes TLS at their servers and inspects the traffic so all of its caching/firewall/etc features can be applied. It does add it back when talking to a tunnel, so it’s non plaintext on the wire.
- piaste 5y ago
  Thank you. Yes, I assumed that the tunnel was encrypted, but I was interested in using Cloudflare only as an untrusted reverse proxy / bastion server in front of my personal homeserver, no traffic inspection or caching or anything else. Your comment and u/pedrogpimenta's give very different answers, I guess I'll need to verify for myself.
pedrogpimenta 5y ago
You can do both or even no TLS if you want. It's easy to choose so on the domain preferences (it's only per domain, AFAIK)
anderspitman 5y ago
Cloudflare Tunnel doesn't offer an end-to-end encryption option. If this is a must for you, either my own boringproxy or remotemoe[0] both offer this. I'm sure at least a couple others on the list[1] do as well but you'd have to check them individually. If you find any that do please consider opening an issue so I can add that information to the list. [0]: https://github.com/fasmide/remotemoe https://github.com/fasmide/remotemoe [1]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

andrewnyr 5y ago

Great write up here, helps supplement the docs perfectly.

allisdust 5y ago

One place where this would shine is running compute intensive tasks (especially the ones that involve GPU) that are usually queued. Instead of throwing too much money to the cloud providers, setup this tunnel on your unused/even new machine and throw tasks at it.

wink 5y ago

> No port forward headache, no complex configuration. That's on page 10 of 12 on the print preview... It has another service running though, I find that adds a lot of complexity to the setup, but as usual, this has pros and cons. Don't get me wrong, it's a good tutorial but I'm not sure I find port forwarding more complex - but I would argue that that strengths of this setup are different.

qeternity 5y ago

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to worry about a thing when it comes to the security of your web service. Well, a port is exposed, it's just exposed on Cloudflare's reverse proxies. And I think this is probably a dramatic overstatement of the security that Cloudflare provides...

deleted 5y ago
[deleted]
h4waii 5y ago
No no, it's encrypted so you can just completely ignore the security of your web service. * Broken auth? Doesn't matter, encrypted. * IDOR? Encryption takes care of it! * Blind SQL or something from the 90s? EEENNNNCCCRRYYPPPTTIIOOONN!
- diarrhea 5y ago
  They probably use military-grade hashes too. So you know it is very secure indeed.
- johnhenry 5y ago
  > ... you can just completely ignore the security of your web service Be weary of such absolute statements -- especially when it comes to security.
  - gmadsen 5y ago
    you are replying to a sarcastic comment that agrees with you..
- sascha_sl 5y ago
  To be fair, this feature is part of Cloudflare's ZeroTrust offering, so you're meant to put a policy in front of it and forget it. This is great for getting extremely old legacy services that previously relied on VPN network trust onto an actual SSO provider instead.

amluto 5y ago

If only there was a straightforward way to manage the credentials used by cloudflared for tunnels, bind them to specific websites, and revoke them. In principle, there is no reason at all to use TLS inside the tunnel — the tunnel itself is authenticated and encrypted. Unfortunately, cloudflare tunnels feel a bit like a cute 20% project that was never quite finished and is barely integrated with the rest of cloudflare’s offering. Hey jgc et all, if you’re reading this, maybe the cloudflare console UI could have a pane for managing tunnels. And the pane for managing website origin servers could let you choose between the traditional cloudflare-initiated connection and a tunnel, and the tunnel mode could give some controls for how the origin server is protected, whether connections load balance across multiple tunnels, etc. And maybe even really open-source the tunnel client for real, because it would be quite nice to have the actual origin server connect via a plugin instead of a separate daemon. In other words, the hard part of this offering is done. Do the boring bits so it can be even better than the primary offering.

jgrahamc 5y ago
Feel free to email me jgc@cloudflare with complaints, ideas, etc. The team that works on Tunnel just pinged me with the internal ticket where they are working on the management UI you are looking for. So... soon!
- amluto 5y ago
  Will do!

schemescape 5y ago

Does anyone know if you can use a Cloudflare tunnel on a single subdomain without using Cloudflare on everything else? It seemed like I had to run everything on the domain through Cloudflare when I looked into this in the past. That might be fine in the end, but I just wanted to try tunnels out first without committing to anything else. Edit: thanks, everyone! This was just going to be a tiny web site for hobby purposes at first.

deleted 5y ago
[deleted]
carride 5y ago
You can have cloudflare handle your DNS, though nothing more. Each DNS record has an extra setting to Proxy. For the tunneled CNAME the proxy must be turned on. For anything else to be pass though traditional DNS then set the Proxy setting off. *edit: Learned here in this discussion that moving NS servers to Cloudflare is not even required. I’ll need to test that.
ejcx 5y ago
(I work at Cloudflare). You can sign up just a subdomain (sub.foo.xyz) as an enterprise customer and then add an NS records from your DNS provider to Cloudflare for that subdomain. Tunnels also has a testing domain you can use. It should give you a subdomain like xxx-xxx-xxx.trycloudflare.com for basic "How do I get this thing working" testing.
- hellodear437 5y ago
  helo
judge2020 5y ago
Unless you want to pay for the business plan with a CNAME Setup[0], you do need to use their DNS offering, even if the rest of your site's DNS records are 'unproxied'. If you just want to try tunnels at all, with a non-descript hostname, Tunnel gives out subdomains that end in trycloudflare.com[1]. If you're referring to the TOS issue that is often discussed here, it depends on what that subdomain is, since Cloudflare doesn't just want to be pushing binary data for free. If the subdomain is some website that is primarily used in the browser, CF will generally be fine leaving it up even if you push TBs a day, but if it's just a file host CF has been known to flag that for abuse and disable proxying for the domain[2]. As for why they bother with a free plan with such cryptic rules, their S1 explains it[3]. 0: https://support.cloudflare.com/hc/en-us/articles/360020348832-Understanding-a-CNAME-Setup#h_48897892411544043189831 https://support.cloudflare.com/hc/en-us/articles/36002034883... 1: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/run-tunnel/trycloudflare https://developers.cloudflare.com/cloudflare-one/connections... 2: https://community.cloudflare.com/t/the-way-you-handle-bandwidth-over-usage/42969/2?u=judge https://community.cloudflare.com/t/the-way-you-handle-bandwi... 3: https://l.judge.sh/85EH https://l.judge.sh/85EH (I am not a CF employee nor your lawyer)

jck 5y ago

I've been running caddy (with the cloudflare addon) to serve local services on a https url. I then set my local dns(Adguard home) to redirect my url to it's lan url. Additionally, I run cloudflare tunnel to expose these services on the internet. This allows me to use the url for internal services both at home or through the internet while having proper auth through cloudflare access when accessed over the internet. It was been working great for me so far

sbaildon 5y ago

Another one for the alternatives list is Kilo[1] It's a wireguard based kubernetes network overlay. I use it to access private services in my homelab cluster from my laptop, phone, etc. [1] https://kilo.squat.ai https://kilo.squat.ai

bob1029 5y ago

I am keeping an eye on this offering. In a B2B setting, this is a compelling way to expose certain sensitive services to the public web without forcing our customers to make complex/problematic firewall changes. Not everyone is sitting on a fat stack of public IPv4s they can just point at their infra. Many of the businesses we work with can't even accurately describe their own technology circumstances. Reducing the conversation to "Can that server ping google?" would make my life 1000% easier.

apitman 5y ago

I maintain a list[0] of solutions to this problem. Cloudflare Tunnel is what I currently recommend to most people. IMO it's the easiest way to expose services publicly on the internet. For example a website or shared Plex server. Main downsides to Cloudflare Tunnel are no e2ee (Cloudflare decrypts all your traffic) and technically anything other than basic HTML websites (ie media streaming) is against their free ToS, though I haven't heard of that being enforced in practice. If you're the only one ever using your services then I'd recommend Tailscale instead, which sets up a VPN using WireGuard along with slick auto p2p setup (NAT traversal, relays, etc). [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

freediver 5y ago
This still feels too cumbersome even for a technical person. An “easy” solution would be something that gets your local content online in one click or less.
- anderspitman 5y ago
  In my biased opinion, the "easiest" solution currently is my own boringproxy, which I mention at the top of the list. Once you have the client daemon running on each of your devices (static executable with minimal CLI params and no config file), adding and removing tunnels is just a few clicks in the web UI. It also has basic e2ee. The TLS certs never leave the client devices by default. Even so I agree with you that this is still too much. I think a non-technical person should be able to write some content, go through a quick OAuth2 flow to point a domain name at that content, and have it just work. I'm currently working on building something more like that.
  - freediver 5y ago
    If I wanted my grandma to host a folder from her Mac so I can access it from the web, what solution feels best?
    - 5y ago

gonehome 5y ago

This is great, I've always found information about how to do this kind of thing to be pretty confusing and not well described. Thanks for adding some more helpful material to the web. I wrote up a guide [0] for using Nginx on a standard digital ocean droplet, but had I known about cloudflared at the time I think I would have tried that (tailscale was also something I thought about). There was another recent article about cloudflared I remember seeing (maybe not on HN?), there's not very much good stuff like this about self-hosting. A lot people online just say "use X" without explaining anything helpful. [0]: https://zalberico.com/essay/2020/06/06/urbit-on-the-cloud.html https://zalberico.com/essay/2020/06/06/urbit-on-the-cloud.ht...

ErisaDev 5y ago
Hi, I'm the author of the blog post being promoted here. Thank you for your kind words! > I've always found information about how to do this kind of thing to be pretty confusing and not well described. This is the main reason I made this post, there is a lot of documentation but most of it is quite dense and doesn't walk through a simple use-case. When I've recommended Tunnel to my friends I usually have to baby them through the process because of the lack of clear information. This post was made so I have something to point to when I recommend people to use Tunnel for their-usecase. I didn't expect it to blow up this much!
- gonehome 5y ago
  Thanks! Yeah it's great - this kind of thing is super helpful and will be helping random people searching the web for years to come :)

lappet 5y ago

A little off topic, but does anyone know the best way to run software on an unused Android phone? For some reason this seems harder than it used to be. My goal is to run Home assistant on it, and I am struggling with issues on Termux right now. There must be a better way.

anderspitman 5y ago
Good luck, it's a hot mess. I spent considerable time last year porting boringproxy to run on Android. There are countless hoops to jump through for running server software, including: * You have to run it as a foreground service so the user knows it's running. Not a problem in theory but annoying to implement. * DNS name resolution doesn't work by default (with Golang at least) because android doesn't use resolve.conf. I solved this by setting DNS servers manually to 1.1.1.1, 8.8.8.8, etc. * You have to do weird hacks in order to run native applications such as Golang programs. * Android has endless optimizations for battery life that are trying to shut down/throttle your program. One example I would see huge performance differences as soon as I turned the screen off. Overall I consider Android to be a very hostile environment for native applications, and networked apps in particular. iOS is even worse from what I can tell. We need a mobile OS that respects the user's control over their device. I'm fine with sane defaults, but it should be easy to switch them off. I'm hopeful for the Pinephone, but we have a long way to go.
- lappet 5y ago
  sigh, thanks for the response. I think I may move onto RaspberryPi instead. Boringproxy looks like an interesting tool.
  - anderspitman 5y ago
    Honestly for technical users the RPi should be preferred IMO. The reason I want to get Android working is to bring self-hosting to the masses. Turning an old Android phone into a personal cloud by installing a couple apps and putting it in a corner would be huge. Android is such a pain we might have to settle for shipping custom SD cards for RPi's though.

skrebbel 5y ago

A word of warning wrt hard-relying your service on Cloudflare. They have hidden undocumented limits. When we hit those, they dropped ~10% of our traffic without warning and they did not respond to our support requests with anything other than platitudes, despite us being on their business plan. After ghosting us for 2 weeks they tried to upsell us to the Enterprise plan for more leeway on said undocumented limits (all the while not providing any insights as to what limits we were hitting, nor how). I don't think they were malicious, I suspect growing pains, but it very much didn't match their stellar reputation. After that experience we made sure not to rely on them for anything that we couldn't instantly turn off or switch away from. I'd run a blog behind cloudflare without worries but not sure anymore about nontrivial high-traffic applications.

jgrahamc 5y ago
The sounds weird. Please email me (jgc@cloudflare) and tell me what happened.
- stavros 5y ago
  I come to HN for the articles, but I stay for the customer support.

stavros 5y ago

I do this for our services, it works great and we can easily put SSO in front of them with CF Access. I publish a Docker container that you can use as a sidecar for your Compose deployments: https://gitlab.com/stavros/docker-cloudflared https://gitlab.com/stavros/docker-cloudflared I use this with Harbormaster (https://gitlab.com/stavros/harbormaster https://gitlab.com/stavros/harbormaster) so I can expose containerized stuff without ever forwarding any ports outside of Docker.

ErisaDev 5y ago
Hi, I'm the author of the blog post being promoted here. I maintain my own Docker image too for personal use (https://github.com/Erisa/cloudflared-docker https://github.com/Erisa/cloudflared-docker) but I've never ran into a situation where needing everything as an environment variable was required or even desired. I really love the idea of that though, and I love that image!
- stavros 5y ago
  Yeah, I did it that way because Harbormaster promotes configuration being passed as env vars, so I needed the image to support that. That way, you can deploy cloudflared to a server without touching it beforehand, just by adding the vars to the repo that describes what you want deployed.

watchdogtimer 5y ago

Is it possible to run a mail server behind a Cloudflare tunnel? Our ISP uses CGNAT, making it impossible to port forward.

ErisaDev 5y ago
Hi, I'm the author of the blog post being promoted here. No, this is not possible. Cloudflare Tunnel focuses mainly on HTTP traffic but also supports SSH, VNC and generic TCP only in situations where the client also uses the cloudflared client to proxy it back to their localhost. Hosting a mail server with these restrictions is not possible I'm afraid.
- watchdogtimer 5y ago
  That's what I thought. Thanks.

vngzs 5y ago

Quick word of warning: I found it striking that even Cloudflare's Teams product, which supports Tunnels as a feature, does not make Tunnels private (e.g., by enforcing authentication, or restricting who can reach an exposed tunnel to your organization) by default. Anyone on the Internet with the Cloudflare Warp client can reach a Tunnel configured with default settings, a quirk that is not called out in their official documentation.

ziml77 5y ago

I just started using Cloudflare Tunnel this weekend to expose a service hosted at home. I love that I don't have to open any ports up, that my home IP isn't exposed, and that I don't need to worry about maintaining my own reverse proxy to host multiple sites on the standard ports. I know there's other ways to do this, but Tunnel made it extremely easy.

mdoms 5y ago

I'm a little confused about hostname routing. You set up a config file with hostname values like either of the two below: ingress: - hostname: myapp1.examples.com service: http://localhost:8080 - hostname: myapp2.example.com service: http://localhost:8081 - service: http_status:404 ingress: - service: http://localhost:80 Then later you explicitly route to a subdomain for the simple case (the second one above): $ cloudflared tunnel route dns mytunnel test.example.com Now you're on a subdomain, how would I handle this routing case for the more complex case from above?

ErisaDev 5y ago
Hi, I'm the author of the blog post being promoted here. The `clouflared tunnel route dns` command creates thee DNS record mapping the tunnel to the domain. The tunnels config maps the hostname to the local service, and you can have multiple of those for each service. So for the example above, you would create a DNS record for each domain pointing to the same one tunnel, and that tunnel will route based on the ingress rules.

qxmat 5y ago

This appears to be similar to Azure AD Application Proxy. If it is they're one step ahead of MS because their App Proxy Connector clobbers MSAL auth tokens and they can't be bothered to fix the issue a year later.

e12e 5y ago

Nice little write-up. Appreciate the hints on setting up a systemd service. That said, with the service being a system service, I'd probably prefer moving the credentials file: > credentials-file: /home/ubuntu/.cloudflared/ed5bfe1 (...) To either /root, or (more likely) /etc/cloudflared/ and making it readable to root, or a system user especially for cloudflared. I like to think that my services will run regardless of the state of my /home filesystem.

twox2 5y ago

My go to is ngrok.

srhyne 5y ago

I spent way too much time trying to get cloudlfared working for team RBAC/MFA SSH solution. Ended up going with Teleport instead. I really wanted to love CF Teams but is lacking some polish IMO.

c0npr 5y ago

I used v2ray+nginx on a linode instance to expose NAT-ed port. I have tried cloudflared before but it seems to not able to proxy the cockpit GUI well. And the credentials (for the whole domain) will have to stay with the device, that make me a little nervous.

divbzero 5y ago

An alternative to using cloudflared is using TLS client certificates to authenticate that requests to your origin server come from Cloudflare [1]. This is not quite as airtight as Cloudflare Tunnel because you expose a port for TLS but it comes close. [1]: https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull/set-up https://developers.cloudflare.com/ssl/origin-configuration/a... "Set up authenticate origin pulls"

fennecfoxen 5y ago

Does anyone have experience with software you can self-host a dial-out tunnel to achieve the same? I'm looking into a similar setup (connecting from an internal site to a private cloud, rather than to the Internet) and would prefer not to write the software myself if I can avoid it: network programming is tricky; network programming with failover, doubly so. It's a real system with various security and compliance concerns; Cloudflare and dev-focused services like Inlet or simple SSH forwarding are unfortunately not going to work.