7 ms·

Bore: A simple CLI tool for making tunnels to localhost

272 points by willmorrison 4y ago

polio 4y ago
What would this be used for?
- qbasic_forever 4y ago
  Testing and developing a web service. Run the service on your localhost, like straight from your IDE with a debugger attached, and get a public internet facing bore.pub address for it. You can then point anything at it--your staging/integration or even production service, or maybe just a friend or coworker who wants to see in development work.
  - quickthrower2 4y ago
    For me to use it it would need to support https and 443 on bore.pub
    - ekzhang 4y ago
      Unfortunately this is explicitly out of scope for the implementation, but feel free to check out many of the more complex or commercial alternatives
  - ekzhang 4y ago
    Yep, those are all good use cases where TCP tunneling comes in handy — basically, how can I get someone to connect to me?
- notuger 4y ago
  I really like to test postback integrations with services like that
hsbauauvhabzb 4y ago
Why not just use ssh with local or remote port forwarding? You get free auth, stream encryption, and battle tested code. Legitimately, what benefits does this have?
- ekzhang 4y ago
  Please see the FAQ. I use SSH with remote port forwarding regularly. This has a different purpose. You’re free to use it or not as you wish.
  - hsbauauvhabzb 4y ago
    Your faq doesn’t answer my question
anonu 4y ago
Isn't this socat?
- Too 4y ago
  Socat only forwards ports within the machine it’s running. This sounds more like ssh -R.
skanga 4y ago
Can we get binaries for Linux, Mac & Windows
bnert 4y ago
This is super cool. Well done!
- ekzhang 4y ago
  Thanks!
heinrichhartman 4y ago
This is a very slick tool that allows you to forward ports from your local machine to a public server at `bore.pub`. I hope this service will continue to be available, however it looks to me as if this service is very easily abused (e.g. by spreading illegal content). But even if it just gets popular there are bandwidth costs which may run high quickly, if you have a few 100 heavy users. If the author is here: - How much of a concern is this for you? - Do you have plans to offset the bandwidth fees? - The backend is a single host, right? When would you need to scale this?
- pmoriarty 4y ago
  Could you explain how using this service would spread illegal content?
  - hsbauauvhabzb 4y ago
    It can be used as an anonymous reverse proxy, meaning it could be used to host malicious or illegal files on a malicious users computer, while making it more difficult to trace back to them. Any complaints will have the service IP address rather than the malicious users, meaning the server host is the first person the feds will be questioning during an investigation. And when I say questioning, I mean potentially publicly arresting the host for child porn or similar, destroying their life (despite being innocent), or holing the hosts computer equipment as evidence for months / years as part of the crime, even with irrefutable proof of innocence on behalf of the host. On the things not to host, a public variant of this would be at the top of my list, right next to tor exit nodes.
- imachine1980_ 4y ago
  im not the author,but don't do that, since crypto mining exist let people access to your machine means they gonna make you mine monero, that's what happens to kill public Unix systems, tradition who start in the early 80s. but i probably use this to test mobile-web, sometime web APIs, like cameras doesn't work consistently between chrome pc and chrome android for example, let you test this solution in real hardware Without need to deploy. other option is cloudflare tunnels
PeterWhittaker 4y ago
While this may be very simple to use, why would I use this in preference to SSH, given that SSH has figured out authentication, session security, etc? Yes, setting this up with SSH is (mildly) more complex, but given the inherent security, one wonders why one would opt for simplicity.
- ekzhang 4y ago
  There are different goals here and a different protocol. I use SSH remote port forwarding regularly for my work. It's ubiquitous, encrypted, and works in production. Bore has different goals; it strives for simplicity, ergonomics, efficiency, and correctness. Adding encryption to the tunnel is explicitly out of scope; bore only proxies raw TCP. If you want to add encryption, you would need to run it on top of bore, by setting up TLS termination on your own local web server (TLS runs on top of TCP) or using some other encrypted protocol.
- skoskie 4y ago
  The author has responded in their own top level comment. Currently the lowest comment on the page.
  - remram 4y ago
    They have responded multiple times "see the FAQ" and "different goals" but haven't actually provided an example advantage of this over ssh -R. Unless the lack of security is a benefit somehow? Speed maybe?
- svnpenn 4y ago
  Is SSH even available for Windows? I see people point to SSH a lot with this topic, but it seems like they assume that everyone has SSH already installed.
  - mcpherrinm 4y ago
    OpenSSH has been included with windows 10 by default for a number of years now
ekzhang 4y ago
Hey, author of bore here! I've been summoned by my friend who saw this on the front page of HN. Thanks for posting. Happy to answer any questions, though the README has most of the technical details already. Quick FAQ: -- Q: What inspired this? A: I wanted to make a really simple CLI tool for forwarding local TCP ports. No TLS termination or any other features. Localtunnel is unmaintained, slow, and requires Node.js. Ngrok v2 is proprietary, while Ngrok v1 is unmaintained, leaks memory, and is complicated to set up (requires wildcard certificates...). Why can't we just write a simple, minimal binary that does this? And focus on user experience (good error messages, clean code, systems correctness). That's the goal. -- Q: Why Rust? A: Because Rust gives you a lot of things: tracking lifetimes of variables statically, very fast code execution, data-race freedom guaranteed by the compiler, documentation, unit testing, simple binary distribution in the form of `cargo install`, and a strong focus on correctness. Tokio is also a _really_ great asynchronous runtime for writing network services. -- Q: Why release a public server? A: Mostly because I want it to be as easy as possible to try and access Bore, even if you don't have access or the technical means to run an instance in the cloud yourself. That said, "bore.pub" is not hard-coded anywhere inside the source code. The CLI usage examples explicitly pass in a mandatory `--to bore.pub` option to make sure that this software is not tied to any particular server instance. And an explicit goal of bore is to be easy to self-host, just run a single command (it's `bore server`) and you're all set. -- Q: How much does this cost you? A: I'm running the public server (bore.pub) on a $6/mo DigitalOcean droplet right now, the smallest size on shared vCPU. I just checked my dashboard, and it's only using 2% CPU at the moment. Will upgrade if I need to, but I don't expect the public server to incur significant fees unless bore gets _really_ popular. -- Q: Is there potential for abuse? A: I don't believe there's much potential for abuse here, in terms of distributing illegal content. If you wanted to do that, you could just set up port forwarding on your router and have people connect directly. Also, bore.pub doesn't guarantee you a stable TCP port to share with people; it's intended as a developer tool. So the risk seems fairly low. -- Q: How can I help with this? A: You can star the repository, share it with your friends, try using bore, and give any feedback on the issues page. Any help with packaging in software repositories or CI/CD binary builds would always be appreciated as well! Right now the only installation option is from source, using `cargo install bore-cli`. Finally, feel free to follow me on Twitter (https://twitter.com/ekzhang1 https://twitter.com/ekzhang1) where I've been posting some updates on this work. -- Q: How can I learn more? A: Read the source code — it's literally 400 lines of Rust, super short if you have an hour or so this afternoon. :)
lmc 4y ago
> This will expose your local port at localhost:8000 to the public internet at bore.pub:<PORT>, where the port number is assigned randomly. Port numbers are limited to 65535. Isn't this un-scalable and a massive security risk?
- ekzhang 4y ago
  This is a small service for developers. Please see the FAQ comment. There are not currently 40,000 proxy connections to the public server (more like 10). If there are then the server will gracefully give an error and terminate the connection. Please do not spread fear, uncertainty, and doubt about security without precise details. It’s not conducive to a healthy conversation.
  - hsbauauvhabzb 4y ago
    Forwarding ports from localhost is a benign activity unless the port is vulnerable in the first place, I wouldn’t be advocating to blindly forward localhost ports to the internet without a second look.
  - lmc 4y ago
    "Please do not spread fear, uncertainty, and doubt about security without precise details." I read the FAQ several times before posting, and it still didn't answer the security question. Elaborating my concerns... You suggest developers use this. That means, users will most likely be running dev servers. Dev servers, especially in the NodeJS world offer the ability to connect a debugger. What happens when someone spams requests to connect a debugger to bore.pub:<PORT>?
    - whodev 4y ago
      You have to explicitly tell bore which server to serve your client on. At no point do you have to use 'bore.pub'. That is being provided by the developer as a public place if you choose not to run your own bore server.
apitman 4y ago
I maintain a list of ngrok/Cloudflare Tunnel alternatives here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling It's interesting to me how many times this particular wheel has been reinvented. That said, it's a great exercise and one I highly recommend if you want to learn a bit more about networking. I like the minimalism of this implementation.
- ekzhang 4y ago
  Thanks for the feedback! I’ve actually seen your list before developing bore, and it was definitely an inspiration for me. Super helpful resource :)
- simulate-me 4y ago
  I only found out about ngrok from following a guide for the Twilio API. The local tunnel problem is one I’ve had multiple times, but it’s never seemed worth the effort to find a solution. It’s also simple to solve, so I can see how many people end up implementing it without Googling for an existing solution first.
- dcow 4y ago
  This problem disappears entirely on IPv6. Even more minimal (:
  - svnpenn 4y ago
    Can you elaborate? Someone else said that, but they refused more details when asked. Then someone else said you still need port forwarding with ipv6
    - hamandcheese 4y ago
      With IPv6, it is typical (though not guaranteed) that you will be allocated an entire range of IPs rather than a single one. This then allows you to assign a unique, publicly routable address to every device on your local network. I’m not sure if consumer hardware commonly supports this, or if it does what kind of firewalling they might do, so I have some slight doubt that IPv6 actually makes the problem Bore solves go away. I probably wouldn’t want every device on my network publicly routable even if it were possible — so even without NAT/port forwarding, there’s still a firewall to configure.
lapser 4y ago
I'm assuming the bore server would have to be listening on all ports right? Doesn't that cause risk as all ports (or lots of them anyway) are open? Also, seems like it'd be trivial to add TLS termination. I've used ngrok for it's TLS termination when developing GH Webhook listeners.
- remram 4y ago
  The number of open ports doesn't matter, if they all point to the same service.
- ekzhang 4y ago
  Good question. No, the bore server only listens on ports dynamically when it gets a new connection. It cleans up connections as well. This is managed by Rust’s ownership system. Could you also clarify what the specific risk is of opening ports? Bore has an explicit design goal of being easy to deploy yourself. Unfortunately adding TLS termination would necessitate setup steps like creating a wildcard certificate and uploading it. It also requires additional configuration options, since TLS termination is on top of HTTP, but bore only proxies TCP directly and is unaware of HTTP. This is by design.
  - lapser 4y ago
    > Could you also clarify what the specific risk is of opening ports? I guess I was meant from a firewall perspective. I understand the ports won't be listening but any potential firewall will not be able to block the port unless you have some integration to dynamically get the firewall to open and close ports on demand.
pabs3 4y ago
I think I would just use Tor onion services for this.
scns 4y ago
Have nearly finished Domain Driven made functional by Scott Wlaschin, highly recommend it. Have to disagree with the conclusion of refactoring legacy system to an event driven one. Subscribing to events makes it implicit and thus hard to follow what is happening. Being explicit pays off.
Klasiaster 4y ago
How about UPNPC when your local gateway supports it? sudo apt install miniupnpc upnpc -r 22 57922 TCP # forward 57922 on public address to this client's port 22 Together with something like https://dynv6.com/ https://dynv6.com/ you even get a subdomain that you can point to the public address: curl "https://ipv4.dynv6.com/api/update?ipv4=auto&token=$TOKEN&zone=$ZONE.dynv6.net" curl "https://ipv6.dynv6.com/api/update?ipv6=auto&token=$TOKEN&zone=$ZONE.dynv6.net"
joshbaptiste 4y ago
Binary musl self contained release would be great for adoption..

272 points by willmorrison 4y ago

polio 4y ago

What would this be used for?

qbasic_forever 4y ago
Testing and developing a web service. Run the service on your localhost, like straight from your IDE with a debugger attached, and get a public internet facing bore.pub address for it. You can then point anything at it--your staging/integration or even production service, or maybe just a friend or coworker who wants to see in development work.
- quickthrower2 4y ago
  For me to use it it would need to support https and 443 on bore.pub
  - ekzhang 4y ago
    Unfortunately this is explicitly out of scope for the implementation, but feel free to check out many of the more complex or commercial alternatives
- ekzhang 4y ago
  Yep, those are all good use cases where TCP tunneling comes in handy — basically, how can I get someone to connect to me?
notuger 4y ago
I really like to test postback integrations with services like that

hsbauauvhabzb 4y ago

Why not just use ssh with local or remote port forwarding? You get free auth, stream encryption, and battle tested code. Legitimately, what benefits does this have?

ekzhang 4y ago
Please see the FAQ. I use SSH with remote port forwarding regularly. This has a different purpose. You’re free to use it or not as you wish.
- hsbauauvhabzb 4y ago
  Your faq doesn’t answer my question

anonu 4y ago

Isn't this socat?

Too 4y ago
Socat only forwards ports within the machine it’s running. This sounds more like ssh -R.

skanga 4y ago

Can we get binaries for Linux, Mac & Windows

bnert 4y ago

This is super cool. Well done!

ekzhang 4y ago
Thanks!

heinrichhartman 4y ago

This is a very slick tool that allows you to forward ports from your local machine to a public server at `bore.pub`. I hope this service will continue to be available, however it looks to me as if this service is very easily abused (e.g. by spreading illegal content). But even if it just gets popular there are bandwidth costs which may run high quickly, if you have a few 100 heavy users. If the author is here: - How much of a concern is this for you? - Do you have plans to offset the bandwidth fees? - The backend is a single host, right? When would you need to scale this?

pmoriarty 4y ago
Could you explain how using this service would spread illegal content?
- hsbauauvhabzb 4y ago
  It can be used as an anonymous reverse proxy, meaning it could be used to host malicious or illegal files on a malicious users computer, while making it more difficult to trace back to them. Any complaints will have the service IP address rather than the malicious users, meaning the server host is the first person the feds will be questioning during an investigation. And when I say questioning, I mean potentially publicly arresting the host for child porn or similar, destroying their life (despite being innocent), or holing the hosts computer equipment as evidence for months / years as part of the crime, even with irrefutable proof of innocence on behalf of the host. On the things not to host, a public variant of this would be at the top of my list, right next to tor exit nodes.
imachine1980_ 4y ago
im not the author,but don't do that, since crypto mining exist let people access to your machine means they gonna make you mine monero, that's what happens to kill public Unix systems, tradition who start in the early 80s. but i probably use this to test mobile-web, sometime web APIs, like cameras doesn't work consistently between chrome pc and chrome android for example, let you test this solution in real hardware Without need to deploy. other option is cloudflare tunnels

PeterWhittaker 4y ago

While this may be very simple to use, why would I use this in preference to SSH, given that SSH has figured out authentication, session security, etc? Yes, setting this up with SSH is (mildly) more complex, but given the inherent security, one wonders why one would opt for simplicity.

ekzhang 4y ago
There are different goals here and a different protocol. I use SSH remote port forwarding regularly for my work. It's ubiquitous, encrypted, and works in production. Bore has different goals; it strives for simplicity, ergonomics, efficiency, and correctness. Adding encryption to the tunnel is explicitly out of scope; bore only proxies raw TCP. If you want to add encryption, you would need to run it on top of bore, by setting up TLS termination on your own local web server (TLS runs on top of TCP) or using some other encrypted protocol.
skoskie 4y ago
The author has responded in their own top level comment. Currently the lowest comment on the page.
- remram 4y ago
  They have responded multiple times "see the FAQ" and "different goals" but haven't actually provided an example advantage of this over ssh -R. Unless the lack of security is a benefit somehow? Speed maybe?
svnpenn 4y ago
Is SSH even available for Windows? I see people point to SSH a lot with this topic, but it seems like they assume that everyone has SSH already installed.
- mcpherrinm 4y ago
  OpenSSH has been included with windows 10 by default for a number of years now

ekzhang 4y ago

Hey, author of bore here! I've been summoned by my friend who saw this on the front page of HN. Thanks for posting. Happy to answer any questions, though the README has most of the technical details already. Quick FAQ: -- Q: What inspired this? A: I wanted to make a really simple CLI tool for forwarding local TCP ports. No TLS termination or any other features. Localtunnel is unmaintained, slow, and requires Node.js. Ngrok v2 is proprietary, while Ngrok v1 is unmaintained, leaks memory, and is complicated to set up (requires wildcard certificates...). Why can't we just write a simple, minimal binary that does this? And focus on user experience (good error messages, clean code, systems correctness). That's the goal. -- Q: Why Rust? A: Because Rust gives you a lot of things: tracking lifetimes of variables statically, very fast code execution, data-race freedom guaranteed by the compiler, documentation, unit testing, simple binary distribution in the form of `cargo install`, and a strong focus on correctness. Tokio is also a _really_ great asynchronous runtime for writing network services. -- Q: Why release a public server? A: Mostly because I want it to be as easy as possible to try and access Bore, even if you don't have access or the technical means to run an instance in the cloud yourself. That said, "bore.pub" is not hard-coded anywhere inside the source code. The CLI usage examples explicitly pass in a mandatory `--to bore.pub` option to make sure that this software is not tied to any particular server instance. And an explicit goal of bore is to be easy to self-host, just run a single command (it's `bore server`) and you're all set. -- Q: How much does this cost you? A: I'm running the public server (bore.pub) on a $6/mo DigitalOcean droplet right now, the smallest size on shared vCPU. I just checked my dashboard, and it's only using 2% CPU at the moment. Will upgrade if I need to, but I don't expect the public server to incur significant fees unless bore gets _really_ popular. -- Q: Is there potential for abuse? A: I don't believe there's much potential for abuse here, in terms of distributing illegal content. If you wanted to do that, you could just set up port forwarding on your router and have people connect directly. Also, bore.pub doesn't guarantee you a stable TCP port to share with people; it's intended as a developer tool. So the risk seems fairly low. -- Q: How can I help with this? A: You can star the repository, share it with your friends, try using bore, and give any feedback on the issues page. Any help with packaging in software repositories or CI/CD binary builds would always be appreciated as well! Right now the only installation option is from source, using `cargo install bore-cli`. Finally, feel free to follow me on Twitter (https://twitter.com/ekzhang1 https://twitter.com/ekzhang1) where I've been posting some updates on this work. -- Q: How can I learn more? A: Read the source code — it's literally 400 lines of Rust, super short if you have an hour or so this afternoon. :)

lmc 4y ago

> This will expose your local port at localhost:8000 to the public internet at bore.pub:<PORT>, where the port number is assigned randomly. Port numbers are limited to 65535. Isn't this un-scalable and a massive security risk?

ekzhang 4y ago
This is a small service for developers. Please see the FAQ comment. There are not currently 40,000 proxy connections to the public server (more like 10). If there are then the server will gracefully give an error and terminate the connection. Please do not spread fear, uncertainty, and doubt about security without precise details. It’s not conducive to a healthy conversation.
- hsbauauvhabzb 4y ago
  Forwarding ports from localhost is a benign activity unless the port is vulnerable in the first place, I wouldn’t be advocating to blindly forward localhost ports to the internet without a second look.
- lmc 4y ago
  "Please do not spread fear, uncertainty, and doubt about security without precise details." I read the FAQ several times before posting, and it still didn't answer the security question. Elaborating my concerns... You suggest developers use this. That means, users will most likely be running dev servers. Dev servers, especially in the NodeJS world offer the ability to connect a debugger. What happens when someone spams requests to connect a debugger to bore.pub:<PORT>?
  - whodev 4y ago
    You have to explicitly tell bore which server to serve your client on. At no point do you have to use 'bore.pub'. That is being provided by the developer as a public place if you choose not to run your own bore server.

apitman 4y ago

I maintain a list of ngrok/Cloudflare Tunnel alternatives here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling It's interesting to me how many times this particular wheel has been reinvented. That said, it's a great exercise and one I highly recommend if you want to learn a bit more about networking. I like the minimalism of this implementation.

ekzhang 4y ago
Thanks for the feedback! I’ve actually seen your list before developing bore, and it was definitely an inspiration for me. Super helpful resource :)
simulate-me 4y ago
I only found out about ngrok from following a guide for the Twilio API. The local tunnel problem is one I’ve had multiple times, but it’s never seemed worth the effort to find a solution. It’s also simple to solve, so I can see how many people end up implementing it without Googling for an existing solution first.
dcow 4y ago
This problem disappears entirely on IPv6. Even more minimal (:
- svnpenn 4y ago
  Can you elaborate? Someone else said that, but they refused more details when asked. Then someone else said you still need port forwarding with ipv6
  - hamandcheese 4y ago
    With IPv6, it is typical (though not guaranteed) that you will be allocated an entire range of IPs rather than a single one. This then allows you to assign a unique, publicly routable address to every device on your local network. I’m not sure if consumer hardware commonly supports this, or if it does what kind of firewalling they might do, so I have some slight doubt that IPv6 actually makes the problem Bore solves go away. I probably wouldn’t want every device on my network publicly routable even if it were possible — so even without NAT/port forwarding, there’s still a firewall to configure.

lapser 4y ago

I'm assuming the bore server would have to be listening on all ports right? Doesn't that cause risk as all ports (or lots of them anyway) are open? Also, seems like it'd be trivial to add TLS termination. I've used ngrok for it's TLS termination when developing GH Webhook listeners.

remram 4y ago
The number of open ports doesn't matter, if they all point to the same service.
ekzhang 4y ago
Good question. No, the bore server only listens on ports dynamically when it gets a new connection. It cleans up connections as well. This is managed by Rust’s ownership system. Could you also clarify what the specific risk is of opening ports? Bore has an explicit design goal of being easy to deploy yourself. Unfortunately adding TLS termination would necessitate setup steps like creating a wildcard certificate and uploading it. It also requires additional configuration options, since TLS termination is on top of HTTP, but bore only proxies TCP directly and is unaware of HTTP. This is by design.
- lapser 4y ago
  > Could you also clarify what the specific risk is of opening ports? I guess I was meant from a firewall perspective. I understand the ports won't be listening but any potential firewall will not be able to block the port unless you have some integration to dynamically get the firewall to open and close ports on demand.

pabs3 4y ago

I think I would just use Tor onion services for this.

scns 4y ago

Have nearly finished Domain Driven made functional by Scott Wlaschin, highly recommend it. Have to disagree with the conclusion of refactoring legacy system to an event driven one. Subscribing to events makes it implicit and thus hard to follow what is happening. Being explicit pays off.

Klasiaster 4y ago

How about UPNPC when your local gateway supports it? sudo apt install miniupnpc upnpc -r 22 57922 TCP # forward 57922 on public address to this client's port 22 Together with something like https://dynv6.com/ https://dynv6.com/ you even get a subdomain that you can point to the public address: curl "https://ipv4.dynv6.com/api/update?ipv4=auto&token=$TOKEN&zone=$ZONE.dynv6.net" curl "https://ipv6.dynv6.com/api/update?ipv6=auto&token=$TOKEN&zone=$ZONE.dynv6.net"

joshbaptiste 4y ago

Binary musl self contained release would be great for adoption..