Centralization is bad for everyone everywhere.
That bring said… I just moved my homeserver to another city… and I plugged in the power, then I plugged in the ethernet, and that was the whole shebang.
Tunnels made it very easy. No port forwarding no dns configuration no firewall fiddling no nothing.
Why do they have to make it so so easy…
Sure it’s easy to set up, but the same behaviour is what I get with my handrolled solution. I rent a cheap VPS with a fixed IP solely for forwarding all traffic through wireguard. My DNS entries all point to the VPS and my servers connect to the VPS to be reachable. It is absolutely network agnostic and does not require any port shenanigans on the local network nor does it require a fixed IP for the internet connection of my home server.
Data security wise the HTTPS terminates on my own hardware (homeserver with reverse proxy) and the wireguard connection is additionally encrypted. There are no secrets or certificates on the rented VPS beyond the bare minimum for the wireguard tunnel and my public key for SSH access.
Shuttling the packets on the VPS (inet to wireguard) is done by socat because I haven’t had the will or need to get in the weeds with nftables/iptables. I am just happy that it works reliably and am happy to loose some potential bandwidth to the kernelspace/userspace hoops.
Does this cause all traffic at the reverse proxy to appear to come from the source IP of your VPS or does it preserve the original source IP?
I’ve been working on setting up a similar setup myself and am trying to figure out specifically how to handle the forwarding on the VPS.
Yes, I do loose the origin IP and I’m a little bugged by it. It also means that ALL traffic incoming on a specific port of that VPS can only go to exactly ONE private wireguard peer. You could avoid both of these issues by having the reverse proxy on the VPS (which is why cloudflare works the way it does), but I prefer my https endpoint to be on my own trusted hardware. That’s totally my personal preference though.
I trust my VPS provider to not be interested enough in my data to setup special surveillance tooling for each and every possible software combination their customers might have. Cloudflare on the other hand only has their own software stack to monitor and all customers must adhere to it. It’s by design much easier for them to do statistics or snooping.
It also means that ALL traffic incoming on a specific port of that VPS can only go to exactly ONE private wireguard peer. You could avoid both of these issues by having the reverse proxy on the VPS (which is why cloudflare works the way it does), but I prefer my https endpoint to be on my own trusted hardware.
For TLS-based protocols like HTTPS you can run a reverse proxy on the VPS that only looks at the SNI (server name indication) which does not require the private key to be present on the VPS. That way you can run all your HTTPS endpoints on the same port without issue even if the backend server depends on the host name.
This StackOverflow thread shows how to set that up for a few different reverse proxies.
Nice, thank you!
I have a similar setup and I just have the reverse proxy on the VPS. It then proxies back to the home server on whatever port the service is on. And yes you can forward the original client IP if you wish.
What VPS do you use for this?
I am using the smallest tier VPS from IONOS for 1€/month. Good, reliable and trustworthy as it is a subsidiary of 1&1 telecommunications.
If you want something cheap check out RackNerd yearly deals. Last I checked they still have listings for black Friday and other old deals once you’ve made an account. I got a server for like $12 a year with 5tb monthly bandwidth. I have 3 servers total with them and haven’t had a problem for the 3 years I’ve been using them.
That would be awesome, currently it’s 500GB for their cheaper option which starts at 23/year. I didn’t find an option to increase the bandwidth before completing the order. Also it needs to be deployed in NY (which would be possibly slow for me in Europe). Finally their isos are somewhat old, the latest Ubuntu they have is 20.04 (which has an EoL next year).
All that being said, 23/year is very cheap for a VPS, and for people in the US that use less than 500GB/month that’s the best deal I’ve ever seen.
There should be more deals when you click add services.
Understand on the latency possibly being an issue. I did see they have servers in France now. Maybe you could do some ping tests.
Thanks, I’m checking that out, but can’t find any “add services” button. Alsp someone mentioned IONOS, which is local to me and doesn’t seem to have bandwidth limits… I was trying to find the poop and they require lots of personal info just to get the account setup, still a bit torn there.
Unless you are behind CGNAT; you would have had the same plug+play experience by using your own router instead of the ISP supplied one, and using DDNS.
At least, I did.
Yes, but it does expose your own IP address and thus where you live. Tunnels don’t.
True, but the downside of cloudflare is that they are a reverse proxy and can see all your https traffic unencrypted.
Yes, but if you host a public site it might be a better option, the content is public anyway, and you won’t get doxed if you publish something controversial. It’s a trade-off, between keeping traffic private or keeping your IP private. Wireguard works best for private traffic, but you can’t host a public site with that.
deleted by creator
Your IP changes all the time, it doesn’t matter. The best someone can deduct from your IP is the country.
This is false. Some ISP’s change IP’s often, but some don’t and sometimes geoip lookups can be really accurate. My IP has remained the same since I moved in, and a geoip lookup results in a coordinate less than a kilometer away. It does matter.
I guess you live in a country with loads of spare IP addresses. Here in the UK they change every few days and IPs get rotated between all ISPs, so you can’t even deduct which ISP I’m using. And sometimes my IP is not even a mainland UK IP, but some weird shit from across the world, because Empire, lol.
When looking up my static ip, the location I get is the one of my ISP, not my address. Do you happen to live nearby some central infrastructure of your ISP? (If it seems otherwise, I’m not trying to debunk what you said - I’m just asking curious questions!)
Yes, it seems to be a hit or a miss. I don’t think I live near any central infrastructure or ISP, especially not this specific part of the city.
No. You are skipping DNS.
I didn’t skip it, I installed ddclient.
Cloudflare is the devil!
and using DDNS
As in, running software to update your DNS records automatically based on your current system IP. Great for dynamic IPs, or just moving location.
Not entirely. CF can protect you from DDOS of up to a few millions of calls per minute. Your home router would melt with that traffic. They also act as a firewall if you enable the proxy dns feature. They do a sanity check before forwarding the call. Also a home router cannot do this. And there’s more.
Sure, cloudflare provides other security benefits; but that’s not what OP was talking about. They just wanted/liked the plug+play aspect, which doesn’t need cloudflare.
Those ‘benefits’ are also really not necessary for the vast majority of self hosters. What are you hosting, from your home, that garners that kind of attention?
The only things I host from home are private services for myself or a very limited group; which, as far as ‘attacks’ goes, just gets the occasional script kiddy looking for exposed endpoints. Nothing that needs mitigation.
It’s almost like the big tech companies are really good at their jobs…
I prefer Tailscale Funnel for these kinds of things. NetBird and ZeroTier also work just fine if you don’t want to expose your services to the public.
I looked at headscale but as far as I can tell their is no active directory or SSO integration. Which is very unfortunate.
Good news, they support OIDC! Haven’t tested it myself so your mileage may vary.
Tailscale is so cool too. I’ll definitely be switching if I can ever use my own domains
I use Cloudflare as my registrar and public DNS. And only for that. Sorry but they don’t get to peek at my network traffic.
I mean, I used to think Google Public DNS was great until I switched to 1.1.1.1…
If you like 1.1.1.1 the. You should try 9.9.9.9. Or better yet host unbound pihole if you’re up to the challenge. Best dns experience I’ve had.
If you use 9.9.9.9, you should try Mullvad DNS (with adblocking) or AdGuard Public DNS
Since we’re all throwing out DNS options, I’ll toss in NextDNS
I already use pihole, but with cloudflared as the upstream. What benefits does unbound offer besides improved security?
It’s actually better privacy since it talks directly to the root servers instead of cloudflare knowing all of your DNS traffic. Quad9 is a good alternative with better data policies
So now your ISP sees all of your queries instead of CF. (Assuming the cloudflared option is using DoH)
I’ll trust Cloudflare over Comcast/AT&T/etc. any day of the week.
It looks like Quad9 supports DoH: quad9
You can run a VPN and tunnel your outbound DNS queries over that. Heck, you could tunnel your DNS queries over TOR
Your ISP knows where you’re going anyway. They don’t need DNS for that. They see all the traffic.
You might want to study more about SNI. Your ISP knows anyway
I know plenty account SNI already, but thanks. You might want to study more yourself, since we’re being condescending.
Well, running your own DNS server will also give you eSNI. And Cloudflare still doesn’t know anything
What benefits are you having from switching?
1.1.1.1/cloudflared responds crazy fast compared to anything else i’ve used. I really just wanted off Google (and before them OpenDNS). That’s about it.
Commenting as I am curious about this too!
Well, centralization and giving up your freedoms, letting someone else control you, is always kinda easy. Same applies to all the other big tech companies and their platforms. I’d say it applies to other aspects of life, too.
And I’d say it’s not far off from the usual setup. If you had a port forward and DynDns like lots of people have, the Dns would automatically update, you’d need to make sure the port forward is activated if you got a new router, but that’s pretty much it.
But sure. if it’s too inconvenient to put in the 5 minutes of effort it requires to set up port forwarding everytime you move, I also don’t see an alternative to tunneling. Or you’d need to pay for a VPS.
Their static website hosting is probably the best in the business. We seriously need some competition though.
I am out of the loop, what’s going in with snooping?
I use their cloudflared tunnel sometimes for accessing home hosted stuff.
Because Cloudflare acts as a reverse proxy it can see everything that happens in a session.
This is also known as a man in the middle attack. But Cloudflare meds to do this in order to do it’s checks for bad actors.Now, as Cloudflare has access to the unencrypted traffic and we know that NSA is all about data vacuuming due to the Snowdn leaks we can make a tin foil hat guess whaylt goes on.
Just note, OP, that the last part of his statement is pure speculation. The first part is technically true, which can lead to that inference, but no information has been released which corroborates it. However, that does not mean it’s not possible.
This is true. Which is why I said tinfoil hat guess.
Though those leaks showed they actually did it on a large scale. I don’t think they stopped for some arbitrary reason. Why would they? And technology developed further, surveillance is only getting easier. I’d say even without a tin-foil hat on, it’s more likely they do it than not.
I don’t understand why Cloudflare gets bashed so much over this… EVERY CDN out there does exactly the same thing. It’s how CDN’s work. Whether it’s Akamai, AWS, Google Cloud CDN, Fastly, Microsoft Azure CDN, or some other provider, they all do the same thing. In order to operate properly they need access to unencrypted content so that they can determine how to cache it properly and serve it from those caches instead of always going back to your origin server.
My employer uses both Akamai and AWS, and we’re well aware of this fact and what it means.
Thank you!
I have written a small blog post about how to Bypass CGNAT, and have also mentioned why you should not use Cloudflare if you are hosting for privacy.
Are there browser plugins (or other solutions) to see if an site uses cloudflare before visting?
I use cloud flare tunnel for my home server too. Are there any viable and somewhat easy alternatives?
As soon as I can use my personal domains with tailscale funnel I’ll be switching, I like tail scale a lot
DNS names are restricted to your tailnet’s domain name (node-name.tailnet-name.ts.net)
I guess that’s fine for some. Not a compromise I’m willing to make though.
Once configured, Tor Hidden Services also just work (you may need to use some fresh bridges in certain countries if ISPs block Tor there though). You don’t have to trust any specific third party in this case.
Wouldn’t that be slow?
It would. But it’s a good option when you have computationally heavy tasks and communication is relatively light.
DynDNS? I’m not 100% sure what CF Tunnel does, but from my 2 min reading it seems that DynDNS would accomplish what OP described just as well.
It might help to read it once more then 🙂
Oh, it’s way more than what any dyndns can do.
Port forwards in the router + DynDns.
also, when you have 5g failover on the router and the fiber it’s down, it automagically continues to work without admin intervention
Is there a way to do reverse tunnels, or something like it, so not opening any ports at all on the network, without cloudflare?
Closest to that XP I got was generating VPN keys and distributing them to close friends, running DDNS (no-ip) on my Pi with a pivpn server and then accessing JellyFin that way.
Rent a VPS, point DNS to it, have it act as central wireguard peer and connect your server(s). Then bridge incoming traffic to server via socat or firewall rules. Done
That’s a lot of work. Thanks though.
deleted by creator
