Just getting started with self hosting. I was wondering if anyone had experience with Cloudflare Tunnels for exposing their services to the internet. I like the simplicity and security it offers but don’t love the idea of using Cloudflare. Like, I’m self hosting for a reason lol. Any tips would be greatly appreciated!
For context, I’m running all of my services in a very small k8s cluster and my priorities are mostly security then maintainability. Thanks yall!
EDIT: yall are great! Thank you so much for the replies. I’m going try my luck with pangolin but its good to know I have options.
I love it, but I’m also a hypocrite. Centralized internet is bad but cloudflared is incredible.
I’m in the same boat. I love that it makes self hosting easier for me. It does what I need and even gives me a small extra measure of security. I admit, I use it because I’m lazy, I could do it without Cloudflare and do for some services. So, I figure if it truly becomes urgent or intolerable I can drop it from the stack.
Serious limits on Cloudflare Tunnels:
- Only works if you use Cloudflare as your domain registrar for that domain
- You can’t use it for anything high bandwidth, specifically including streaming media (e.g. Plex/Jellyfin)
- They reserve the right to terminate your service tunnel randomly at any time without warning for any/no reason unless you pay them for the service.
And that doesnt address the issue of getting in bed with Cloudflare (which has its own ethical ramifications).
I’d recommend one of the alternatives like localxpose.io that offer the same thing but without the limitations. Or you can slap together your own with a wireguard tunnel to a minuscule VPS with some routing rules on it. Both are about €5/month, which is cheaper (the same?) as paying for Cloudflare Tunnel to avoid the random termination and vendor lock in.
I heard you can use Pangolin and self host your own tunnel.
Haven’t looked into it.
Hosting the tunnel is the only real value add from these services, which is why I’m confused by Pangolin’s business model.
For #3 every service will say something like that, even with paid accounts.
Regarding #1, you have to use Cloudflare for DNS but it doesn’t matter if they are your domain registrar or not.
I only used their quick tunnels for some testing as it doesn’t need a domain and natively runs under Termux. For that at least it worked fine.
But I probably wouldn’t use them for anything serious. Typically you’re doing everything to avoid MITM, and now this is just the opposite of that.Pangolin is also pretty straight forward. I set it up a few months ago to test out on a new server I was firing up and I’ve decided to just switch all my other servers running nginx-proxy-manager over to it.
Also, if you’re just accessing it yourself and have maybe a handful of people who’d be using it, I’d recommend just setting up Headscale.
TLDR: Pangolin or Nginx-Proxy-Manager or Tailscale + one of the previously mentioned reverse proxy solutions.
Pangolin is great, I can expose things like game servers on it and have my entry point in a geographically close data center to keep the ping time lower than other options would let me.
I’m currently trying out the managed self hosted version, it seems a bit slower, but you also get ha with it which is pretty cool.
I wish I could like it. I followed the install directions to a tee, had it working, came across a random bug, hasn’t worked since. Posted an issue and devs said it must be related to using IPv6, but I’m using IPv4. That was a week ago. This is my second time installing by the way, the first time had other issues.
I’m just bummed because I spent all night changing all my services and DNS to Pangolin after it was working fine, then waking up to find all of them have failed. Had to revert to Cloudflare and I’m probably going to need to spin up another VPS if devs aren’t sure either.
Cloudflare is very popular, there should be plenty people around with experience. And Cloudflare is convenient and fairly easy to use. I wouldn’t call them “secure” though. I mean that depends on your definition of the word… But they terminate the encryption for you and handle certificates, so it’s practically a man-in-the-middle, as they process your data transfers in cleartext. But as far as I know their track-record is fine. I have some ethical issues because they centralize the internet and some of their stuff borders on snake-oil… But it’s a common solution if you can’t open ports in your home internet connection, need some caching in front of your services, something to block AI scrapers, or you need a web application firewall as a service.
100% agree. That’s why I don’t exactly love the idea of using them more…
Seems some people here advocate for a VPS, and I do it as well. I pay roughly 7€ a month for a small(ish) server with 4 cpu cores, 8GB of RAM and 256 GB of storage. That allows me to host a few services there, for example some websites and matrix chat, which I don’t want to go down if there’s an issue at home. And it allows me to do reverse proxying there, so I have the entire chain under my control. But there’s many ways to do it, and several other tunneling solutions (boringproxy.io, nohost.me, pagekite, ngrok, …) that I heard of.
And a lot of home internet connections allow port-forwarding. Not sure what your provider does, but I can simply open ports in my router and make them accessible from the outside, no VPS or Cloudflare needed. That’d be the direct solution. (And what I use for my personal services on my NAS.) Just mind that discloses your internet connection’s IP address to visitors, so they’ll learn the name of your provider and your rough location.
You can (and I do) terminate TLS locally and have your data encrypted through the tunnel. Use Traefik/Caddy for easy automated certs with containers or whatever flow you prefer to automate acme certs provisioning locally. You’ll have to configure your tunnel to hit a local DNS so it can route the domain to your local IP instead of the public records on the tunnel or use a secondary domain for the local termination.
I’m fairly sure what you mean is, traffic is decrypted in the middle and the re-encrypted before it gets sent your way. Otherwise they couldn’t do proxying or threat detection/mitigation.
You’re right, sorry, that was a heavy brain fart. The data needs to be decrypted on cloudflare’s end before being proxied and send to your services.
I just started using them and I like it. It’s a good balance of easy and secure for me. I just added the container to my stack and then use their UI to point a subdomain at the internal port. Security can go pretty extreme if you set up their whole zero trust thing.
An alternative similar option is Pangolin. I’ve seen a lot of people like it to avoid Cloudflare, but I haven’t used it myself. There still has to be an endpoint running it, so you’ll need an external VPS, which then adds a cost to the equation but at least you control it.
Cloudflared CLI for reverse proxy is as dummy proof as hosting a hidden onion site over Tor. I like it’s simplicity but I know I’m relying on a non free network.
If you want to self host, rent some cheap server somewhere (I use Hetzner) the will act as a proxy and then configure frp.
It’s basically what Cloudflare tunnel does, except you need to provide the public server instead of Cloudflare giving you one for “free.”
Two of my coworkers with kubernetes homelabs use the Helm Chart deployment of this and they like it very much. All my domains are in Cloudflare so this is a no brainer.
I would like to try this with their SSO offering so that I could just handle auth at the tunnel instead of something like Dex in front of each service in the cluster.
@WhosMansIsThis@lemmy.world You Could in theory just use wireguard with nginx.
DNS pointing to Public VPS -> Nginx running on public vps -> Nginx resolving to internal wg IPS -> Any of your other devices.
What is the advantage of using a tunnel vs dynamic DNS directly to your home IP address?
It only requires an outbound connection, which is needed if you’re stuck on CGNAT. It also provides DDoS protection and hides your IP address. It comes with the huge downside of using Cloudflare though.
I just found out about cloudflared, it looks straightforward but you need a cloudflare account to use it. IDK what (if anything) they charge for it.
I have generally just used a VPS for this. I’ve done it through an ssh reverse proxy which is pretty crappy, but a more serious approach would use iptables forwarding or wireguard or whatever the current hotness is.
No, there’s a very generous free tier on CF.
I switched to it because the ISP blocked ports 80/443. It was good and things actually got a bit faster with them handling SSL certs.
but one thing to note is that the free tier has a 100MB file limit. I got around some of that by using the tail scale vpn with a custom domain entry to point to the local network.
I did these changes (wire guard to tail scale, dns to tunnels, etc) at different times, which is why things aren’t very consistent.
Why are you involving Cloudflare at all at that point? It sounds like you setup your own “Tunnel” service using Tailscale and/or direct Wireguard already.
cloudflare happened first and I haven’t been bothered to change it yet
I used a cloudflare tunnel for streaming music in jellyfin. Didn’t so much else with it and it worked pretty well. Anything high bandwidth you should use something else, but for stuff that doesnt consume a ton of bandwidth like music streaming in my case, it worked fine, at least when I used it a few years back.
It’s easy to use and takes away some of the hassle.
If you don’t like cloudflare you could find a VPS you do like and run Pangolin on it to get the same service but maybe not the same level of protection.
I use Oracle’s free tier to host it. They’re probably worse than cloudflare though as far as evil corporations go.
I’m using Pangolin, which is the current hotness. It’s somewhat like cloud flare tunnels, but you need a VPS (find a cheap one). That tunnels back to your house. I opted into using crowdsec as another later. It’s a part of their setup process.
So what benefit does Pangolin actually provide then if you already have to provide the VPS? Routing back to your network from a VPS is trivially easy, it’s getting the affordable VPS (given bandwidth prices) that’s actually the sticking point of any solution.
Over cloudflare, it’s knowing you’re the man in the middle and not some company. It has a few other things like zero trust, and an authentication layer.
I use racknerd for VPS and it’s about $35/year. So definitely one of the cheapest part of my home lab.
The Racknerd $35/yr seems to be the 500MB RAM VPS with a 500GB/mo network data limit. That’s probably sufficient power for a wireguard endpoint for ingress, but that’s pretty low network data limit if you’re putting a media server behind it (10GB/hr of video isn’t unexpected, data is counted twice when having to ingress+egress thru the endpoint=25 hours of quality video per month)
Use the their New Year deals and get 7000 gb monthly transfer with 3.5 GB RAM. Only $32.49/year
