9 ms·
Show HN: Inlets – Expose your local endpoints to the Internet
- moltar 8y agoSo it’s like ngrok?
- gruez 8y agoFrom the readme: >Why do we need this project? Similar tools such as ngrok or Argo Tunnel from Cloudflare are closed-source, have limits built-in, can work out expensive and have limited support for arm/arm64. Ngrok is also often banned by corporate firewall policies meaning it can be unusable.
- jgrahamc 8y agoSource code of Cloudflare's Argo Tunnel: https://github.com/cloudflare/cloudflared https://github.com/cloudflare/cloudflared
- avip 8y agongrok v1 is open source.
- arethuza 8y agoUnfortunately: "DO NOT RUN THIS VERSION OF NGROK (1.X) IN PRODUCTION. Both the client and server are known to have serious reliability issues including memory and file descriptor leaks as well as crashes. There is also no HA story as the server is a SPOF. You are advised to run 2.0 for any production quality system." https://github.com/inconshreveable/ngrok https://github.com/inconshreveable/ngrok NB I've used ngrok and think it's very useful, but it's not really open source
- barbecue_sauce 8y agoWhy would anyone run ngrok "in production" anyway? I thought it was just a tool for briefly making your computer into a publicly available server?
- stronglikedan 8y agoBecause, if it's possible, someone will do it.
- arethuza 8y agoI've used it for demos - which aren't production but I'd really prefer if it didn't crash!
- duiker101 8y agoMake a small prototype and show it to your boss, they now think it's fully working (Prototype/WIP/etc... means nothing to some people) and they start to show it around aaaand before you know it you are hosting a new company's website.
- arbie 8y ago> Make a small prototype and show it to your boss, they now think it's fully working (Prototype/WIP/etc... means nothing to some people) and they start to show it around aaaand before you know it ... What is the best way to avoid this trap, short of making your prototypes purposefully buggy and incomplete?
- duiker101 8y agoI am afraid that even that would not work, in my opinion the best solution is be aware of it and try to always have prototype that you are confident enough you could release and keep working on.
- thecatspaw 8y agoWipe data every X days and display a huge red header warning of this.
- dspillett 8y ago> is also often banned by corporate firewall policies meaning it can be unusable If this tool offers similar functionality, as soon as it becomes well-known it too will "be often banned by corporate firewall policies meaning it can be unusable". Welcome to an arms race!
- pingiun 8y agoIt would be difficult to ban this as it looks like regular https traffic
- rohan1024 8y agoWe will not need these solutions after complete ipv6 migration, right? Or it also has some NAT equivalent?
- exrook 8y agoUnless a firewall on your network is blocking incoming connections to your IPv6.
- dsr_ 8y agoYou won't need these solutions in any situation where your IT organization is cooperative and responsive to the company's needs.
- avip 8y agoSometimes you don’t have “an IT organization”. Think demo day with an IoT device. God bless ngrok.
- dsr_ 8y agoYou're going to do a demo of a network connected device in a new place? Bring your own network. If you can bring all the parts with you, that's even better -- a self-contained system that has no external dependencies is best. If you absolutely need network connectivity, bring a cellular-wifi hotspot that you've already tested. Talk to the site organizer to find out what cell networks work there, and if you need to, buy a SIM in advance. If you don't have an IT organization, you are the IT organization, so be a good one.
- jsjohnst 8y agoWhile I emphatically agree with you, if the person doesn’t know what they are doing, following your advise can cause major havoc too. As someone who has hosted hack days in many countries on six continents and prides himself on providing a reliable and friendly network (including hand-on supporting IoT folks) for said events, it’s really freaking annoying when someone starts blasting their AP at ridiculous power levels for their one-off use case effectively muddying to hell the RF spectrum of the event space.
- gmac 8y agoSee also: http://localhost.run/ http://localhost.run/
- tdhz77 8y agoI will use this to get letsEncrypt Certs for intranet pages. Self sign certs just seem so dangerous. And I want to renew every 30 days and not 100.
- rhn_mk1 8y ago> Self sign certs just seem so dangerous. Why are they dangerous? Is that because they need to be manually added to applications, and no one bothers to do that?
- zaarn 8y agoThere is nothing dangerous about self-signed certs, browsers show you a warning because it doesn't know if it should trust the cert. If you add your CA to the trust store then you can sign your localhost certs.
- zeveb 8y ago> If you add your CA to the trust store then you can sign your localhost certs. Not necessarily. Google have decided that Android users can't be trusted to install their own certificates. I don't know if Apple will permit it, either.
- stenioaraujo 8y agoYou can achieve this without exposing any service. Let's Encrypt allows you to prove ownership of a domain through DNS 01 hooks. I personally use Duck DNS [1] for main internal domains, so I can have a certificate that most tools will recognize as valid. This saves me from adding my cert in every machine that will use that service. I use dehydrated [2] to get a Let's Encrypt certificate using Duck DNS. There is a good article explaining that by Andreas Gohr [3]. [1] - https://www.duckdns.org/ https://www.duckdns.org/ [2] - https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated [3] - https://www.splitbrain.org/blog/2017-08/10-homeassistant_duckdns_letsencrypt#set_up_duckdns https://www.splitbrain.org/blog/2017-08/10-homeassistant_duc...
- gesman 8y agoOr zerotier (to do it safely)
- thunderbong 8y agoThere's also a roll your own version if you have a domain https://jerrington.me/posts/2019-01-29-self-hosted-ngrok.html https://jerrington.me/posts/2019-01-29-self-hosted-ngrok.htm...
- disiplus 8y agohttps://github.com/mmatczuk/go-http-tunnel/blob/master/README.md https://github.com/mmatczuk/go-http-tunnel/blob/master/READM... there is also this that I used instead of ngrok
- adnanh 8y agoWhy wouldn't one use SSH tunnels instead of this/ngrok?
- omegabravo 8y agomy glorious corporate firewall doesn't allow any traffic other than on ports 80,443
- adnanh 8y agoinbound, outbound, or both?
- omegabravo 8y agoonly outbound connections permitted
- x0x0 8y agoI'd ask for approval in writing from my boss to play this game. If received, you could perfectly well set up a $6 digital ocean box and ask sshd to listen to 443. Then... ssh -R 443:localhost:3000 -N my_remote-server is a perfectly good outbound connection? Obviously, you'll want some iptables on the remote end or for your local box not to have anything valuable on it, but it will let you test webhooks.
- wut42 8y agoI run an sshd on 443 for this reason. Helped me bypass some corporate firewalls in the past, very useful when you go onsite.
- nijave 8y agoThere's this little gem that uses websocket tunnels for all those times only http is allowed. https://github.com/jpillora/chisel https://github.com/jpillora/chisel A lot of modern websites rely on websockets for push notifications so they're usually open. It works wonderfully for things like public WiFi where all traffic is sent through an HTTP proxy and everything else blocked
- ithkuil 8y agosimilar idea (shameless plug) https://github.com/bitnami-labs/udig https://github.com/bitnami-labs/udig
- rhardih 8y agoAlso https://localtunnel.github.io/www/ https://localtunnel.github.io/www/
- irl_ 8y agoFor additional security, instead of exposing your internal services to the Internet, communicate using a Tor Onion service. It handle NAT for you, and can be very resilient (you have 6500 servers that can act as a rendezvous point in the Tor network instead of just the 1 VPS). It's not going to give you the same low latency and high throughput as putting the service straight on the Internet but it's going to be difficult to match the security (for confidentiality, integrity and availability) properties any other way.