7 ms·
VPN service for hosting public-facing services on non-hosting ISP circuits
- giancarlostoro 7y agoNice but be careful when doing this sorta thing at work that you dont compromise company policy.
- diminoten 7y agoOh jesus don't do this at work without permission!
- leetbulb 7y agoIt might just be me, but I feel like this is going to be abused...badly. I know of a few other similar services that have had huge abuse issues.
- geocrasher 7y agoYeah, the very first thing I thought of was along the lines of "Oh, so this is how attackers will compromise a machine and run http://my-favorite-bank.com.holepunch.io/login-and-give-me-all-your-moneys http://my-favorite-bank.com.holepunch.io/login-and-give-me-a... on a compromised computer." I do see the benefit of the service, but I think it would be cool if they offered a self-hosted version. A LowEndBox for $20/year gets you a box and an IP to tunnel through.
- jlogsdon 7y agoI am using a free tier instance in GCP and using tinc to accomplish exactly this. It's not "click and play" but setting it up is simple. If I ever outgrow the f1-micro its easy enough to add another node with a public IP. It has the added benefit of being a full-on VPN, though I don't generally use it for regular internet browsing.
- fulafel 7y agoWell, this is working around externally imposed lack of internet connecivity after all. It might be called abuse by your local Mordac^Wperson disagreeing with you about risk assessments. You may want to try getting your net fixed, as an alternative to this proxying.
- sandov 7y agoI'll try to use this for SSH. What's the best way to embed an SSH session inside of HTTP requests?
- fulafel 7y agostunnel?
- graton 7y agoUsually you can just port forward a port above 1024 on your router to port 22 (SSH) on your computer inside your home network. This has worked for me for the ISPs I have used.
- cbluth 7y agohttps://github.com/jpillora/chisel https://github.com/jpillora/chisel
- vinay_ys 7y agoIt seems to be using ssh to tunnel your http connection in the first place. So, if ssh is blocked in your network, this won't work.
- lohszvu 7y agoThat's not how networking works. Incoming connections are usually blocked which is what this is for. It punches a hole through your firewall by using an established ssh tunnel to forward traffic over. You don't need to allow incoming anything to use this service
- avh02 7y agoYes, but there are organizations that block outgoing ssh connections.
- iamnothere 7y agoRunning SSH as a Tor service might be easier if you're confident in the security of your SSH setup. (Key authentication is highly recommended for any public-facing SSH setup.) https://www.howtoforge.com/anonymous-ssh-sessions-with-tor https://www.howtoforge.com/anonymous-ssh-sessions-with-tor
- fulafel 7y agoThis might actually be the future of running net-accessible stuff on your own devices, if the NAT-imposed unreachability continues to cement itself as the default expectation for people. Great that they have a free tier. Though I think you can do this same thing with many existing tunnel providers too, no?
- sdwisely 7y ago> This might actually be the future of running net-accessible stuff on your own devices I sure hope not, demand ipv6.
- fulafel 7y agoYes, this kind of proxying is the plan D.
- altfredd 7y agoPossession of an IPv6 address does not automatically imply that your ISP allows incoming connection to your ports.
- sdwisely 7y agoport blocking is a whole other problem. I'm referring to the rapidly growing number of people behind CGNAT.
- thinkmassive 7y agoTor is another helpful tool for working around NAT.
- steve_taylor 7y agoHow does this compare with ngrok?
- old-gregg 7y agoWhy don't you find out and tell us?
- stedaniels 7y agoThe website looks good. Obviously early days since pricing is missing. Probably sorting out value proposition, how much they can get away with charging, etc. A comparative point is using Cloudflare and Argo tunnel which I'm currently using.
- Tepix 7y agoIf you are technically capable to set it up by yourself using OpenVPN, you can get a dirt cheap VPS with one IPv4 address for less than $1/month ($12/year). lowendtalk.com is a community that discusses these deals.
- dannyw 7y agoMy experiences have been that these businesses generally disappear after a few months and leave you holding the bag, with a service disruption and data loss. Recommendations for any “low end box” that’s about $12 a year and not a fly by night scam would be appreciated.
- lohszvu 7y agoI've used hostus and alpharacks for multiple years at that price range.
- vinay_ys 7y agoLooking through the https://github.com/CypherpunkArmory/punch/blob/master/tunnel/tunnel.go https://github.com/CypherpunkArmory/punch/blob/master/tunnel... seems to indicate it is just using a ssh connection between your box and their server and then forwarding traffic through that ssh connection. If ssh is blocked by your IT admin, this will not work. In that sense this isn't doing any holepunching. In a more traditional definition of holepunching it meant to establish connection between two machines behind NAT stateful firewall and neither have static public IP addresses. Also, looking at the code, there seems to not much emphasis on security w.r.t ssh host key verification or bootstrapping the chain of trust with pre-verified credentials etc. Weird choices for a project with cypherpunk in it's name.
- prater 7y agoAuthor here. You're right. The project is still in beta - so we're still working on ironing out some of the kinks. The host key verification issue is being worked on today actually. I'm not sure what you mean by "bootstrapping the chain of trust with pre-verified credentials" though. If you want to open an issue on https://github.com/CypherpunkArmory/holepunch https://github.com/CypherpunkArmory/holepunch we'd love to get your feedback about how we can improve security prior to a general release.
- CodeWriter23 7y agoTypo: “With our low cost, secure tunneling service, you won't run out __or__ reasons or ways to use it.“
- mirimir 7y agoAnother option is algo using wireguard with port forwarding. https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- syntonym 7y agoI'm really confused why this creates an IPsec server AND an wireguard server, or do I read that wrong? Managing two server which basically do the same thing seems to double the attack surface without any gains. One selling point of wireguard is to be an easier but still as least as secure alternative to IPsec.
- random45345 7y agoRemind me of http://pagekite.net http://pagekite.net It has been around for a few years, their software is open source and seems pretty easy to use. Never used it myself though so I cannot vouch for their stability.
- EugeneOZ 7y agoNever shut down your computer and pay electricity bills. Don't reboot too often. And hope your provider will never have outages. I know, some people have always-on computers, some people have low prices for electricity, some don't care about downtimes. But it all looks so fragile, too many "if". If only there would be some layer to cover main instance outages...
- ronsor 7y agoThere's also Serveo[0] which I use pretty often: [0] https://serveo.net https://serveo.net
- Ttlequals0 7y agoThis is an option to build on demand disposable openvpn endpoints on AWS https://github.com/ttlequals0/autovpn https://github.com/ttlequals0/autovpn
- righteous 7y agoSo its ngrok with a prettier website. Neat.
- peter_d_sherman 7y agoLooks like a service many people could use -- I wish you the best of luck in your business endeavor! One thing I'd like to see though is an "About Us" page, if you're a company; or maybe a link to your LinkedIn profile if you're an individual... Reason: I'd like to know more about the company or person that I'd be dealing with before establishing a business relationship... I'm sure I'm not alone, either. Anyway, best of luck with your venture!