4 ms·

You don't like the overhead of VPNs, but you're okay with using this protocol that sits atop TCP/IP and encrypts traffic between your endpoint and Cloudflare?

• ThePhysicist 7y ago
  Well partially I'd say. A VPN creates a new network interface on my local computer through which I can then tunnel traffic to the destination HTTP server. A reverse proxy is just a server that accepts HTTP requests and forwards them to the destination server. In both cases the destination server would be configured to only accept traffic from the VPN or reverse proxy, and the VPN / proxy would perform additional authentication of the user before letting them connect through them. So in that sense they're similar, a VPN has more overhead though since we need ot install client software on any computer / device from which we want to connect, which can be cumbersome. On the other hand we can tunnel arbitrary IP traffic through the VPN and we can ensure that all traffic gets tunneled (which is not possible with a reverse proxy setup), so there are still cases where a VPN is the only solution. I can see the appeal of a more lightweight proxy-based tunnel for HTTP services (and one can come up with schemes for arbitrary TCP/UDP traffic as well, though not as elegantly as for HTTP, which already supports a "fan out" mechanism via the "Host" header). Since we can encrypt HTTP traffic using TLS between the client as well as the proxy and the destination the security should not be much worse than a VPN (though TLS leaks slightly more metadata as far as I know). What I don't like about Cloudflare's solution is that I have to trust them with my traffic, as they decrypt and re-encrypt it in transit. I'd rather have that done by a server that's under my control.
  • o-__-o 7y ago
    ...and then anyone beyond that server can watch and analyze your traffic./ so what’s the point of any server, cloudflare or otherwise?