4 ms·

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between yo

> But what if you could host a web service with no ports exposed? Well, you can! Cloudflare Tunnel makes a persistent outbound connection (a tunnel!) between your server and Cloudflare's nearest datacenter. All the traffic to your domain flows through this outgoing tunnel and connects to your server through the protection of Cloudflare. This also has the benefit of being seamlessly encrypted, so you don't have to worry about a thing when it comes to the security of your web service. Well, a port is exposed, it's just exposed on Cloudflare's reverse proxies. And I think this is probably a dramatic overstatement of the security that Cloudflare provides...

h4waii 5y ago
No no, it's encrypted so you can just completely ignore the security of your web service. * Broken auth? Doesn't matter, encrypted. * IDOR? Encryption takes care of it! * Blind SQL or something from the 90s? EEENNNNCCCRRYYPPPTTIIOOONN!
- johnhenry 5y ago
  > ... you can just completely ignore the security of your web service Be weary of such absolute statements -- especially when it comes to security.
  - gmadsen 5y ago
    you are replying to a sarcastic comment that agrees with you..
- diarrhea 5y ago
  They probably use military-grade hashes too. So you know it is very secure indeed.
- sascha_sl 5y ago
  To be fair, this feature is part of Cloudflare's ZeroTrust offering, so you're meant to put a policy in front of it and forget it. This is great for getting extremely old legacy services that previously relied on VPN network trust onto an actual SSO provider instead.
username_my1 5y ago
and the fact that all your data will flow through cloudflare and they decide how to use it.
deleted 5y ago
[deleted]
judge2020 5y ago
The point is that it's connected via NAT, so you don't have to worry about port scanners hitting your origin IP and seeing any info about your web server (potentially exposing it to DDOS), and it's overall easier when you don't have to touch your inbound firewall.
- brightball 5y ago
  Could an origin server run a port scanner through the tunnel and hide the origin of the scan?
  - rank0 5y ago
    Well sure the scan would appear to come from cloudflare. But it’d be pretty easy for cloudflare to then identify the tunnel user as the source of the scans.
- qeternity 5y ago
  I understand that. That doesn't mean you don't have to worry about security. Most stacks would crumble under a relatively small L7 ddos that Cloudflare would not likely mitigate.
  - janto 5y ago
    https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/ https://www.cloudflare.com/learning/ddos/glossary/web-applic...
    - qeternity 5y ago
      We are die hard Cloudflare customers, I am speaking from experience. They are phenomenal, but they aren’t magic.
      - janto 5y ago
        What do you then mean by a "relatively small L7 ddos that Cloudflare would not likely mitigate"? It seems to me that their WAF would mitigate that and I can worry even less about threats.
rank0 5y ago
Well their WAF and dos protection are pretty nice. An easy secure setup would be to spin up a guest VM and isolate it in its own subnet. Disable routing between your guest and the rest of your lan and you can sleep easy at night so long as your app doesn’t serve any crazy dynamic content.
- superkuh 5y ago
  "Walking around covered in body armor and allowing the military to drive me to work in a tank" is nice protection but it's also very restrictive. I don't think the argument against this is so much that Cloudflare doesn't provide nice features as that those features are entirely unneeded for 99.99% of people hosting from home. The downsides of heavy protection are vastly increased complexity and dependence on a non-'dumb pipe' non-ISP corporation which kind of defeats the point of hosting from home. You really can just host your webserver from home network and forward the port using your consumer grade router and consumer home connection most of the time and nothing bad happens. But this kind of tunneling would be great for when you have a bad ISP that blocks port 80 instead of just saying servers aren't allowed.
  - rank0 5y ago
    Lmao your response made me chuckle. You're entirely right! Probably nothing bad will happen. Especially if you partition your network like I mentioned in my OP. I would get worried about somehow enabling access to defects in my router by opening some inbound ports. I realize that's a little paranoid...but recently I have been playing around with https://github.com/threat9/routersploit https://github.com/threat9/routersploit and routinely find defects in consumer routers. Here's my other beef with cloudflare: Once I gotta pay 200+/mo for their security services or whatever, I could just rent out a private rack in a colocation and throw some old beefy lga-2011 xeon hosts. Now I don't need anything on my LAN exposed and I have dedicated IPs, physical security, and backup generators...etc.
    - Karrot_Kream 5y ago
      > Here's my other beef with cloudflare: Once I gotta pay 200+/mo for their security services or whatever, I could just rent out a private rack in a colocation and throw some old beefy lga-2011 xeon hosts. Now I don't need anything on my LAN exposed and I have dedicated IPs, physical security, and backup generators...etc. Yeah but now you need to source the hardware for the rack, make sure it stays up and there's no hardware failures, etc, etc. Even simpler is to grab a Linode dedicated box which comes with v4 and v6 IPs and you get all the benefits for only $30 / mo instead.

h4waii 5y ago

No no, it's encrypted so you can just completely ignore the security of your web service. * Broken auth? Doesn't matter, encrypted. * IDOR? Encryption takes care of it! * Blind SQL or something from the 90s? EEENNNNCCCRRYYPPPTTIIOOONN!

johnhenry 5y ago
> ... you can just completely ignore the security of your web service Be weary of such absolute statements -- especially when it comes to security.
- gmadsen 5y ago
  you are replying to a sarcastic comment that agrees with you..
diarrhea 5y ago
They probably use military-grade hashes too. So you know it is very secure indeed.
sascha_sl 5y ago
To be fair, this feature is part of Cloudflare's ZeroTrust offering, so you're meant to put a policy in front of it and forget it. This is great for getting extremely old legacy services that previously relied on VPN network trust onto an actual SSO provider instead.

username_my1 5y ago

and the fact that all your data will flow through cloudflare and they decide how to use it.

deleted 5y ago

[deleted]

judge2020 5y ago

The point is that it's connected via NAT, so you don't have to worry about port scanners hitting your origin IP and seeing any info about your web server (potentially exposing it to DDOS), and it's overall easier when you don't have to touch your inbound firewall.

brightball 5y ago
Could an origin server run a port scanner through the tunnel and hide the origin of the scan?
- rank0 5y ago
  Well sure the scan would appear to come from cloudflare. But it’d be pretty easy for cloudflare to then identify the tunnel user as the source of the scans.
qeternity 5y ago
I understand that. That doesn't mean you don't have to worry about security. Most stacks would crumble under a relatively small L7 ddos that Cloudflare would not likely mitigate.
- janto 5y ago
  https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/ https://www.cloudflare.com/learning/ddos/glossary/web-applic...
  - qeternity 5y ago
    We are die hard Cloudflare customers, I am speaking from experience. They are phenomenal, but they aren’t magic.
    - janto 5y ago
      What do you then mean by a "relatively small L7 ddos that Cloudflare would not likely mitigate"? It seems to me that their WAF would mitigate that and I can worry even less about threats.

rank0 5y ago

Well their WAF and dos protection are pretty nice. An easy secure setup would be to spin up a guest VM and isolate it in its own subnet. Disable routing between your guest and the rest of your lan and you can sleep easy at night so long as your app doesn’t serve any crazy dynamic content.

superkuh 5y ago
"Walking around covered in body armor and allowing the military to drive me to work in a tank" is nice protection but it's also very restrictive. I don't think the argument against this is so much that Cloudflare doesn't provide nice features as that those features are entirely unneeded for 99.99% of people hosting from home. The downsides of heavy protection are vastly increased complexity and dependence on a non-'dumb pipe' non-ISP corporation which kind of defeats the point of hosting from home. You really can just host your webserver from home network and forward the port using your consumer grade router and consumer home connection most of the time and nothing bad happens. But this kind of tunneling would be great for when you have a bad ISP that blocks port 80 instead of just saying servers aren't allowed.
- rank0 5y ago
  Lmao your response made me chuckle. You're entirely right! Probably nothing bad will happen. Especially if you partition your network like I mentioned in my OP. I would get worried about somehow enabling access to defects in my router by opening some inbound ports. I realize that's a little paranoid...but recently I have been playing around with https://github.com/threat9/routersploit https://github.com/threat9/routersploit and routinely find defects in consumer routers. Here's my other beef with cloudflare: Once I gotta pay 200+/mo for their security services or whatever, I could just rent out a private rack in a colocation and throw some old beefy lga-2011 xeon hosts. Now I don't need anything on my LAN exposed and I have dedicated IPs, physical security, and backup generators...etc.
  - Karrot_Kream 5y ago
    > Here's my other beef with cloudflare: Once I gotta pay 200+/mo for their security services or whatever, I could just rent out a private rack in a colocation and throw some old beefy lga-2011 xeon hosts. Now I don't need anything on my LAN exposed and I have dedicated IPs, physical security, and backup generators...etc. Yeah but now you need to source the hardware for the rack, make sure it stays up and there's no hardware failures, etc, etc. Even simpler is to grab a Linode dedicated box which comes with v4 and v6 IPs and you get all the benefits for only $30 / mo instead.