3 ms·

Setup a competitor to Cloudflare tunnel. People want to host Internet services from their homes. They don't have static IPs, and/or they don't want to open the

Setup a competitor to Cloudflare tunnel. People want to host Internet services from their homes. They don't have static IPs, and/or they don't want to open their home IP address directly to the public, for good reason. You can setup some wireguard servers with static IPs. Then people can tunnel their services running at home through your servers. They avoid the cost of having to pay for cloud hosting, and you provide a shield so that they aren't exposed. Obviously, the IP addresses on their own aren't enough to make this work. You're going to need some computing infrastructure. But you won't need lots of storage and compute. You'll mostly need bandwidth and networking equipment. The thing is, getting IP addresses is harder than getting hardware and bandwidth. You already did the hard part.

westhanover 3y ago
The hard part is when all of the malware c&c and CP is now being served from your network.
- lagniappe 3y ago
  You know, at some point, in the interest of a free internet we should consider whether penalizing the mostly-benevolent-cogs along the way is the right way to go about it. It's not like someone operating that service is specifically consenting to every packet that flows through them so it shouldn't be treated in a court room as if they gave their explicit blessing for whatever malfeasance came to happen. I don't accept the argument that by attempting to benefit the common good that one must be responsible for what happens or how that's used. Many items and actions of good will can be weaponized, in ways that the media finds odious like the things you mentioned, but nobody comes after the cell phone operators, the ISPs, they attack the weak link that cant afford representation in court - the solo and small operators. It's stupid and I'm surprised it fools the voter base in the current epoch.
  - jve 3y ago
    The moment you give someone an opportunity to create outbound connection to port 25 from your IP, you are certainly risking (well, guaranteeing) those IPs to be listed at various blocklists. And you will be the one that will have to deal with abuse complaints.
  - cdchn 3y ago
    Unfortunately its intractable to separate oblivious rubes from willing accomplices. Thankfully we have common carrier protection laws that people can argue they're protected by or not.
- KomoD 3y ago
  Yeah, that's a huge issue. Like, just look at Playit.gg, they have issues with both ip blacklists and domain blacklists (+ safe browsing warnings) T-Mobile is a big one that apparently blocks their ip ranges.
paxys 3y ago
Why would you need unique IPs for this? This entire setup can work perfectly fine with a single public IP address if needed.
- icedchai 3y ago
  That won't work if you want reuse incoming port numbers across customers.
- Libcat99 3y ago
  I'm not sure it can? My interpretation of what's been suggested is basically an ip you can port forward, as if you had a public ip. For example, let's say you want to run a minecraft server for your friends from your home. You use this hypothetical service to get an ip you can use, and tunnel the needed ports in to your network (and ultimately, your minecraft server). This couldn't be provided with a single ip, since at best that would limit you to selling off individual ports. The product becomes worthwhile if each customer has their own ip.
  - semi 3y ago
    You can still do it off of one IP but it becomes more expensive as you now have to understand the protocol, and to route based on the handshake. For tls1.2, that's usually routing based on server name identifier in the ClientHello and you can do it pretty trivially For Minecraft.. you would probably need to write your own proxying logic. But as long as the protocol includes some info on what it's trying to connect to you could still do it. Alternatively you could do it like the old quakeworld spectator proxies and just write a custom Minecraft server people connect to that then presents a menu in game to pick a server that it then connects to.
    - Libcat99 3y ago
      It's a very different product then. The fixed ip product more or less lets a user use it for anything they could with their own static ip. The single ip product only allows the end user to use protocols for which you have built forwarding logic. For some, like sip or http, this would be simple, but for others you would need a much higher understanding of the application protocol. One is a geeks Swiss army ip, the other is "now you can self host one of these 5 services, some or which might stop working if the application makes breaking changes."
atomicnumber3 3y ago
Ngrok already exists, so between them, cloudflare, and tailscale, this market already has a lot of players.

westhanover 3y ago

The hard part is when all of the malware c&c and CP is now being served from your network.

lagniappe 3y ago
You know, at some point, in the interest of a free internet we should consider whether penalizing the mostly-benevolent-cogs along the way is the right way to go about it. It's not like someone operating that service is specifically consenting to every packet that flows through them so it shouldn't be treated in a court room as if they gave their explicit blessing for whatever malfeasance came to happen. I don't accept the argument that by attempting to benefit the common good that one must be responsible for what happens or how that's used. Many items and actions of good will can be weaponized, in ways that the media finds odious like the things you mentioned, but nobody comes after the cell phone operators, the ISPs, they attack the weak link that cant afford representation in court - the solo and small operators. It's stupid and I'm surprised it fools the voter base in the current epoch.
- jve 3y ago
  The moment you give someone an opportunity to create outbound connection to port 25 from your IP, you are certainly risking (well, guaranteeing) those IPs to be listed at various blocklists. And you will be the one that will have to deal with abuse complaints.
- cdchn 3y ago
  Unfortunately its intractable to separate oblivious rubes from willing accomplices. Thankfully we have common carrier protection laws that people can argue they're protected by or not.
KomoD 3y ago
Yeah, that's a huge issue. Like, just look at Playit.gg, they have issues with both ip blacklists and domain blacklists (+ safe browsing warnings) T-Mobile is a big one that apparently blocks their ip ranges.

paxys 3y ago

Why would you need unique IPs for this? This entire setup can work perfectly fine with a single public IP address if needed.

icedchai 3y ago
That won't work if you want reuse incoming port numbers across customers.
Libcat99 3y ago
I'm not sure it can? My interpretation of what's been suggested is basically an ip you can port forward, as if you had a public ip. For example, let's say you want to run a minecraft server for your friends from your home. You use this hypothetical service to get an ip you can use, and tunnel the needed ports in to your network (and ultimately, your minecraft server). This couldn't be provided with a single ip, since at best that would limit you to selling off individual ports. The product becomes worthwhile if each customer has their own ip.
- semi 3y ago
  You can still do it off of one IP but it becomes more expensive as you now have to understand the protocol, and to route based on the handshake. For tls1.2, that's usually routing based on server name identifier in the ClientHello and you can do it pretty trivially For Minecraft.. you would probably need to write your own proxying logic. But as long as the protocol includes some info on what it's trying to connect to you could still do it. Alternatively you could do it like the old quakeworld spectator proxies and just write a custom Minecraft server people connect to that then presents a menu in game to pick a server that it then connects to.
  - Libcat99 3y ago
    It's a very different product then. The fixed ip product more or less lets a user use it for anything they could with their own static ip. The single ip product only allows the end user to use protocols for which you have built forwarding logic. For some, like sip or http, this would be simple, but for others you would need a much higher understanding of the application protocol. One is a geeks Swiss army ip, the other is "now you can self host one of these 5 services, some or which might stop working if the application makes breaking changes."

atomicnumber3 3y ago

Ngrok already exists, so between them, cloudflare, and tailscale, this market already has a lot of players.