4 ms·

I maintain a list of similar tools here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling I'm not sure ther

I maintain a list of similar tools here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling I'm not sure there's a single class of software that's been implemented more times than ngrok-style tunneling. I keep finding more and more. Honestly it's a really fun exercise. Fairly challenging, but well within the reach of a single developer. I believe I'm currently working on my 5th incarnation.

LoganDark 3y ago
> I'm not sure there's a single class of software that's been implemented more times than ngrok-style tunneling. I keep finding more and more. AFAIK ngrok was the first widespread implementation of it, and there was such a sheer lack of it before that everyone started working on their own implementations at once and now we have an abundance. (At least that's my personal theory.)
- kelnos 3y ago
  I think "widespread" in this case means "marketed better". There were open source implementations before ngrok, whose founder even worked with someone who'd written one of those. (ngrok back then was certainly better than a lot of those other options, though.) Webhooks created the need for local tunneling software. Before ngrok, webhooks themselves were just starting to become more common. The need for local tunneling is much much greater than it was 15 years ago. (Also consider that ngrok today is far more then a local tunnel proxy. They noticed the abundance of open source options years ago and have moved on from the basic concept.)
  - apitman 3y ago
    It's an interesting market. Currently most (all?) offerings are targeted at the developer case, a la webhooks and request inspection. But I think in the future the more important use case (and much larger market) will be self hosting. That's going to require a lot more bandwidth.
  - LoganDark 3y ago
    > I think "widespread" in this case means "marketed better". No, widespread means widespread. As in tons of people started to use it, ngrok started pivoting into enterprise, moved from ngrok.io to ngrok.com, etc. I was there for all of it. The landscape of software other than ngrok was a total wasteland. Maybe there was localtunnel or SSH, I guess. But both of them kind of sucked and were fragile. ngrok was a static Go binary you could run anywhere to open a tunnel and it was total magic, worked perfectly, and was exactly what the world needed. It was the original. It taught people how this stuff ought to work and once people learned the formula, just like the iPhone, everyone else started copying it and now there are tons of implementations.
- CoffeeOnWrite 3y ago
  Before ngrok we set it up in 15 minutes by configuring ssh and nginx a la https://gist.github.com/gdamjan/4586758 https://gist.github.com/gdamjan/4586758
aborsy 3y ago
I still haven’t found an ideal solution, despite a variety of options. Cloudflare tunnels are good, but Cloudflare terminates TLS certificates, and scans the traffic. People host on premise for privacy, which is moot if using Cloudflare. FRP is simple and works, but it takes inbound traffic from open Internet. A vulnerability in it could compromise your environment. The transport encryption is customized (probably using TLS). It’s not a VPN quality software, going through audits. It may need a reverse proxy in front of it. The ones that make outbound connections seem better. Ngrok pricing is not good, particularly when using custom domains. Tailscale funnel seems to be for short lived lightweight connections, has bandwidth and speed limitations due use of relay servers, kills my CPU, and requires a tailnet. SSH reverse tunnels require some scripting with autossh or similar to ensure persistent connections.
- d-z-m 3y ago
  > Tailscale funnel seems to be for short lived lightweight connections, has bandwidth and speed limitations due use of relay servers, kills my CPU, and requires a tailnet. I'm a fan of their approach[0] though. No termination of TLS, SNI proxying(I presume) to backend machines, etc. [0]: https://tailscale.com/kb/1223/funnel https://tailscale.com/kb/1223/funnel
- apitman 3y ago
  Can you clarify what you mean by inbound vs outbound? Pretty much all of these tools work the same way. You have a machine (usually a VPS) with a public IP address that runs the server, you connect to it with a client, and it tunnels traffic sent to the server to the client and other machines that would otherwise only be visible to the client. There are several options on the list that do e2ee, including commercial services that likely have better pricing than ngrok. That said, I'm not aware of any that are marketed for high bandwidth usage such as video streaming. FWIW my 5th incarnation mentioned above will be such a service.
  - aborsy 3y ago
    Yes, sorry, I was sloppy in my comment. I meant, say in the case of Cloudflare or Tailscale, I don’t need to open any ports, or operate any server. The server, its firewall and security are outsourced to those companies. They take care of configuring and securing the internet-facing component. The clients make outbound connections, and the company takes care of handling inbound. This is similar to running your own VPN server, vs using what’s called zero trust network access with services provided by companies such as Cloudflare. Cloudflare tunnels are simple, robust and include a range of features: various authentication options, a secure internet-facing webpage in Cloudflare Access, DDoS mitigation, IP hiding, DNS and domain setup, etc . If they don’t decrypt and scan the traffic, that’s how an ideal solution would look like.
jszymborski 3y ago
I used your list recently, thanks! Ended up using boringproxy for my case.
- apitman 3y ago
  Glad you found it useful. boringproxy fills a pretty nice niche, but it has some rough edges. I'm working on its successor now.

LoganDark 3y ago

> I'm not sure there's a single class of software that's been implemented more times than ngrok-style tunneling. I keep finding more and more. AFAIK ngrok was the first widespread implementation of it, and there was such a sheer lack of it before that everyone started working on their own implementations at once and now we have an abundance. (At least that's my personal theory.)

kelnos 3y ago
I think "widespread" in this case means "marketed better". There were open source implementations before ngrok, whose founder even worked with someone who'd written one of those. (ngrok back then was certainly better than a lot of those other options, though.) Webhooks created the need for local tunneling software. Before ngrok, webhooks themselves were just starting to become more common. The need for local tunneling is much much greater than it was 15 years ago. (Also consider that ngrok today is far more then a local tunnel proxy. They noticed the abundance of open source options years ago and have moved on from the basic concept.)
- apitman 3y ago
  It's an interesting market. Currently most (all?) offerings are targeted at the developer case, a la webhooks and request inspection. But I think in the future the more important use case (and much larger market) will be self hosting. That's going to require a lot more bandwidth.
- LoganDark 3y ago
  > I think "widespread" in this case means "marketed better". No, widespread means widespread. As in tons of people started to use it, ngrok started pivoting into enterprise, moved from ngrok.io to ngrok.com, etc. I was there for all of it. The landscape of software other than ngrok was a total wasteland. Maybe there was localtunnel or SSH, I guess. But both of them kind of sucked and were fragile. ngrok was a static Go binary you could run anywhere to open a tunnel and it was total magic, worked perfectly, and was exactly what the world needed. It was the original. It taught people how this stuff ought to work and once people learned the formula, just like the iPhone, everyone else started copying it and now there are tons of implementations.
CoffeeOnWrite 3y ago
Before ngrok we set it up in 15 minutes by configuring ssh and nginx a la https://gist.github.com/gdamjan/4586758 https://gist.github.com/gdamjan/4586758

aborsy 3y ago

I still haven’t found an ideal solution, despite a variety of options. Cloudflare tunnels are good, but Cloudflare terminates TLS certificates, and scans the traffic. People host on premise for privacy, which is moot if using Cloudflare. FRP is simple and works, but it takes inbound traffic from open Internet. A vulnerability in it could compromise your environment. The transport encryption is customized (probably using TLS). It’s not a VPN quality software, going through audits. It may need a reverse proxy in front of it. The ones that make outbound connections seem better. Ngrok pricing is not good, particularly when using custom domains. Tailscale funnel seems to be for short lived lightweight connections, has bandwidth and speed limitations due use of relay servers, kills my CPU, and requires a tailnet. SSH reverse tunnels require some scripting with autossh or similar to ensure persistent connections.

d-z-m 3y ago
> Tailscale funnel seems to be for short lived lightweight connections, has bandwidth and speed limitations due use of relay servers, kills my CPU, and requires a tailnet. I'm a fan of their approach[0] though. No termination of TLS, SNI proxying(I presume) to backend machines, etc. [0]: https://tailscale.com/kb/1223/funnel https://tailscale.com/kb/1223/funnel
apitman 3y ago
Can you clarify what you mean by inbound vs outbound? Pretty much all of these tools work the same way. You have a machine (usually a VPS) with a public IP address that runs the server, you connect to it with a client, and it tunnels traffic sent to the server to the client and other machines that would otherwise only be visible to the client. There are several options on the list that do e2ee, including commercial services that likely have better pricing than ngrok. That said, I'm not aware of any that are marketed for high bandwidth usage such as video streaming. FWIW my 5th incarnation mentioned above will be such a service.
- aborsy 3y ago
  Yes, sorry, I was sloppy in my comment. I meant, say in the case of Cloudflare or Tailscale, I don’t need to open any ports, or operate any server. The server, its firewall and security are outsourced to those companies. They take care of configuring and securing the internet-facing component. The clients make outbound connections, and the company takes care of handling inbound. This is similar to running your own VPN server, vs using what’s called zero trust network access with services provided by companies such as Cloudflare. Cloudflare tunnels are simple, robust and include a range of features: various authentication options, a secure internet-facing webpage in Cloudflare Access, DDoS mitigation, IP hiding, DNS and domain setup, etc . If they don’t decrypt and scan the traffic, that’s how an ideal solution would look like.

jszymborski 3y ago

I used your list recently, thanks! Ended up using boringproxy for my case.

apitman 3y ago
Glad you found it useful. boringproxy fills a pretty nice niche, but it has some rough edges. I'm working on its successor now.