5 ms·
I still haven’t found an ideal solution, despite a variety of options. Cloudflare tunnels are good, but Cloudflare terminates TLS certificates, and scans the t
by aborsy 3y ago
I still haven’t found an ideal solution, despite a variety of options.
Cloudflare tunnels are good, but Cloudflare terminates TLS certificates, and scans the traffic. People host on premise for privacy, which is moot if using Cloudflare.
FRP is simple and works, but it takes inbound traffic from open Internet. A vulnerability in it could compromise your environment. The transport encryption is customized (probably using TLS). It’s not a VPN quality software, going through audits. It may need a reverse proxy in front of it.
The ones that make outbound connections seem better. Ngrok pricing is not good, particularly when using custom domains. Tailscale funnel seems to be for short lived lightweight connections, has bandwidth and speed limitations due use of relay servers, kills my CPU, and requires a tailnet.
SSH reverse tunnels require some scripting with autossh or similar to ensure persistent connections.
- d-z-m 3y ago> Tailscale funnel seems to be for short lived lightweight connections, has bandwidth and speed limitations due use of relay servers, kills my CPU, and requires a tailnet. I'm a fan of their approach[0] though. No termination of TLS, SNI proxying(I presume) to backend machines, etc. [0]: https://tailscale.com/kb/1223/funnel https://tailscale.com/kb/1223/funnel
- apitman 3y agoCan you clarify what you mean by inbound vs outbound? Pretty much all of these tools work the same way. You have a machine (usually a VPS) with a public IP address that runs the server, you connect to it with a client, and it tunnels traffic sent to the server to the client and other machines that would otherwise only be visible to the client. There are several options on the list that do e2ee, including commercial services that likely have better pricing than ngrok. That said, I'm not aware of any that are marketed for high bandwidth usage such as video streaming. FWIW my 5th incarnation mentioned above will be such a service.
- aborsy 3y agoYes, sorry, I was sloppy in my comment. I meant, say in the case of Cloudflare or Tailscale, I don’t need to open any ports, or operate any server. The server, its firewall and security are outsourced to those companies. They take care of configuring and securing the internet-facing component. The clients make outbound connections, and the company takes care of handling inbound. This is similar to running your own VPN server, vs using what’s called zero trust network access with services provided by companies such as Cloudflare. Cloudflare tunnels are simple, robust and include a range of features: various authentication options, a secure internet-facing webpage in Cloudflare Access, DDoS mitigation, IP hiding, DNS and domain setup, etc . If they don’t decrypt and scan the traffic, that’s how an ideal solution would look like.
- PLG88 3y agoHave you tried https://zrok.io/ https://zrok.io/? Its open source so you can self-host with custom domains, has a free SaaS incl. reserved shares which give static, vanity URLs, and includes internet hardening/auth.
- aborsy 3y agoI have seen OpenZiti mentioned, and should probably try that and zrok. I think self hosting internet facing servers is not a good idea for most people. That component should be outsourced to specialists, in a product that includes a range of features (see my comment on Cloudflare Access below).
- PLG88 3y agoSure, I hear that argument. That is why zrok (zrok.io) and OpenZiti (CloudZiti) have SaaS services so that the hosting is outsourced to specialists.