8 ms·

There are some limitations such as: – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is mea

There are some limitations such as: – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). – Other TCP protocols (including SSH) require every client to run the software too. So if you were thinking about bypassing the TLS termination restriction by creating a TCP tunnel instead of an HTTP(S) tunnel you can't. – Max 100 MB uploads for HTTP(S). – No media servers allowed. Otherwise it's a really good service!

thousand_nights 2y ago
Some good points, thanks. FWIW, I have been using it with Plex (just two users, me and my parents) and haven't gotten banned. The ToS are kind of unclear on whether this is allowed if I have to be honest.
- jsheard 2y ago
  Video streaming in general is one of their red lines, you're not supposed to shove any kind of video through their CDN unless the origin is another Cloudflare product (e.g. CF Stream or R2).
  - thousand_nights 2y ago
    From the discussions I've read, it's not as clear cut, e.g.: https://old.reddit.com/r/PleX/comments/152wfdh/can_i_use_a_cloudflare_tunnel_to_make_my_plex/ https://old.reddit.com/r/PleX/comments/152wfdh/can_i_use_a_c...
    - jsheard 2y ago
      It rarely is clear cut with Cloudflare, many of their policies are ambiguous so you never really know if you're stepping over the line until you get an email from sales asking you to either cut it out, start paying, or pay more. Others experience might give you a rough idea of what they'll tolerate, but since none of it is in writing they can change their minds on a whim.
      - cj 2y ago
        As I've painfully learned, Cloudflare's "free bandwidth" is only free until a point. Cloudflare threatened to terminate our $15k enterprise license last week for serving 76 TB of API JSON files last month (90% cache hits). I moved half of the traffic to a new domain with a Business license to see what they say...
        jgrahamc 2y ago
        My email is jgc@cloudflare.com. You can email me about this.
    - gunapologist99 2y ago
      Agreed with sibling, but TBH if you're just using it for personal streaming, it's not likely to trip any bandwidth alerts on a free account, and CF will probably be happy that you're using it for personal stuff (because you'll probably take it with you to your day job too)
    - password4321 2y ago
      Just don't show up on some motivated salesperson's prospects report. https://news.ycombinator.com/item?id=40481808#40482405 https://news.ycombinator.com/item?id=40481808#40482405
      - 12345hn6789 2y ago
        FWIW that thread looks to be a casino being black listed after trying to negotiate down cloud flares enterprise plan.
vladvasiliu 2y ago
> – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). But on the flip side, this allows you to have a nice certificate on your outside connection without having to fiddle with letsencrypt or whathaveyou.
- KennyBlanken 2y ago
  If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.
  - janwillemb 2y ago
    Parent did not say it was challenging. I find fiddling with LE tedious because it has to be repeated too often.
    - slt2021 2y ago
      certbot and crontab needs to be setup just once, to solve cert problem
      - deleted 2y ago
        [deleted]
      - Dalewyn 2y ago
        HTTPS when used in the ubiquitous manner it is now always strikes me as unnecessary complexity and tedium, and reasonings like yours addressing them with even more complexity and tedium. Whatever happened to KISS?
        darkwater 2y ago
        It happened that the last S changed from "stupid" to "secure". If I use HTTPS I can safely enough connect to my home services through an open cafe Wifi, for example
coda_ 2y ago
They do allow ssh via a web browser. It may be a "beta" feature, but it doesn't require the client to run anything.
- e12e 2y ago
  Requires your client to run a web browser though? That's a lot different from just an ssh client?
  - RockRobotRock 2y ago
    Not a web browser, the client has to install cloudflared to connect. It's pretty much exactly the Tailscale feature, but clunkier. https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ https://developers.cloudflare.com/cloudflare-one/connections...
    - mortos 2y ago
      GP was saying the client would require a web browser. The server of course needs cloudflared. That said, personally I don't really have any devices that can use SSH but not a browser.
      - RockRobotRock 2y ago
        My past comment is wrong but you do need to install cloudflared on the client if you want to SSH without a browser. Read the docs, you can do it either way.
        tarasglek 2y ago
        I found it easier to use ssh over websocat over cloudflared. Then you just need websocat again on clientside and can use regular ssh client with it
      - nottorp 2y ago
        > I don't really have any devices that can use SSH but not a browser. No headless boxes?
DreamFlasher 2y ago
At which point is the MITM happening? What I mean is: browser → Cloudflare server → cloudflared on my server → web service. Is TLS only from browser to Cloudflare server, or is it browser to cloudflared?
- RockRobotRock 2y ago
  >Is TLS only from browser to Cloudflare server, or is it browser to cloudflared? It's encrypted between the browser and Cloudflare, but you can also create a cert and encrypt between Cloudflare and your origin server. (but that isn't mandatory)
fishcrackers 2y ago
[dead]

thousand_nights 2y ago

Some good points, thanks. FWIW, I have been using it with Plex (just two users, me and my parents) and haven't gotten banned. The ToS are kind of unclear on whether this is allowed if I have to be honest.

jsheard 2y ago
Video streaming in general is one of their red lines, you're not supposed to shove any kind of video through their CDN unless the origin is another Cloudflare product (e.g. CF Stream or R2).
- thousand_nights 2y ago
  From the discussions I've read, it's not as clear cut, e.g.: https://old.reddit.com/r/PleX/comments/152wfdh/can_i_use_a_cloudflare_tunnel_to_make_my_plex/ https://old.reddit.com/r/PleX/comments/152wfdh/can_i_use_a_c...
  - jsheard 2y ago
    It rarely is clear cut with Cloudflare, many of their policies are ambiguous so you never really know if you're stepping over the line until you get an email from sales asking you to either cut it out, start paying, or pay more. Others experience might give you a rough idea of what they'll tolerate, but since none of it is in writing they can change their minds on a whim.
    - cj 2y ago
      As I've painfully learned, Cloudflare's "free bandwidth" is only free until a point. Cloudflare threatened to terminate our $15k enterprise license last week for serving 76 TB of API JSON files last month (90% cache hits). I moved half of the traffic to a new domain with a Business license to see what they say...
      - jgrahamc 2y ago
        My email is jgc@cloudflare.com. You can email me about this.
  - gunapologist99 2y ago
    Agreed with sibling, but TBH if you're just using it for personal streaming, it's not likely to trip any bandwidth alerts on a free account, and CF will probably be happy that you're using it for personal stuff (because you'll probably take it with you to your day job too)
  - password4321 2y ago
    Just don't show up on some motivated salesperson's prospects report. https://news.ycombinator.com/item?id=40481808#40482405 https://news.ycombinator.com/item?id=40481808#40482405
    - 12345hn6789 2y ago
      FWIW that thread looks to be a casino being black listed after trying to negotiate down cloud flares enterprise plan.

vladvasiliu 2y ago

> – TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons). But on the flip side, this allows you to have a nice certificate on your outside connection without having to fiddle with letsencrypt or whathaveyou.

KennyBlanken 2y ago
If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.
- janwillemb 2y ago
  Parent did not say it was challenging. I find fiddling with LE tedious because it has to be repeated too often.
  - slt2021 2y ago
    certbot and crontab needs to be setup just once, to solve cert problem
    - deleted 2y ago
      [deleted]
    - Dalewyn 2y ago
      HTTPS when used in the ubiquitous manner it is now always strikes me as unnecessary complexity and tedium, and reasonings like yours addressing them with even more complexity and tedium. Whatever happened to KISS?
      - darkwater 2y ago
        It happened that the last S changed from "stupid" to "secure". If I use HTTPS I can safely enough connect to my home services through an open cafe Wifi, for example

coda_ 2y ago

They do allow ssh via a web browser. It may be a "beta" feature, but it doesn't require the client to run anything.

e12e 2y ago
Requires your client to run a web browser though? That's a lot different from just an ssh client?
- RockRobotRock 2y ago
  Not a web browser, the client has to install cloudflared to connect. It's pretty much exactly the Tailscale feature, but clunkier. https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ https://developers.cloudflare.com/cloudflare-one/connections...
  - mortos 2y ago
    GP was saying the client would require a web browser. The server of course needs cloudflared. That said, personally I don't really have any devices that can use SSH but not a browser.
    - RockRobotRock 2y ago
      My past comment is wrong but you do need to install cloudflared on the client if you want to SSH without a browser. Read the docs, you can do it either way.
      - tarasglek 2y ago
        I found it easier to use ssh over websocat over cloudflared. Then you just need websocat again on clientside and can use regular ssh client with it
    - nottorp 2y ago
      > I don't really have any devices that can use SSH but not a browser. No headless boxes?

DreamFlasher 2y ago

At which point is the MITM happening? What I mean is: browser → Cloudflare server → cloudflared on my server → web service. Is TLS only from browser to Cloudflare server, or is it browser to cloudflared?

RockRobotRock 2y ago
>Is TLS only from browser to Cloudflare server, or is it browser to cloudflared? It's encrypted between the browser and Cloudflare, but you can also create a cert and encrypt between Cloudflare and your origin server. (but that isn't mandatory)

fishcrackers 2y ago

[dead]