7 ms·

I spent some time on Friday trying out Cloudflare tunnel and boy was it a bad experience. The big killer was that the tunnel endpoint they gave me had an IPv6-

I spent some time on Friday trying out Cloudflare tunnel and boy was it a bad experience. The big killer was that the tunnel endpoint they gave me had an IPv6-only endpoint that I'm not sure was even valid. None of my devices could connect to it, including macbook, phone, linux, AWS instance... On top of that I keep running into unexpected roadblocks with Cloudflare, like when I was trying to set up the tunnel they required me to set up a dedicated domain, you can't set up a subdomain of an existing domain. Probably fine if you are rolling it out as a production service, but for just testing it to make sure it even works (see IPv6 comments above), I just wanted to set it up as a subdomain.

watermelon0 1y ago
Haven't used Cloudflare in a while, but in the past you needed $200/month Business plan to be able to use subdomains of an existing domain with DNS hosted elsewhere.
- h33t-l4x0r 1y ago
  Nah, I'm free tier. I register domains through them and I think I pay around $10/month for R2 storage. All kinds of other freebies come on that tier, D1 databases (sqlite), Workers (think Lambda)
csomar 1y ago
That really sums up the cloudflare experience and this is from someone heavily invested in their workers platform. They have lots of products and keep pumping more but except for DNS, most of them are half assed with weak maintenance/support.
- CuriouslyC 1y ago
  That's not a fair take. I will give Cloudflare a lot of shit for some of their products, but some of their products are 100% best in class. For instance, R2 is just better than S3, and KV is better than AWS/GCP options. The pricing is better, it's multi-region by default and there's less ops overhead.
  - Eikon 1y ago
    R2 is very high latency with huge variance, definitely lower quality than S3. In my experience even backblaze b2 performs (way) better. Their community forums are full of such reports. KV is so expensive that it’s barely usable, and like R2, is very slow.
    - theultdev 1y ago
      Slightly higher latency. I've seen about 20-30% increase from S3 to R2. But the bill is magnitudes lower. Agree with the KV point, Upstash is the same. But I just use dragonflydb on a single VM. No point paying for transactions. Hell, S3 could have 20ms latency and it wouldn't matter since I can't afford it.
      - johncolanduoni 1y ago
        Where are you seeing orders of magnitude lower R2 bills? The storage price for S3 is $0.023 per GB, and the price for CF is $0.015 per GB. The operation pricing is even more similar - S3 is $5/million writes and $0.40/million reads, while Cloudflare is $4.50/million writes and $0.36/million reads.
        CuriouslyC 1y ago
        Egress fees are the largest part of many AWS bills, this is by design, that price is deceptive. R2 has no egress fees.
  - csomar 1y ago
    I agree with R2 but KV is un-realiable. I said DNS but I meant CDN which R2 kind of falls into. Cloudflare is good in moving lots of data but most of their other products are not polished. It doesn't mean that they are not exceptional products. I have deployed a wasm-worker 5 years ago and it is still up and running to this day. I don't think a server would have survived or any other product from any other provider would have guaranteed such backward compatibility.
  - 1y ago
Jnr 1y ago
It was a smooth experience for me. Just start the cloudflared container with the provided key in the environment and you are done. I also don't have ipv6 but it is not required and if I remember correctly I did not have to specify any endpoints, just the key.
h33t-l4x0r 1y ago
Works great for me, 5 subdomains coming to various ports on my dev pc for whatever project I'm testing (8000 for laravel, 3000 for nextjs). Way better than ngrok.
stingraycharles 1y ago
We're using Cloudflare Zero Trust quite extensively, and I find them quite easy to use. Works perfectly from AWS as well, all their endpoints have both IPv4 and IPv6 IPs.
- linsomniac 1y ago
  Maybe the tunnel they provisioned for me was just broken, because: $ host -t A 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com has no A record $ host -t AAAA 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com has IPv6 address fd10:aec2:5dae:: $ telnet -6 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com 443 Trying fd10:aec2:5dae::... telnet: Unable to connect to remote host: Connection timed out I got the cloudflared running fairly easily (though their Debian package repo seemed broken and they didn't have an option listed on the setup page for downloading just the binary, I was able to find it after some searching). That part went smoothly, I just couldn't connect to the tunnel they provisioned.
  - johncolanduoni 1y ago
    It’s confusing, but those tunnels are not designed to be used directly - you’re supposed to use them as an origin in a DNS record or hit them from a worker. The IPv6 address you’re getting there is actually a private (ULA) address and will not be reachable via the internet. I’m not sure why they return it at all.
pyeri 1y ago
localtunnel[1] is one good option, at least for now. [1] https://localtunnel.github.io/www/ https://localtunnel.github.io/www/
- mrasong 1y ago
  Gotta say, this is amazing, exactly what I needed.
- letmetweakit 1y ago
  I don't really get how the developer can run the project free of charge without monetization options. Does this solely rely on donors?
  - pyeri 1y ago
    Tunneling isn't that big of a toll on resource, it doesn't require storage/disk space nor compute power (CPU chips), all it needs is ingress/egress (spare bandwidth). A non-profit or decent business in telco can easily offer it, consider that many hosting companies offer entire package in free tier today (compute + disk + egress). For several years, ngrok was practically free, only recently they've started monetizing once it gained popularity.
f311a 1y ago
We spent 3 days trying to properly integrate their tunnels to our internal network. I took us 3 hours to integrate tailscale. Tunnels are poorly documented.
- linsomniac 1y ago
  >Tunnels are poorly documented. I'd tend to agree with that, but I was able to find some youtube videos of people setting them up. It was still a little bit of a challenge though because they have moved the menus all around in the last few months, so even the most recent videos I could fine were pointing to locations that didn't exist and I had to go hunting for them. I would have preferred to just use tailscale for this, but we are using headscale and want to make a service available to our sister company, that doesn't have e-mails in our Google Workgroup where we have the OIDC for auth, so they can't be part of our tailnet without buying them logins or setting up accounts in keycloak or similar.
  - xyzzy_plugh 1y ago
    > they can't be part of our tailnet without buying them logins I'm pretty sure you can use Cloud Identity Free accounts to do this. I've done something similar with OIDC and it didn't cost anything.
noir_lord 1y ago
I use it with a separate docker compose project so everything lives inside that (with traefik) and it's been utterly bulletproof for years - took a little puzzling out to start with but otherwise no drama and lets me do foo-whatever.mydomain.co.uk and route publically which is fantastic for local dev stuff or where I want to test something on iphone/android easily or share it - keeps all that stuff out of my "stack" for dev projects which makes for a very fast spinup if I want to test something.
candiddevmike 1y ago
We were also super frustrated with Cloudflare Tunnel, especially from a developer experience and firewall perspective. So we built Tunlr to replace it: https://tunlr.dev https://tunlr.dev. It's Cloudflare Tunnels but you can self-host it and provide your own domains for your internal developers to use, and it proxies over HTTP/SSE which plays nicely with firewalls.
- ricardbejarano 1y ago
  Oh like Pangolin
sklarsa 1y ago
I'm very surprised to see all of the negativity toward Cloudflare's usability and value here. It's been relatively painless for me to set up tunnels secured by SSO to expose dashboards and other internal tools across my distributed team using the free plan. Yes, I need to get a little creative with my DNS records (to avoid nested subdomain restrictions), but this is not really much of a nuisance given all of the value they're giving me for free. And after paying just a little bit ($10-20 per month), I'm getting geo-based routing through their load balancers to ensure that customers are getting the fastest connection to my infra. All with built-in failover in case a region goes down.
- linsomniac 1y ago
  I really wanted to love Cloudflare, even invested in it a couple years ago I was so confident in their vision. But... - They won't tell you at what point you will outgrow their $200/mo plan and have to buy their $5K+/mo plan. I've asked their support and they say "it almost never happens", but they won't say "It will never happen." HN comment threads are full of people saying they were unexpectedly called by sales saying they needed to go Enterprise. - There are no logs available (or at least weren't 6-9 months ago) for the service I proxy through Cloudflare at the $200/mo level, you have to go with Enterprise ($5K+ I've been told) to get logs of connections. - I set up some test certs when I was migrating, and AFAICT there is no way to remove them now. It's been a year, my "Edge Certificates" page has 2 active certs and 6 "Timed Out Validation" certs, I can't find a way to remove them. - The tunnel issue I had on Friday trying to set up where my tunnel, more details in another comment here but apparently the endpoint they gave me was IPv6 only and not accepting traffic. - Inability to set up a tunnel, even to test, on a subdomain. You have to dedicate a domain to it, for no good reason that I can tell.
- locknitpicker 1y ago
  > I'm very surprised to see all of the negativity toward Cloudflare's usability and value here. As someone who uses Cloudflare at a professional level, I don't. To me each and every single service provided by Cloudflare feels somewhere between not ready for production or lacking any semblance of a product manager. Everything feels unreliable and brittle. Even the portal. I understand they are rushing to release a bunch of offerings, but this rush does surface in their offerings. One of my pet peeves is Cloudflare's Cache API in Cloudflare Workers, and how Cloudflare's sanctioned approach to cache POST requests is to play tricks with the request, such as manipulate HTTP verb, URL, and headers, until it somehow works. It's ass-backwards. They own the caching infrastructure, they own the js runtime, they designed and are responsible for the DX, but all they choose to offer is a kludge. Also, Cloudflare Workers are somehow deemed as customizable request pipelines, but other Cloudflare products such as Cloudflare Images service can't be used with Workers as it fails to support forwarding standard request headers. I could go on and on, but ranting won't improve anything.

watermelon0 1y ago

Haven't used Cloudflare in a while, but in the past you needed $200/month Business plan to be able to use subdomains of an existing domain with DNS hosted elsewhere.

h33t-l4x0r 1y ago
Nah, I'm free tier. I register domains through them and I think I pay around $10/month for R2 storage. All kinds of other freebies come on that tier, D1 databases (sqlite), Workers (think Lambda)

csomar 1y ago

That really sums up the cloudflare experience and this is from someone heavily invested in their workers platform. They have lots of products and keep pumping more but except for DNS, most of them are half assed with weak maintenance/support.

CuriouslyC 1y ago
That's not a fair take. I will give Cloudflare a lot of shit for some of their products, but some of their products are 100% best in class. For instance, R2 is just better than S3, and KV is better than AWS/GCP options. The pricing is better, it's multi-region by default and there's less ops overhead.
- Eikon 1y ago
  R2 is very high latency with huge variance, definitely lower quality than S3. In my experience even backblaze b2 performs (way) better. Their community forums are full of such reports. KV is so expensive that it’s barely usable, and like R2, is very slow.
  - theultdev 1y ago
    Slightly higher latency. I've seen about 20-30% increase from S3 to R2. But the bill is magnitudes lower. Agree with the KV point, Upstash is the same. But I just use dragonflydb on a single VM. No point paying for transactions. Hell, S3 could have 20ms latency and it wouldn't matter since I can't afford it.
    - johncolanduoni 1y ago
      Where are you seeing orders of magnitude lower R2 bills? The storage price for S3 is $0.023 per GB, and the price for CF is $0.015 per GB. The operation pricing is even more similar - S3 is $5/million writes and $0.40/million reads, while Cloudflare is $4.50/million writes and $0.36/million reads.
      - CuriouslyC 1y ago
        Egress fees are the largest part of many AWS bills, this is by design, that price is deceptive. R2 has no egress fees.
- csomar 1y ago
  I agree with R2 but KV is un-realiable. I said DNS but I meant CDN which R2 kind of falls into. Cloudflare is good in moving lots of data but most of their other products are not polished. It doesn't mean that they are not exceptional products. I have deployed a wasm-worker 5 years ago and it is still up and running to this day. I don't think a server would have survived or any other product from any other provider would have guaranteed such backward compatibility.
- 1y ago

Jnr 1y ago

It was a smooth experience for me. Just start the cloudflared container with the provided key in the environment and you are done. I also don't have ipv6 but it is not required and if I remember correctly I did not have to specify any endpoints, just the key.

h33t-l4x0r 1y ago

Works great for me, 5 subdomains coming to various ports on my dev pc for whatever project I'm testing (8000 for laravel, 3000 for nextjs). Way better than ngrok.

stingraycharles 1y ago

We're using Cloudflare Zero Trust quite extensively, and I find them quite easy to use. Works perfectly from AWS as well, all their endpoints have both IPv4 and IPv6 IPs.

linsomniac 1y ago
Maybe the tunnel they provisioned for me was just broken, because: $ host -t A 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com has no A record $ host -t AAAA 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com has IPv6 address fd10:aec2:5dae:: $ telnet -6 9c8855f1-e47f-47bf-9e0e-66938be0f076.cfargotunnel.com 443 Trying fd10:aec2:5dae::... telnet: Unable to connect to remote host: Connection timed out I got the cloudflared running fairly easily (though their Debian package repo seemed broken and they didn't have an option listed on the setup page for downloading just the binary, I was able to find it after some searching). That part went smoothly, I just couldn't connect to the tunnel they provisioned.
- johncolanduoni 1y ago
  It’s confusing, but those tunnels are not designed to be used directly - you’re supposed to use them as an origin in a DNS record or hit them from a worker. The IPv6 address you’re getting there is actually a private (ULA) address and will not be reachable via the internet. I’m not sure why they return it at all.

pyeri 1y ago

localtunnel[1] is one good option, at least for now. [1] https://localtunnel.github.io/www/ https://localtunnel.github.io/www/

mrasong 1y ago
Gotta say, this is amazing, exactly what I needed.
letmetweakit 1y ago
I don't really get how the developer can run the project free of charge without monetization options. Does this solely rely on donors?
- pyeri 1y ago
  Tunneling isn't that big of a toll on resource, it doesn't require storage/disk space nor compute power (CPU chips), all it needs is ingress/egress (spare bandwidth). A non-profit or decent business in telco can easily offer it, consider that many hosting companies offer entire package in free tier today (compute + disk + egress). For several years, ngrok was practically free, only recently they've started monetizing once it gained popularity.

f311a 1y ago

We spent 3 days trying to properly integrate their tunnels to our internal network. I took us 3 hours to integrate tailscale. Tunnels are poorly documented.

linsomniac 1y ago
>Tunnels are poorly documented. I'd tend to agree with that, but I was able to find some youtube videos of people setting them up. It was still a little bit of a challenge though because they have moved the menus all around in the last few months, so even the most recent videos I could fine were pointing to locations that didn't exist and I had to go hunting for them. I would have preferred to just use tailscale for this, but we are using headscale and want to make a service available to our sister company, that doesn't have e-mails in our Google Workgroup where we have the OIDC for auth, so they can't be part of our tailnet without buying them logins or setting up accounts in keycloak or similar.
- xyzzy_plugh 1y ago
  > they can't be part of our tailnet without buying them logins I'm pretty sure you can use Cloud Identity Free accounts to do this. I've done something similar with OIDC and it didn't cost anything.

noir_lord 1y ago

I use it with a separate docker compose project so everything lives inside that (with traefik) and it's been utterly bulletproof for years - took a little puzzling out to start with but otherwise no drama and lets me do foo-whatever.mydomain.co.uk and route publically which is fantastic for local dev stuff or where I want to test something on iphone/android easily or share it - keeps all that stuff out of my "stack" for dev projects which makes for a very fast spinup if I want to test something.

candiddevmike 1y ago

We were also super frustrated with Cloudflare Tunnel, especially from a developer experience and firewall perspective. So we built Tunlr to replace it: https://tunlr.dev https://tunlr.dev. It's Cloudflare Tunnels but you can self-host it and provide your own domains for your internal developers to use, and it proxies over HTTP/SSE which plays nicely with firewalls.

ricardbejarano 1y ago
Oh like Pangolin

sklarsa 1y ago

I'm very surprised to see all of the negativity toward Cloudflare's usability and value here. It's been relatively painless for me to set up tunnels secured by SSO to expose dashboards and other internal tools across my distributed team using the free plan. Yes, I need to get a little creative with my DNS records (to avoid nested subdomain restrictions), but this is not really much of a nuisance given all of the value they're giving me for free. And after paying just a little bit ($10-20 per month), I'm getting geo-based routing through their load balancers to ensure that customers are getting the fastest connection to my infra. All with built-in failover in case a region goes down.

linsomniac 1y ago
I really wanted to love Cloudflare, even invested in it a couple years ago I was so confident in their vision. But... - They won't tell you at what point you will outgrow their $200/mo plan and have to buy their $5K+/mo plan. I've asked their support and they say "it almost never happens", but they won't say "It will never happen." HN comment threads are full of people saying they were unexpectedly called by sales saying they needed to go Enterprise. - There are no logs available (or at least weren't 6-9 months ago) for the service I proxy through Cloudflare at the $200/mo level, you have to go with Enterprise ($5K+ I've been told) to get logs of connections. - I set up some test certs when I was migrating, and AFAICT there is no way to remove them now. It's been a year, my "Edge Certificates" page has 2 active certs and 6 "Timed Out Validation" certs, I can't find a way to remove them. - The tunnel issue I had on Friday trying to set up where my tunnel, more details in another comment here but apparently the endpoint they gave me was IPv6 only and not accepting traffic. - Inability to set up a tunnel, even to test, on a subdomain. You have to dedicate a domain to it, for no good reason that I can tell.
locknitpicker 1y ago
> I'm very surprised to see all of the negativity toward Cloudflare's usability and value here. As someone who uses Cloudflare at a professional level, I don't. To me each and every single service provided by Cloudflare feels somewhere between not ready for production or lacking any semblance of a product manager. Everything feels unreliable and brittle. Even the portal. I understand they are rushing to release a bunch of offerings, but this rush does surface in their offerings. One of my pet peeves is Cloudflare's Cache API in Cloudflare Workers, and how Cloudflare's sanctioned approach to cache POST requests is to play tricks with the request, such as manipulate HTTP verb, URL, and headers, until it somehow works. It's ass-backwards. They own the caching infrastructure, they own the js runtime, they designed and are responsible for the DX, but all they choose to offer is a kludge. Also, Cloudflare Workers are somehow deemed as customizable request pipelines, but other Cloudflare products such as Cloudflare Images service can't be used with Workers as it fails to support forwarding standard request headers. I could go on and on, but ranting won't improve anything.