5 ms·

One thing that makes Cloudflare worse for home usage is it acts as a termination point for TLS, whereas Tailscale does not. If you use a Tailscale Funnel, you g

by jchw 11mo ago

One thing that makes Cloudflare worse for home usage is it acts as a termination point for TLS, whereas Tailscale does not. If you use a Tailscale Funnel, you get the TLS certificate on your endpoint. With Cloudflare, they get a TLS certificate for you, and then strip and optionally re-add TLS as traffic passes through them. I actually have no idea how private networks with WARP are here, but that's a pretty big privacy downgrade for tunneling from the Internet. I also consider P2P with relay fallback to be highly desirable over always relaying traffic through a third party, too. Firstly, less middlemen. Secondly, it continues working even if the coordination service is unavailable.

keehun 11mo ago
TLS termination is neither required nor enabled by default, right?
- crimsonnoodle58 11mo ago
  Correct. We run it without it and just use the DNS filtering aspect.
  - philipwhiuk 11mo ago
    How does it do DNS filtering without TLS interception - takeover for DNS resolution?
    - arcfour 11mo ago
      In what way are DNS resolution and TLS related except for the little-used DoT?
- jchw 11mo ago
  For tunnels many of the features basically have to work this way, so I'd be surprised if you could avoid it. It's also impossible to avoid if you use normal Cloudflare "protected" DNS entries. You can use Cloudflare as just a DNS server but it's not the default, by default it will proxy everything through Cloudflare, since that's kind of the point. You can't cache HTTP requests you can't see.
jpdb 11mo ago
I generally prefer tailscale and trust them more than cloudflare to not rug-pull me on pricing, but the two features that push me towards cloudflared is the custom domains and client-less access. I could probably set it up with caddy and some plugins, but then I still need to expose the service and port forward.
- jchw 11mo ago
  I'm definitely not trying to dissuade anyone from using Cloudflare, just making sure people realize the potential privacy implications of doing so. It isn't always obvious, even though some of the features pretty much require it (at least to be handled entirely on Cloudflare's side. You could implement similar features that are split between the endpoint and the coordination server without requiring full TLS stripping. Maybe Tailscale will support some of those as features of the `serve` server?) > client-less access JFYI, Tailscale Funnels also work for this, though depending on your use case it may not be ideal. Ultimately, Cloudflare does handle this use case a bit better.
  - jpdb 11mo ago
    Tailscale funnels do work, but it's public only. No auth.
    - jchw 11mo ago
      Yeah, because the auth can't be done on Tailscale's end if they don't terminate the TLS connection. However, it is still possible to use an authentication proxy in this situation. Many homelab and small to medium size company setups use OAuth2 Proxy, often with Dex. If you wanted to get fancier, you could use Tailscale for identity when behind the firewall and OAuth2 Proxy when outside the firewall. This may seem like a lot of effort and it is definitely not nothing, but Cloudflare Tunnels also has a decent number of moving parts and frankly their authentication gateway leaves a bit to be desired for home users.
    - elcritch 11mo ago
      Tailscale ‘serve’ works well at my startup. SSL and DNS still but unlike funnel it’s limited to your tailscale network.
Ingon 11mo ago
Tunneling p2p with relay fallback is essentially what connet [1] aspires to be. There are a lot of privacy/security benefits exposing endpoints only to participating peers. You can either run it yourself or use hosted version [2]. [1] https://github.com/connet-dev/connet https://github.com/connet-dev/connet [2] https://connet.dev https://connet.dev
zeckalpha 11mo ago
Zero Trust, except for the trust in Cloudflare.
gz5 11mo ago
The other option from this great list https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling which seems to meet both sets of goals is NetFoundry. 1. End-to-end encryption. 2. Performance and reliability. 100+ PoPs in all major clouds running their data plane routers if they host (still E2EE), or run routers anywhere if you self-host. Dynamic routing to find best paths across the routers.
- indigo945 11mo ago
  I don't see any indication that NetFoundry zrok supports end-to-end encryption from the client to the web server. The default configuration definitely terminates SSL on NetFoundry's server, and I don't see any documentation for how to avoid that. There's a TCP tunneling mode, but servers that use this mode can only be accessed by clients that are themselves also connected to the NetFoundry VPN service, not by clients on the public web. What's needed is a TLS tunneling mode that figures out the correct target via SNI, and zrok doesn't seem to provide that.
  - dovholuknf 11mo ago
    You are correct, zrok doesn't support mutual TLS. zrok is the free offering that NetFoundry supports so it's easy to see why you looked there for information. The productized version, NetFoundry Frontdoor (doc here https://netfoundry.io/docs/frontdoor/how-to-guides/create-mtls-tcp-share https://netfoundry.io/docs/frontdoor/how-to-guides/create-mt...) is what offers mutual TLS support. It'll still terminate TLS at the servers, though. It's not mTLS all the way through to the endpoint.
    - indigo945 11mo ago
      > It'll still terminate TLS at the servers, though. It's not mTLS all the way > through to the endpoint. That was the entire point, though. If NetFoundry Frontdoor can see the traffic (because it gets terminated on their servers, mTLS or not), then it's not end-to-end encrypted as the parent commenter claimed.
deleted 11mo ago
[deleted]
ghoshbishakh 11mo ago
For that kind of end-to-end encryption I use pinggy.io tls tunnels.
xrmagnum 11mo ago
I ended up building something in this space recently (TunnelBuddy – https://www.tunnelbuddy.net https://www.tunnelbuddy.net I’m the author) that lets you use a friend’s machine as an exit node over WebRTC. One of the design decisions I made was P2P or nothing: there’s a small signalling service, but no TURN/relay servers. If the peers can’t establish a direct connection, the tunnel just doesn’t come up. The trade-off is fewer successful connections in weird NAT setups, but in return you know your traffic never transits a third-party relay – it goes straight from your client to your friend’s endpoint.
- stavros 11mo ago
  My traffic will transit third parties all the time, since it's going over the Internet. What's the problem with relays, if the traffic is end-to-end encrypted?
  - xrmagnum 11mo ago
    Fair point! - With a TURN/relay, you’re introducing a single, purpose-built box that: - sees all the tunnel metadata for many users (IP pairs, timing, volume), - is easy to log at or subpoena/compel, - and becomes a natural central chokepoint if someone wants to block the system. - Without that relay, your traffic still crosses random ISPs/routers, but: - those hops are *generic Internet infrastructure*, not “the TunnelBuddy relay”, - there’s no extra entity whose whole job is to see everyone’s flows.
hoppp 11mo ago
Thats a big privacy issue if they strip TLS, does it have a technical reason or they just don't want to offer privacy?
aborsy 11mo ago
Is it technically possible to have something like Tailscale funnel but with something like Cloudflare Access authentication (at least for some options)? That would be great!!
WhyNotHugo 11mo ago
> Cloudflare […] acts as a termination point for TLS This doesn’t sounds zero-trust at all to me. In fact, it’s as far from zero trust as you can get.

by jchw 11mo ago

keehun 11mo ago

TLS termination is neither required nor enabled by default, right?

crimsonnoodle58 11mo ago
Correct. We run it without it and just use the DNS filtering aspect.
- philipwhiuk 11mo ago
  How does it do DNS filtering without TLS interception - takeover for DNS resolution?
  - arcfour 11mo ago
    In what way are DNS resolution and TLS related except for the little-used DoT?
jchw 11mo ago
For tunnels many of the features basically have to work this way, so I'd be surprised if you could avoid it. It's also impossible to avoid if you use normal Cloudflare "protected" DNS entries. You can use Cloudflare as just a DNS server but it's not the default, by default it will proxy everything through Cloudflare, since that's kind of the point. You can't cache HTTP requests you can't see.

jpdb 11mo ago

I generally prefer tailscale and trust them more than cloudflare to not rug-pull me on pricing, but the two features that push me towards cloudflared is the custom domains and client-less access. I could probably set it up with caddy and some plugins, but then I still need to expose the service and port forward.

jchw 11mo ago
I'm definitely not trying to dissuade anyone from using Cloudflare, just making sure people realize the potential privacy implications of doing so. It isn't always obvious, even though some of the features pretty much require it (at least to be handled entirely on Cloudflare's side. You could implement similar features that are split between the endpoint and the coordination server without requiring full TLS stripping. Maybe Tailscale will support some of those as features of the `serve` server?) > client-less access JFYI, Tailscale Funnels also work for this, though depending on your use case it may not be ideal. Ultimately, Cloudflare does handle this use case a bit better.
- jpdb 11mo ago
  Tailscale funnels do work, but it's public only. No auth.
  - jchw 11mo ago
    Yeah, because the auth can't be done on Tailscale's end if they don't terminate the TLS connection. However, it is still possible to use an authentication proxy in this situation. Many homelab and small to medium size company setups use OAuth2 Proxy, often with Dex. If you wanted to get fancier, you could use Tailscale for identity when behind the firewall and OAuth2 Proxy when outside the firewall. This may seem like a lot of effort and it is definitely not nothing, but Cloudflare Tunnels also has a decent number of moving parts and frankly their authentication gateway leaves a bit to be desired for home users.
  - elcritch 11mo ago
    Tailscale ‘serve’ works well at my startup. SSL and DNS still but unlike funnel it’s limited to your tailscale network.

Ingon 11mo ago

Tunneling p2p with relay fallback is essentially what connet [1] aspires to be. There are a lot of privacy/security benefits exposing endpoints only to participating peers. You can either run it yourself or use hosted version [2]. [1] https://github.com/connet-dev/connet https://github.com/connet-dev/connet [2] https://connet.dev https://connet.dev

zeckalpha 11mo ago

Zero Trust, except for the trust in Cloudflare.

gz5 11mo ago

The other option from this great list https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling which seems to meet both sets of goals is NetFoundry. 1. End-to-end encryption. 2. Performance and reliability. 100+ PoPs in all major clouds running their data plane routers if they host (still E2EE), or run routers anywhere if you self-host. Dynamic routing to find best paths across the routers.

indigo945 11mo ago
I don't see any indication that NetFoundry zrok supports end-to-end encryption from the client to the web server. The default configuration definitely terminates SSL on NetFoundry's server, and I don't see any documentation for how to avoid that. There's a TCP tunneling mode, but servers that use this mode can only be accessed by clients that are themselves also connected to the NetFoundry VPN service, not by clients on the public web. What's needed is a TLS tunneling mode that figures out the correct target via SNI, and zrok doesn't seem to provide that.
- dovholuknf 11mo ago
  You are correct, zrok doesn't support mutual TLS. zrok is the free offering that NetFoundry supports so it's easy to see why you looked there for information. The productized version, NetFoundry Frontdoor (doc here https://netfoundry.io/docs/frontdoor/how-to-guides/create-mtls-tcp-share https://netfoundry.io/docs/frontdoor/how-to-guides/create-mt...) is what offers mutual TLS support. It'll still terminate TLS at the servers, though. It's not mTLS all the way through to the endpoint.
  - indigo945 11mo ago
    > It'll still terminate TLS at the servers, though. It's not mTLS all the way > through to the endpoint. That was the entire point, though. If NetFoundry Frontdoor can see the traffic (because it gets terminated on their servers, mTLS or not), then it's not end-to-end encrypted as the parent commenter claimed.

deleted 11mo ago

[deleted]

ghoshbishakh 11mo ago

For that kind of end-to-end encryption I use pinggy.io tls tunnels.

xrmagnum 11mo ago

I ended up building something in this space recently (TunnelBuddy – https://www.tunnelbuddy.net https://www.tunnelbuddy.net I’m the author) that lets you use a friend’s machine as an exit node over WebRTC. One of the design decisions I made was P2P or nothing: there’s a small signalling service, but no TURN/relay servers. If the peers can’t establish a direct connection, the tunnel just doesn’t come up. The trade-off is fewer successful connections in weird NAT setups, but in return you know your traffic never transits a third-party relay – it goes straight from your client to your friend’s endpoint.

stavros 11mo ago
My traffic will transit third parties all the time, since it's going over the Internet. What's the problem with relays, if the traffic is end-to-end encrypted?
- xrmagnum 11mo ago
  Fair point! - With a TURN/relay, you’re introducing a single, purpose-built box that: - sees all the tunnel metadata for many users (IP pairs, timing, volume), - is easy to log at or subpoena/compel, - and becomes a natural central chokepoint if someone wants to block the system. - Without that relay, your traffic still crosses random ISPs/routers, but: - those hops are *generic Internet infrastructure*, not “the TunnelBuddy relay”, - there’s no extra entity whose whole job is to see everyone’s flows.

hoppp 11mo ago

Thats a big privacy issue if they strip TLS, does it have a technical reason or they just don't want to offer privacy?

aborsy 11mo ago

Is it technically possible to have something like Tailscale funnel but with something like Cloudflare Access authentication (at least for some options)? That would be great!!

WhyNotHugo 11mo ago

> Cloudflare […] acts as a termination point for TLS This doesn’t sounds zero-trust at all to me. In fact, it’s as far from zero trust as you can get.