SSH into private machines from anywhere using Cloudflare Tunnel
orth.uk
orth.uk
Answer: ZeroTier -- on Mac, Linux (home & cloud), Windows, Android
I actually setup DNS entries resolving to private IPs as configured in ZeroTier so I didn't have to login to dig them up but my default DNS provider won't resolve them. I guess newer ZeroTier versions optionally have DNS covered these days but I haven't looked into it.
IIRC, I tried both ZeroTier and Tailscale but at the time Tailscale did not yet have a simple setup to run as an unattended Windows service (and still does not have the equivalent for Mac). Being able to access a machine without staying logged in was table stakes so I decided Tailscale needed more time to bake.
Downsides I'm aware of:
- Less attention to their encryption implementation than the current hotness (WireGuard).
- Did not work with minimal effort from the local public library.
- Mac Activity Monitor shows unexpectedly high amounts of traffic even though I use it very rarely, it's not clear what's going on within that network. As in currently 100's of MB's I can't think of why would have passed through.
- It's 50 hosts + 1 admin per network for free, unlimited networks (unless you setup your own "controller"/proxy).
Re: access control brought up in another comment contrasting exposing only SSH vs. VPN connections, ZeroTier includes some off-puttingly complex access control configuration mechanism I will probably never look into.
Hope this detailed anecdata helps someone, I'm glad to be in a position to try to give back to the community by sharing my experience. Any other ZeroTier gotchas would be appreciated in case I have to dodge something in the future. I debated setting it up as permanent "route-all-internet-access-back-through-home-internet" VPN on my phone but was scared off by the complexity of setting up routing/bridging on the endpoint at home.
Also the pricing is for our controller SaaS. If you want to self host controllers you can for free. There is a free community developed control panel somewhere.
I updated re:free, thanks.
Their appear to be two (Node.js/GPL3) control panels: https://github.com/key-networks/ztncui and https://github.com/dec0dOS/zero-ui
Learning moment for us: don't give timelines and don't reveal too much. Just say "when it's finished." Only Elon Musk can use Elon Time(tm). :)
Edit: we also promised some things that are just brutally hard, like fully decentralizing the root backplane via full data set replication. We are still working on that but it proved tougher than we originally thought, especially in light of scaling needs and security concerns. Some interesting technology in development but still in private repos.
Our competition just builds SaaS with a single controller run by a single entity. That's easy. We make it hard on ourselves by trying to keep going on the decentralization and control your own security boundary mission. Part of why everything is getting centralized into silos is that that's just so easy to engineer.
I also hate the way scammy cryptocurrency shonk has sucked all the air out of the room on this topic, especially since most of "web3" is not even decentralized. Most of it goes through a few companies' centralized hubs. Total hot air. I'm thinking about trying to coin a new term for actual decentralization.
And don't even get me started on web3.
I went ahead and beefed up the ZT entry in the list[0] a bit.
Absolutely love ZeroTier!
I run Wireguard, Tailscale and Yggdrasil on my home network.
So in addition to ZeroTier, I use AutoSSH [1] to setup and maintain a persistent ssh tunnel on a high port on my vps. It's a lot faster than ZeroTier's relay because the vps is in a neighboring city instead of in another country. It's pretty reliable too, automatically reconnect when the tunnel is down. I'm still using ZeroTier for backup connection though.
Simply use `autossh -M 0 -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -v -N -R 22222:localhost:22 user@my-vps-domain` to forward port 22222 on your vps into your local machine. I also configured a supervisord instance to automatically start it on my machine so it'll always running.
SSH agent forwarding was merged 3 months ago (after the patch waited 7+ years in one form or another), but per https://unix.stackexchange.com/a/437299 → https://github.com/mobile-shell/mosh/issues/337 (2012), mosh does not yet officially support port forwarding, despite https://github.com/mobile-shell/mosh/pull/583 (2013 → 2015 → 2017). It appears the initiator of the original patch has maintained their fork: https://github.com/rinne/mosh (disclaimer: I don't use mosh and have not tried or reviewed the differences from the official version).
Perhaps https://github.com/MisterTea/EternalTerminal is a viable alternative. Per https://github.com/MisterTea/EternalTerminal/issues/473#issu..., 'Several security teams have reviewed ET.'
Ive since set up wireguard and use nginx for reverse proxy and haven't looked back. This has been rock solid, set and forget.
Tailscale must be properly configured on your client machine to access machines/ports on their respective private Tailscale network(s), setup of which typically requires administrative intervention. Without bridging to a public network, services exposed to the Tailscale network are not accessible publicly.
Tailscale does offer user-mode clients so it can be used similarly to SSH by those allowed to connect (I don't know how difficult user-mode Tailscale is without admin setup on various operating systems).
If your network firewall is preventing the tunneling process, then that's on you. and if its not on you and its a company decision then its VERY unlikely they'd be okay with cloudflare's publicly exposed ports.
the tailscale devices you see are only accessible by other devices on the same tailscale network.
S/he's talking about accessing those machines from OUTSIDE that network. That's what would require admin intervention. So for example if I have a webserver on my home LAN that has Tailscale installed and authenticated, then sure, I can access that webserver from any of my other Tailscale devices from anywhere. But if I want a friend to be able to access that webserver without first being authenticated to the Tailscale network... Do you see the problem, yet?
for starters, what you're describing is a load balancer. those already exist and are trivial to setup.
Can you download and run Tailscale on a Windows client without Administrative access to install the software (setup the virtual NIC)? An SSH client is just a user-space app.
I appreciate that your approach is the more secure standard practice, yet want to make others aware of the edge cases here on a site called Hacker News rather than something like StackOverflow, where 'this is the way' reigns supreme.
I would probably set up one gateway machine, and then from that machine log into other machines on the network; instead of exposing them all to the Internet. SSH allows you to chain logins thus:
ssh -A -t user@public-gateway ssh -A -t user2@server-behind-dmz
The big advantage of this (over ssh user@host1 ssh user@host2) is that the jump host only sees the encrypted inner connection – it doesn't get access to the client's SSH agent/keychain, nor to the target host (host2) or data transmitted over the connection.
Pretty easy to setup SSH to use it to hop through with just one command.
Host myserver
User user
ProxyCommand ssh -q public-server nc -q0 private-server 22
I wrote that alias about a decade ago when it wasn't available for me yet
ServerAliveInterval 30 is important because my ISP often drop idle connections, often not even 1 minute idle. Can probably tweak it to listen to a localhost only port instead of exposing them to internet.
s/http/https/
-or-
s/http/SSL/
since http is technically often referring to unencrypted port 80 transport.
I like your GNU license, I do not like your GNU license people.
They're not forcing you to do anything, just giving you advice.
If anything this is letting people more easily self host their own version of 'BigCorp cartel' apps like mail, code hosting, etc.
Just look at all the people panicking with the free Google Workspace shutdown.
Cost of my time for reading contract and learning new proprietary tool is not worth it for several years.
Cloudflare is arguably better from big tech. But cost of deployment some binary package on confidential server, keeping up with their marketing bs, etc is simply not worth it.
My home firewall blocks all traffic except for incoming SSH from 3 IP addresses in the world. One of those is my virtual server.
If I'm in a hotel with my laptop I run the first command to set up an SSH tunnel to my "home" computer through the cloud virtual server. That listens on my laptop to port 8888 and forwards it through the cloud virtual server to my home computer's SSH daemon listening on port 22
ssh -X -f -C -L 8888:home.mydomain.com:22 -N user@cloud.mydomain.com
ssh -p 8888 user@localhost
Just to clarify: many pull requests have been accepted and would thus from my perspective be covered by the license as having become part of the software.
Caveat: did not dig deeply enough to check if it's mostly Cloudflare employees developing publicly, etc.
Edit: worth mentioning here on HN customer support as well that 'opensource@cloudflare.com' is misconfigured.
PPS: I wish cloudflared were split up into client and server instead of one binary for both, it would be easier to audit and understand that way.
PPPS: I noted while auditing that cloudflared embeds its dependencies instead of depending on them and uses some golang libraries that are obsoleted.
it's already vast... and telemetry always seems to be the thin end of the wedge
a minimal version, not maintained by the company, under a proper open source license with no bullshit and a vastly smaller attack service would seem like a easy win...
(and even better if it supported more service providers than just cloudflare... killing their lock-in)
That does not follow trivially. Contracts themselves are not articles of contract law.
'Illegal' ~ 'against the law'. What is doing something against the law? Doing something the law states you are not allowed to do. So in practice under continental law (Napoleonic / Germanic) a law states "do X" or "leave Y" and doing the opposite is illegal. Then, if the law states "you must (under good faith) fulfill your contract" and you do not fulfill your contract ... that's illegal. A legally binding contract has the force of law for the signing parties.
Of 'inheritance'? What does this mean? Are you trying to apply the rules of OOP to contract law, as if an individual contract were an instance of contract law...?
That's true, but I don't quite see how that makes a contract the law. Someone who doesn't turn up to work isn't doing something illegal by dint of breaking their employment contract. IME, 'illegal' generally refers to breaking the criminal law, whereas I wouldn't say this even breaks civil law, sensu stricto. https://malesculaw.com/is-breach-of-contract-a-tort/
Also, there's some casual discussion by lawyers of this exact terminological question here: https://www.quora.com/How-should-a-breach-of-contract-be-qua...
Do you know if it will be feasible to add Cloudflare tunneling to 3rd party Golang apps?
https://docs.github.com/en/github/site-policy/github-terms-o...
> By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies of Content from your repositories in repositories they control).
https://github.com/openziti-incubator
enables ssh without exposing sshd ports to the networks.
disclosure: founder of company who builds products on OpenZiti open source
See section 2.8 "Limitation on Serving Non-HTML Content." of their subscriber agreement:
use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service or expressly allowed under our Supplemental Terms for a specific Service.
Last I checked, SSH is non-html content. I even opened a support ticket with their support, specifically asking about SSH and other traffic and this is what I received: So if no matter what service you use, Once you breach this rule it will be applied.
EDIT: Looks like the CloudFlare CTO has clarified things below that this usage does not in fact violate the ToS.
This is the correct one for Cloudflare Tunnel: https://developers.cloudflare.com/cloudflare-one/connections...
This was my assumption as well given the tutorials and such available on your site. I was confused though and so reached out for clarification.
“I’m literally never going to stop misusing this word.”
The original comment above implied that using SSH with Cloudflare Tunnel was somehow forbidden.
(I'm looking for a way to get around bad traffic shaping I get in the afternoon between two locations streaming live TV.)
You will also find comments from CloudFlare folks here which suggests this use-case is sanctified.
Won't they be exposed to CloudFlare?
CloudFlare CEO has personally said:
https://www.bizjournals.com/sanjose/news/2013/09/12/cloudfla...
that the company may be required to hand over data to the NSA, and would not be able to tell clients/users about it.
My use-case was to allow bitbucket hosted instances to connect to private instances in my infrastructure to push code to as part of the build pipeline. They way they are running Docker at bitbucket, you can't run the normal zerotier processes (IIRC, it wasn't allowed to create a tun/tap device).
The zerotier public networks are networks that anyone can join given the network ID, without requiring an admin to authorize them.
I wrote a python-based "ztproxy" [1] which you can call from SSH as a ProxyCommand like: `ProxyCommand /usr/bin/python3 /path/to/ztproxy /tmp 1234567890abcdef 9994 10.3.2.1 22`. On top of that I had SSH public key authentication of both the remote host and the local user, so even if the network ID was exposed, it wouldn't have been wide open. I also had ZeroTier network level rules that only allowed the SSH traffic.
1. Run https://github.com/antoniomika/sish on any free tier instance or fly
2. On server, ssh -R anythinghere:22:localhost:22 sishinstance
3. On client, ssh -J anythinghere sishinstance
The tunnel is kept internal to sish, meaning it isn’t exposed to the open internet. You need to auth first to sish (using SSH) and then auth with your server (using SSH) as well before you can gain access.
Do you have a Cloudflare on first page of HN alert?
And will Cloudflare Tunnel stay free and included for free accounts?
But, it looks interesting. I'll have to check it out more.
https://blog.cloudflare.com/getting-cloudflare-tunnels-to-co...
As it boils down, the OP's solution is "free" as in money but not as in freedom for a certain set of requirements.
Basically, going with CF trades-off some freedom for the considerable/legitimate protection benefits of being under the "cloudflare umbrella". It's probably a good trade for this moment in time. But rational people can disagree about whether it's a good trade when you broaden the time horizon to 5, 10, etc. years.
Like all things, it depends on the requirements you're building for.
Setting up a Pi and running the Wireguard install script is about half an hour of work.
When adding more devices at home (IP cameras etc.) and not connecting just to the Pi then the Wireguard VPN comes in.
We have a ssh reverse-forwarding based solution. And unlike the Cloudflare solution you don't need to "give the keys of your house" (as someone here commented) to reach your private machines.
You can remotely open and close the tunnels through our web interface or our web API.
Plus, we have web API-based automated deployment solution if you have many clients.
It is _your_ computer that makes connection to our servers, so you are in control of everything and there is literally nothing on our forwarding servers that would allow anybody to enter your computer.
Why is the traffic rather limited? You seem to be hosting it on Linode and they offer like $5/TB traffic, I think you could easily offer several times more traffic, at least with the bigger plans.
apt install tor
echo HiddenServiceDir /var/lib/tor/myserver\
HiddenServicePort 22 127.0.0.1:22 >> /etc/tor/torrc
systemctl restart tor
Bonus point: you get automatic certificate verification as part of the onion name itself, and you can also restrict the tor server configuration to allow only specific public keys (those who don't have them will not even reach sshd).
Can anyone shed some light on the pros/cons of each?
I like it because of the easy web interface, and ability to tag / organize machines. Authentication is really simple.
> Nebula is a mutually authenticated peer-to-peer software defined network based on the Noise Protocol Framework.
It's self-hosted and I think it's a great alternative to ZeroTier, or Tailscale.
I believe its been powering Slack's overlay network for ~5+ years.
YMMV, of course.
I have a domain and VPS. I want to expose a local dev server running on my laptop to something like mydomain.xyz/something temporarily. I want to host it myself and would prefer open-source tools.
ssh -R 8000:localhost:80 mydomain.xyz
Now you should be able to access your local laptop on port 8000 of the VPS. There are a few easy steps you can add if you want to make it a bit more ergonomic or permanent. If you don't want to use an alternate port, you can just forward the port on the VPS with iptables.
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000
If you want the link to be more permanent, I'd suggest using wireguard instead of ssh. That's a little more effort, but not ridiculous.
- put "GatewayPorts clientspecified" into /etc/ssh/sshd_config, restart sshd
- ssh -R 0.0.0.0:8000:localhost:80 (the first parameter is the address where the tunnel should listen -- you can also pass something like 192.168.0.123 and expose it only to LAN etc.)
It's then reachable on your_vps:8000.
If you need it on the "correct" port and you are already running some other webserver (so you need to share that port), you need to set up a reverse proxy based on hostname or URL. I personally use haproxy, but for example nginx can do it too.
TIL `ProxyCommand cloudflared access ssh --hostname %h`
I assume in this way we can even host mincraft servers (or any binary TCP protocol service) with cloudflared?
It is free, runs on my hardware (Raspi Zero) and I do not have to open ports.
With client authentification, only clients with a certain key can access the service.
Edit: it sees https://utteranc.es/ is used.
Tailscale - does everything outlined here, free for 20 devices plus a full subnet router.
Tailscale scan your host for all open ports and open a WireGuard connection between the installed machines. Like every machine is on the same network, even if they are not. Way harder to have a good access control compared to plain SSH. And you don't need extra SW for just SSH.
For real, I can't imagine running a straight port 22 ssh service on the modern internet, but I'm usually happy just moving it to an unprivileged port for obscurity on personal equipment (plus some other common sense hardening of course). For work stuff, I'd feel naked without some sort of VPN and it seems that's essentially what these services are.
Genuine question, my knowledge of server security is low-to-middle.
Imagine if you could take an old Android phone, install a Nextcloud app, do a quick OAuth2 flow to set up a tunnel, and now you have 100GB of cloud storage, sync, calendar, etc all running from a desk drawer.
Port forwarding is too hard. DNS is too hard. IPv6 is going to take another 10-100 years and people will still have to figure out how to manage firewalls.
IMO web3 is going to come by lowering the barrier of entry to self-hosting.
I am hesitant to commit to a tunnel-based approach because where I live I get frequent power/internet outages. I feel that tunneling is something I would explore if my application grows to the point where I would need to rent space in a colocation.
I don't think tunneling is necessarily a great for hosting large-scale things or businesses that need to stay online 24/7. Self-hosted services for friends and family or maybe small communities seems like the best use case.
It's annoying but ok if your media server goes down once in a while.