Tunnel via Cloudflare to any TCP service | Hacker News Reader

Tunnel via Cloudflare to any TCP service

iq.thc.org

193 pointssharjeelsayed63 comments

OK... if you want to know the REAL benefit of doing this...

With this method, you effectively turn Cloudflare into a transport, which enables you to get around the limitation of Cloudflare. Say what if you want to transport UDP packets now (for your Wireguard for example)? Cloudflare don't really support that currently, but now it's achievable (albeit, not the best way).

The software used, both websocat, and gost is there to convert/proxy (non-Cloudflare specific) WebSocket connections to arbitrary TCP/UDP (supported by gost). You need to install them on both end of your endpoint through, to enable full conversion (App TCP client -> websocat/gost client -> [Cloudflare via Websocket] -> websocat/gost server -> App TCP server).

Also, you can use Tor network to do similar things, just with .onion service. Tor only supports TCP proxying (if I remembered it correctly), now you can do UDP too.

Cloudflare tunnels have been a blessing for me, as someone locked behind an apartments router trying to host services without the ability to forward ports. The fact that it's free, is the cherry on top.

FWIW you can do the same thing with a cloud server & a couple bucks a month. I use AWS/t4g.nano reserved instance & WireGuard, and I think it runs me less than half a beer a month.

If you're going to pay for AWS, might as well use Oracle's free tier. It is extremely generous. And you have to specifically change a setting to leave the free tier; So you it's not that easy to get accidentally billed for a misconfig.

Yes, yes...I know..."ORACLE"!? choking sounds But at this point, they're no worse a company than Amazon. I've been very happy with their free tier for my home use. There's a bit of learning curve...just like AWS, but they give you a ton of free stuff, including training.

+1 for Oracle. Their free tier for compute is better than Google's: Up to four free ARM VMs and up to two AMD VMs.

And the 10TB of free egress. Their proprietary stuff is very generous as well. Also 3000 emails/day -- really great offering tbh

Oracle OCI will randomly shut your instances down, which is super annoying. I stopped bothering to boot them back up again.

Used to be a huge proponent, it was a good 4 years of freebies. But this too shall pass.

Do you know what causes this to happen? Mine's been doing alright with uptime

    05:20:09 up 631 days, 23:10,  1 user,  load average: 0.01, 0.02, 0.00

on my "Always Free" instance.

You might not be on a "Always Free" account then. AFAIK, you're not subject to reclamation if you add a payment method to the account.

Here's the link to their documentation on reclamation of idle resources: https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...

> Idle Always Free compute instances may be reclaimed by Oracle. Oracle will deem virtual machine and bare metal compute instances as idle if, during a 7-day period, the following are true:

> * CPU utilization for the 95th percentile is less than 15%

> * Network utilization is less than 15%

> * Memory utilization is less than 15% (applies to A1 shapes only)

And here's the email that I get whenever they reclaim an instance:

> Oracle Cloud Infrastructure (OCI) has reclaimed idle Always Free compute resources from Always Free customers by stopping the compute instance(s). Reclaiming idle resources allows OCI to efficiently provide services to Always Free customers. Your account had one or more idle compute instances that have been stopped. You can restart your compute instance as long as the associated compute shape is available in your region. Your Boot and Block Volumes remain unchanged and available to you. In the future, you can keep idle compute instances from being stopped by converting your account to Pay As You Go (PAYG). With PAYG, you will not be charged as long as your usage for all OCI resources remains within the Always Free limits.

Yes - so i'm not sure why it doesn't seem to actually happen to me, my instance definitely sits idle like that a lot. All free Oracle accounts must have a payment method, it was mandatory when creating the account.

Screenshot of my "Always Free" banner in the Oracle web interface: https://imgur.com/a/hTZfkek

It's not super random. They email your before at least. Mine has been shut down once in 3 months. Which I think is fair enough considering I run 2 machines with 8gb RAM each and 2 arm cores each. Insane value.

Why not run two machines with 12gb RAM each? There's a total of 24gb available on the always free tier. I'm running 4x 6gb nodes in a k3s cluster.

Then I do that. I just misremembered the exact sizes because I haven't logged in in so long.

> Oracle OCI will randomly shut your instances down, which is super annoying.

In the 3+ years of running 2 instances on OCI, I'm yet to see this.

And you won't be able to start up again if they don't have enough capacity for your free instance

there have been a few reports of oracle randomly terminating services for people who only use the free tier, i’d rather pay a meager fee than get unpredictably evicted

I am not sure this is 100 percent but the Internet says you can upgrade to the paid tier and they won't evict you. You can use the same always free resources. In terms of unexpected fees, if you open a free tier account, let the free trial expire, basically whatever you can then do will also be free when you upgrade.

tbh running a free service on the internet requires unilateral termination of service for "bad citizens". totally different story whether it was justified in specific cases.

Last I looked they demanded a credit card, even for the free tier, and choked on a gift card credit card, they wanted a "real" one. Has this changed?

Isn't AWS the same?

I'm not sure. I have my "play" AWS account, for Alexa apps, connected to my Amazon account but I don't really have a single credit card on my Amazon account, it always asks which one to use, so I don't think so.

They sent sales people to call me after I signed up for their cloud. Only once for me though since they determined I was just a nobody.

I have done this before, which is pretty simple because ssh is basically always available:

    ssh -R \*:8080:localhost:80 -N root@example.com

Same thing with hetzner and I don't have to worry about an AWS account with my payment info on it.

I've seen too many cloud provider horror stories.

> FWIW you can do the same thing with a cloud server & a couple bucks a month.

Until you get hacked or attacked and the bandwidth bill skyrockets. I wouldn't risk it.

Cloudflare is bandwidth "included".

I started doing this a year ago and it's been super solid and low maintenance.

Post it here and I'm sure some random guy are going to make you pay $100 next month.

How have you found it for hosting services? I found it struggled with something as simple as an Apache webserver, though perhaps that's just something to do with my internet itself.

I've had my Plex server behind Cloudflare Tunnels for years, never had any performance or reliability issues.

Another great use case is for SSH to a server quite some distance away. I find that the latency when using a cloudflare tunnel to SSH on average better than whatever route my ISP would normally take.

> Plex server behind Cloudflare Tunnels for years

Unless I'm missing something here, there's no way Cloudflare is allowing that much traffic through tunnels for free. Is this just setting up the initial plex connection through the tunnel and then going p2p?

Nope, 100% of my external users go through CF tunnels. The downside is that the caching results in the entire file being cached immediately if the user is not using transcoding, but most of my users are utilizing transcoding. I put a bandwidth limiter on my Cloudflare tunnel to limit it to 100Mbps

I don't have any actual stats, but there appear to be about 10-20 hours a day of remote streaming, mostly at 3Mbps. So we're only looking at 400-800GB on average per month.

Also, you can use Cloudflare unregistered free tunnels just like the article, but using registered tunnels makes it so you don't have to update the Plex url every time you reconnect. I used unregistered tunnels until Cloudflare made tunnels available on free tier accounts with no bandwidth charges.

Ive been using a tunnel to share my jellyfin server to friends for about a year. Its pretty much a proxy for it (add jellyfin:port to the config, start cloudflared, access on jellyfin.my.domain on cloudflare).

I havent had any issues with bandwidth but it depends on how much you push through it. Ive seen stories throughout the years of people pushing 30-50TB before getting a temp ban from using cloudflare services. Of course DNS still works but you just cant use their proxy/cdn/tunnels/etc

> there's no way Cloudflare is allowing that much traffic through tunnels for free

What's the limit?

I've pushed quite a lot of traffic over Tunnels with no issues - IME it performs just as well as sending the traffic over Cloudflare without the Tunnel.

My $5 is on the MTU mismatch.

the internet is not going to accept bigger packets just because someone wants to add vpn-encapsulation (additional data). you either account for the overhead (mssfix) or your payload gets fragmented and performance goes to shit, deal with it 8)

I see options in my Cloudflare control panel to tunnel things besides HTTP(S) services (including TCP and SSH) via Cloudflare Tunnel. Am I misunderstanding the blog post?

Yeah it supports generic tcp forwarding, I only tried it once when it released but worked without issues. Needs cloudflared on the client as well but so does the method in the blogpost so should be about the same:

https://developers.cloudflare.com/cloudflare-one/application...

I think you're right. I'm using Cloudflare Tunnels with SSH just fine, though I haven't tried anything else yet. They definitely have a direct integration for SSH.

They have an SSH authentication solution, but IMO it’s rather half-baked. Definitely not a top-tier Cloudflare product.

I am not using their solution for SSH authentication, but I am using Cloudflare Tunnels to access SSH normally. I'm actually surprised it can be used this way, but it seems it can.

You don't need a websocket proxy. CF tunnel supports TCP and UDP just fine.

This is what I was wondering when reading the article.

I do SSH forwarding just fine with a CF tunnel. No extra services needed.

Just wanted to inform you that your HN profile as well as your blog's "About me" need to be updated. Cheers!

> Error validating origin URL: Currently Cloudflare Tunnel does not support udp protocol.

You sure?

good find!

the audience probably feels more comfortable working with technologies that have a "web" prefix and or can be deployed to a shared webhosting account aka cloud

I wrote something tangentially related, but for single user.

"gofwd" is a cross-platform TCP port forwarder with Duo 2FA and Geographic IP integration. Its use case is to help protect services when using a VPN is not possible. Before a connection is forwarded, the remote IP address is geographically checked against city, region (state), and/or country. Distance (in miles) can also be used. If this condition is satisfied, a Duo 2FA request can then be sent to a mobile device. The connection is only forwarded after Duo has verified the user.

https://github.com/jftuga/gofwd

Nobody has yet mentioned that they get full unencrypted access to all of your traffic if you do this, so I shall.

Just like any VPN.

That's why you shouldn't buy VPN services. Buy a hosting instead and host your VPN yourself.

This is bonkers that people so actively discuss this. That's like using 3rd party service to access your bank account.

> Buy a hosting instead and host your VPN yourself.

So the ISP gets access instead of the VPN? All this does is shift trust, not remove it.

How does ISP get insecure traffic? Your connection to your VPN (and then from there to your bank) should be encrypted and none of inbetween hosts should be able to decrypt it.

which millions of people do. So many of them that Intuit bought mint.com.

The submitted blog post says it.

Cloudflare Tunnel is a great service, but if you're looking for selfhosted alternatives I maintain a list here:

https://github.com/anderspitman/awesome-tunneling

I don't know if Corkscrew is still relevant, but if you're maintaining a list, it might have a place there. I forget exactly why, but I used it some years ago.

https://github.com/bryanpkc/corkscrew

I'm quite surprised to read what feels like a cloudflare ad from THC..

Hi, I'm the author of Inlets. We've seen a recent rise in users looking to tunnel TCP traffic w/o these kinds of hacks and additional tools.

I wrote up a quick guide back in early May - seems relevant to this article as one of the newest users couldn't get Cloudflare to work with TCP how he wanted.

https://inlets.dev/blog/2023/05/04/expose-local-tcp-ports.ht...

I've been thinking about using a tunnel like this to host a retro computing website. My idea was to run OpenBSD i386 on an AMD K6-III (1999) host, then use the built-in webserver httpd(8) to render and serve a static site. The machine would be tunneled via Wireguard to a VPS, and the VPS could optionally terminate the TLS (and transmit plain HTTP over WG) to free up some CPU cycles. :)

We’ve been working on something (https://github.com/build-trust/ockam) that enables exactly this, among a whole host of other use cases. If you check out some of the code examples in the docs you’ll see how to setup a tunnel using the CLI.

For other use cases there’s also the programming libraries (only Rust atm, though I was spiking a TypeScript/Node PoC this week) which might provide more flexibility. Personally I’m excited by the idea of being able to move this kind of secure by design connectivity all the way into the application layer though.

I wrote something similar to be able to run vscode against any remote machine. This was before vscode's own tunnels.

https://github.com/efrecon/sshd-cloudflared

It automatically runs a dockerised sshd to access your directory. The sshd is configured using your github's keys to protect access.

Why would I want to do that? Would certain firewalls setup cause issues?

Cloudflare tunnel does support SSH on top of the main HTTP offering, but if it didn’t, it would be the kind of use case for this. And generally anything that talks something-over-TCP but not HTTP, so XMPP maybe? Databases, cameras and other IoT stuff?

And if you’re asking why anyone would even do that, like why use Tunnel at all, then well, many people are behind all kinds of NAT or, like me, on a public IP with my ISP’s stateful firewall preventing anyone from talking to me. CF Tunnel allows you to hide all that in a nice outgoing TCP connection and if your firewall allows that (which it probably does), you’re golden.

Reply on news.ycombinator.com