Hacker News Reader

Comment by Shakahs | Hacker News Reader

I'm curious how they built this. It's SSH but the IP address is Cloudflare's edge network. It could be using CF Tunnel to transparently route all the SSH sessions to some serving infrastructure, but I didn't know you could publicly serve arbitrary TCP ports like that. Building it in serverless fashion on CF Workers would be ideal for scalability, but those don't accept incoming TCP connections.

View on HN

Yup! Cloudflare naturally advertises HTTP most heavily and it has fancier routing controls, but it supports arbitrary TCP protocols.

> Cloudflare Tunnel can connect HTTP web servers, SSH servers, remote desktops, and other protocols safely to Cloudflare.

https://developers.cloudflare.com/cloudflare-one/connections...

> In addition to HTTP, cloudflared supports protocols like SSH, RDP, arbitrary TCP services, and Unix sockets.

https://developers.cloudflare.com/cloudflare-one/connections...

That requires the client to install custom tunnelling software.

If you want the client to not require special software, they provide a web based terminal emulator for ssh, and a web based VNC client.

Cloudflare Tunnels only open HTTP/S to the internet, you'll need their client to reach the other protocols. More likely that this is Cloudflare Spectrum.

I don't think that's correct. I serve matrix on 8443 through a tunnel.

Matrix is based on HTTP...?

Cloudflare supports 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 443, 80, 8080, 8443, 8880 for HTTP/S https://developers.cloudflare.com/fundamentals/reference/net...

True. You did not say "standard http port", thank you for clarifying.

hey - worked on this it's using Cloudflare Spectrum which can proxy any tcp traffic

will be talking more about this soon

Some protocols do not support virtual hosting; apparently this includes SSH.

It would be possible to support other protocols with a single IP address (either because they are running on the same computer, or for any other reason) if they support virtual hosting.

Of the "small web" protocols: Gopher and Nex do not support virtual hosting; Gemini, Spartan, and Scorpion do support virtual hosting. (Note that Scorpion protocol also has a type I request for interactive use.)

NNTP does not support virtual hosting although depending on what you are doing, it might not be necessary, although all of the newsgroups will always be available regardless of what host name you use (which requires that distinct newsgroups do not have the same names). This is also true of IRC and SMTP.

However, if you are connecting with TLS then it is possible to use SNI to specify the host name, even if the underlying protocol does not implement it.

(This will be possible without the client requiring special software, if the protocol is one that supports virtual hosting. There may be others that I have not mentioned above, too.)

Most likely using "Spectrum" which allows Layer 4 TCP+UDP proxying/DDoS protection: https://www.cloudflare.com/application-services/products/clo...

Cloudflare workers has support for inbound TCP coming 'soon' [1]. Maybe they have early access?

[1]: https://developers.cloudflare.com/workers/reference/protocol...

Reply on news.ycombinator.com