Why not tunnel 22/23/25? reddit / selfhosted ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-15 15:19 Why not tunnel non-http/https traffic from public servers (Tailscale/Cloudflare) such as ssh, ftp, smtp, or SMB? When you try to connect to those protocols the client first determined the IP address to connect to then sends the connect request. A public entry point only sees the source and destination IP addresses and ports, nothing else. It knows what to do with say SSH (port 22) but no way to know which of millions of customers to route to. There are three ways around this limitation: 1. Use http/https. The request header contains the HOST name. Tailscale and Cloudflare use this to route to the appropriate tunnel/customer. 2. Use private networking. In this case the request is to your specific server IP within the private network. As long as the IP is unique it knows where to route the packet. Cloudflare calls this “Zerotier” and it is the default on Tailscale. Every device using it needs to run the VPN software or a router needs to run the software route traffic onto the system. There are many proxies out there but the end result is the same. 3. Use your own IP/VPS and set up Wireguard or a similar service. This is just like #2 except you supply a dedicated (static or dynamic) ip. Generally speaking some older ISPs use dynamic ipv4 IPs which rarely change. Newer ones tend towards static ipv6 ip’s and NAT ipv4 but allow you to pay for a static ipv4 ip (generally $10/month). IPv6 isn’t fully deployed everywhere so it’s not a universal solution. IONOS has the cheapest VPS’s at $2/month currently for a static IPv4 IP and can run Wireguard to redirect all requests to a tunnel. ---------------------------------------------------------------------- ElevenNotes · 2023-10-15 15:28 ssh proxy is a thing: https://hub.docker.com/r/11notes/sshpiper ---------------------------------------------------------------------- talent_deprived · 2023-10-15 15:45 If I understand what you're asking or suggesting or both, I do use Wireguard on my VPS which directs the ports I desire to route to my home machine. It works great. ---------------------------------------------------------------------- certuna · 2023-10-15 15:57 Tailscale and Cloudflare do two different things - one is a peer-to- peer mesh VPN solution (similar to Zerotier), the other is a public CDN. ---------------------------------------------------------------------- preclowski · 2023-10-15 17:30 cloudflare offer tunnels to their proxy service so you dont have to expose resources publicly, i think thats the place where op got confused. He wants to expose ssh via cloudflare-tunneled frontend like cloudflare does with his :80->:443 on cloudflare. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-16 03:45 That’s the issue and Cloudflare is clear on this. If it’s not http/https their public facing tunnel service does not work. Also you must have a domain name to use the Cloudflare side Zerotier works even if you don’t. Effectively Zero Tier provides tunnels which is why you see strange addresses in DNS on the CF side. Over on the zero tier side you just set up and run cloudflared on each machine. In Zero tier you set up two tunnels and copy the data into each one. Once this is done traffic can flow between Cloudflare and either machine. You can also run Zero Tier on your phone or other devices. You can also go into your tunnel settings and set up a “private” address such as 192.168.1.0/24 which will advertise the 192.168.1.x subnet on your private network so you can access non-tunnel machines and vice versa through the tunnel. Just be aware you can’t create conflicts unlike the tunnel nodes that are assigned 100.x.x.x ip’s. Also as near as I can tell unless you set it up for split addressing ALL traffic goes into the tunnel. It exits wherever Cloudflare decides is the closest node so other than a lack of control it acts like an outgoing VPN. Tailscale is similar in terms of private addresses but the differences end there. On the public facing side the “funnel” system only uses either a random subdomain name or a random one you get to pick from a two word list. No custom DNS. And you provide exit nodes if you want to use it as a VPN Routing is peer to peer, no CDN. On top of these I own a DSM so a third option for me is Synology. In this case I am limited to about 4 DNS subdomains labeled “my- name.synology.me”. It is not a CDN or private networking but just a public facing tunnel for http/https traffic. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-16 03:51 I agree. I used sshtunnel for a couple years to bypass an overly aggressive firewall that blocked a lot of legit traffic. This is user level so runs SOCKS but worked great for my needs at that location. Today I just run Tailscale. But the issue is that now I can’t ssh to my home server with an ISP change so I have to use Tailscale, ---------------------------------------------------------------------- certuna · 2023-10-16 11:20 I'm not sure what you mean here - Zerotier doesn't "provide" a tunnel, it's a mesh VPN, i.e. peers connect directly to each other. If you use Zerotier, connections are not tunneled through Cloudflare, nor do they run over Zerotier's servers, it is a peer-to-peer VPN (like Tailscale). You can use Zerotier and Tailscale with both private or public addresses, depending on whether you have a gateway to the internet at one of the nodes.