Cloudflare tunnels privacy reddit / selfhosted ---------------------------------------------------------------------- chaplin2 · 2023-11-05 17:03 Cloudflare tunnels are advertised as modern zero trust solutions. However, it seems that the SSL certificates terminate on the Cloudflare servers. So if I want to access my NAS through Cloudflare tunnels, Cloudflare has access to my NAS as well as the password to login into that. That seems the worse than old solutions! Am I missing something? ---------------------------------------------------------------------- ElevenNotes · 2023-11-05 17:28 No you miss nothing, and understood exactly how it works. If you don't agree with that, don't use it. ---------------------------------------------------------------------- _Rezava_ · 2023-11-05 17:35 Most of Cloudflare services are just a MITM (Man In The Middle), so they do have theoretical access to (unencrypted) network traffic when using their services. Secure? Yes definitely. Private? Not so much. ---------------------------------------------------------------------- fliberdygibits · 2023-11-05 18:39 I've actually been tinkering with Twingate which fixes that. All the security of Cloudflare tunnels, but twingate has no access to the stream. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-11-05 20:23 OpenZiti is an open source and self-hostable alternative which does the same. I work on the project - https://github.com/openziti ---------------------------------------------------------------------- Objective-Hotel-3947 · 2023-11-05 22:13 You host and control the tunnel to CF (Docker cloufared is the easiest way). You only configure internal sites you want remote access to. You create an access policy to restrict access to that page by (Identity provider, IP, or Gateway (WARP ZT client)). With that in place, you can get to the web interface of an internal site and CF provides you a cert automatically. No internal site credentials need to be sent to CF. ---------------------------------------------------------------------- fprof · 2023-11-06 01:41 > defying the purpose of self hosting so why use Cloudflare at all? ---------------------------------------------------------------------- gfish69 · 2023-11-06 01:59 Run cloudflare tunnel into NPM. Have NPM encrypt traffic with non- cloudflare ssl cert. This should encrypt traffic in tunnel and prevent cloudflare from seeing your traffic. ---------------------------------------------------------------------- DamascusWolf82 · 2023-11-06 02:44 Did you personally make this work? Looking for pointers on this. ---------------------------------------------------------------------- bz386 · 2023-11-06 03:21 You are misunderstanding how all this works. A web browser will connect to the Cloudflare frontend, which will terminate the traffic and decrypt the contents. At that point NPM doesn't even come into play and the fact that you are encrypting traffic between NPM and Cloudflare is irrelevant. ---------------------------------------------------------------------- bz386 · 2023-11-06 03:22 You don't understand how Cloudflare tunnels work. Traffic is terminated on CF, decrypted, then sent (re-encrypted) over the tunnel to your endpoint. No matter what you do, CF will decrypt your traffic. ---------------------------------------------------------------------- ozhound · 2023-11-06 07:06 I think you mean using CloudFlare as a DNS proxy and pushing the https traffic to your npm install which has your domain cert? ---------------------------------------------------------------------- VitoSaver · 2023-11-06 07:10 You are missing that it can be terminated end to end, when using proxy that would be Full encryption option but on tunnel when you make ingress rule just point to https service instead of http and create self signed certificate. ---------------------------------------------------------------------- jkirkcaldy · 2023-11-06 08:33 If you proxy, data is stored on cloudflare’s servers. The only way cloudflare doesn’t have your data is if you use non of their services apart from plain dns hosting. Then none of your traffic goes through their servers. ---------------------------------------------------------------------- jkirkcaldy · 2023-11-06 08:36 Everything needs to be sent to cloudflare every single packet from your web browser to your server needs to be sent to cloudflare. And everything is decrypted on cloudflare’s servers and re-encrypted before being sent to your browser. This means that *theoretically*, someone at cloudflare could see all your traffic unencrypted. ---------------------------------------------------------------------- jkirkcaldy · 2023-11-06 08:39 If you want a fully self hosted version you can create a similar effect with a vps and a vpn. Set up a vpn somewhere with decent traffic throughput and bandwidth and set a vpn up between that vps and your servers. Then set up a proxy on the vps to point to your services and point your dns to the vps. That’s essentially what cloudflare tunnels is. ---------------------------------------------------------------------- ozhound · 2023-11-06 09:36 Ahh cool, good to know ---------------------------------------------------------------------- MistiInTheStreet · 2023-11-06 11:38 I recommend you to check rathole, that’s closer from what Cloudflare is doing I think: https://github.com/rapiz1/rathole :) ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-06 12:19 This is a fundamental necessity for a CDN. They cannot cache your content if they can’t access it: passwords though are easily resolved. Don’t use this for authentication!