Benefits of Cloudflare Access reddit / selfhosted ---------------------------------------------------------------------- garibaldi3489 · 2023-11-18 06:08 For a self-hosted application with a valid SSL certificate and support for OAuth, what are the benefits that Cloudflare Access provides? From what I can tell, it also filters traffic to possibly block attacks? Can it even be used with a self-hosted app if you aren't also running Cloudflare Tunnel? Is there a better alternative (that also integrates with major OAuth providers like Google, Github, etc) for self-hosters? Thanks for the help in understanding how this works. ---------------------------------------------------------------------- driversti · 2023-11-18 07:12 RemindMe! 7 days ---------------------------------------------------------------------- RemindMeBot · 2023-11-18 07:12 I will be messaging you in 7 days on [**2023-11-25 07:12:06 UTC**](htt p://www.wolframalpha.com/input/?i=2023-11- 25%2007:12:06%20UTC%20To%20Local%20Time) to remind you of [**this link **](https://www.reddit.com/r/selfhosted/comments/17y00pm/benefits_of_c loudflare_access/k9qo17q/?context=3) [**CLICK THIS LINK**](https://www.reddit.com/message/compose/?to=Remin dMeBot&subject=Reminder&message=%5Bhttps%3A%2F%2Fwww.reddit.com%2Fr%2F selfhosted%2Fcomments%2F17y00pm%2Fbenefits_of_cloudflare_access%2Fk9qo 17q%2F%5D%0A%0ARemindMe%21%202023-11-25%2007%3A12%3A06%20UTC) to send a PM to also be reminded and to reduce spam. ^(Parent commenter can ) [^(delete this message to hide from others.)] (https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Delete %20Comment&message=Delete%21%2017y00pm) ***** |[^(Info)](https://www.reddit.com/r/RemindMeBot/comments/e1bko7/remind mebot_info_v21/)|[^(Custom)](https://www.reddit.com/message/compose/?t o=RemindMeBot&subject=Reminder&message=%5BLink%20or%20message%20inside %20square%20brackets%5D%0A%0ARemindMe%21%20Time%20period%20here)|[^(Yo ur Reminders)](https://www.reddit.com/message/compose/?to=RemindMeBot& subject=List%20Of%20Reminders&message=MyReminders%21)|[^(Feedback)](ht tps://www.reddit.com/message/compose/?to=Watchful1&subject=RemindMeBot %20Feedback)| |-|-|-|-| ---------------------------------------------------------------------- QF17 · 2023-11-18 09:39 I can expose things like HASS and my Unifi controller to the public internet, but stick it behind Cloudflare Access (and Office 365) for protection. I can essentially unlock my door anywhere in the country, as O365 has conditional access setup to block international logins and I’ve got MFA set up on it. My port forwarding is only enabled for Cloudflare IP’s, as is Nginx (for extra piece of mind) and I’ve got CF client certificates installed as well. It mitigates the need for me to configure and use a VPN (although I’ve got one of those configured as well) - which I’ve noticed can be disabled on some networks (I always had trouble using VPN’s on T-Mobile in North America when I was there in 2018) ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-11-18 11:51 Maybe try OCserv for your VPN it is using https as a fallback and never failed me. ---------------------------------------------------------------------- Johannesboy1 · 2023-11-18 11:55 Remember that cloudflare will see your traffic, Even with an ssl certificate. ---------------------------------------------------------------------- ElevenNotes · 2023-11-18 12:37 Don't forget that Cloudflare offers no protection against traffic from within Cloudflare. There were several incidents in the past where Cloudflares services where used to break into other clients services (hijacking). ---------------------------------------------------------------------- avdept · 2023-11-18 12:50 There’s not much reasons of exposing any of your local services to internet. Use vpn to have access to your local resources. This is best you can come up with for your home lab ---------------------------------------------------------------------- tradinghumble · 2023-11-18 13:40 Question : what if I need to access my home computer from a work laptop and I’m not allowed to install things such as the WireGuard VPN client. Do I use native say Windows VPN? ---------------------------------------------------------------------- avdept · 2023-11-18 13:41 You can use your phone to use connection via phone ---------------------------------------------------------------------- garibaldi3489 · 2023-11-18 13:43 For most things I agree but I this case I'm thinking of a service where you want to have a group of people access and they all aren't willing or tech-saavy enough to install a VPN ---------------------------------------------------------------------- avdept · 2023-11-18 13:44 Wire guard is super easy. I installed it for all my fam members and it’s constantly on, so they also enjoy benefits of pihole ---------------------------------------------------------------------- garibaldi3489 · 2023-11-18 13:49 Right, so I'm trying to determine if that is worse or if exposing a service without Cloudflare (and being more at risk from someone trying to break into my service because of not having the monitoring/protection Cloudflare provides) is worse. ---------------------------------------------------------------------- garibaldi3489 · 2023-11-18 13:53 I agree, Wireguard is great, but I'm not confident this group of people is going to want something like Wireguard running constantly in the background on their devices. The thing that is appealing about Cloudflare Access is I could put OAuth in front of the app, requiring 2FA login with Google, GitHub, Facebook, etc which seems like it offers a decent amount of protection (though obviously no where as good as a VPN) ---------------------------------------------------------------------- bloody_ass_ · 2023-11-18 14:28 RemindMe! 3 days ---------------------------------------------------------------------- tradinghumble · 2023-11-18 14:29 So connect to my hotspot and then VPN? ---------------------------------------------------------------------- avdept · 2023-11-18 14:34 That’s how i do when I can’t setup vpn ---------------------------------------------------------------------- soapymoapysuds · 2023-11-18 14:51 Benefits have been listed out here by others. The few restrictions I found on the free tier of Cloudflare is that they limit file size for uploads to 200MB. If you were exposing your NAS and want to upload a large file then you need to pay for Cloudflare or it will be restricted. ---------------------------------------------------------------------- GIRO17 · 2023-11-18 15:21 Didn’t they changed their TOS about streaming? ---------------------------------------------------------------------- garibaldi3489 · 2023-11-18 15:23 You mean it is allowed now? I had not heard that ---------------------------------------------------------------------- GIRO17 · 2023-11-18 15:26 I‘m honestly not 100% sure, i would need (and probably should) read trough the TOS my self, or read trough one of the Reddit discussions 😅 But i know there was a TOS change which started a discussion about this. ---------------------------------------------------------------------- soapymoapysuds · 2023-11-18 15:28 First time hearing this. Do you have a source to confirm this. ---------------------------------------------------------------------- CodeSugar · 2023-11-18 15:40 I use Authelia as an extra security protection over my apps, with 2FA. ---------------------------------------------------------------------- garibaldi3489 · 2023-11-18 15:47 I had looked into that but their documentation says "We currently do not support the OpenID Connect 1.0 Relying Party role" which I think means you cannot use any of the major 2FA providers (e.g. Google, Github, Facebook, etc) with Authelia, right? How do you have Authelia configured? ---------------------------------------------------------------------- ripe-lychee · 2023-11-18 16:16 If you have an EC2 Amazon Compute Instance, you don’t hear people saying “Amazon can read your data”. Cloudflare is a major provider like Google or Amazon. Use Tailscale if your not convinced ---------------------------------------------------------------------- garibaldi3489 · 2023-11-18 16:40 Right, I sort of feel like that's the case - any VPS provider can read files on the filesystem or run a daemon. The difference is Cloudflare does a MITM of the SSL but effectively either way the provider has access to your data if they want it so maybe it doesn't matter which provider you use (including Cloudflare) ---------------------------------------------------------------------- iRawrz · 2023-11-18 17:40 I'm not sure about Authelia, but I'm using Authentik with Cloudflare. Cloudflare is federating SSO logins to Authentik and Authentik is federating with Plex and Discord. Often when I'm looking for help with Authentik I find Authelia discussions which usually translate pretty well, so they might have that functionality too. I haven't set up them but there's options to set up with Google and Github. Facebook is there but you need a business account with Facebook and maybe some additional things there. ---------------------------------------------------------------------- amizzo · 2023-11-18 17:40 That really isn't an acceptable solution for many use cases. ---------------------------------------------------------------------- chin_waghing · 2023-11-18 17:55 I use it within my Kubernetes to expose services outsides my house, and then I use Azure AD to manage access. I know this isn’t very self hosted, but for me where I have a dynamic IP and don’t want to play with port forwarding, it’s really good. Nice and easy especially with Kubernetes and the helm chart I wrote ---------------------------------------------------------------------- adamshand · 2023-11-18 18:21 Thank you, didn't realise that! ---------------------------------------------------------------------- adamshand · 2023-11-18 18:25 Assuming it's a Linux server at home and you can use SSH on your work computer, there's a couple ways to do this. - Install a web based terminal client - Setup Cloudflare tunnels on your home server and use the the SSH proxy. I do this with a simple helper in `~/.ssh/config`: ``` Match host "*.cf" ProxyCommand /usr/local/bin/cloudflared access ssh --hostname $(echo %h | sed 's/\.cf$/.homelab.nz/') ForwardAgent yes ``` ---------------------------------------------------------------------- GIRO17 · 2023-11-18 18:42 https://www.reddit.com/r/selfhosted/s/7l8detAeBY One quick search. I haven‘t read trough the TOS as stated before. But i have confirmed that section 2.8 is still gone. ---------------------------------------------------------------------- zfa · 2023-11-18 20:01 No it still isn't allowed. Despite the TOS being expanded and making it's use cases even more explicit some people can't understand them and assume because S2.8 had gone the restriction has gone. It hasn't. ---------------------------------------------------------------------- trisanachandler · 2023-11-19 03:11 Do you have the examples of this so I can take a look? Was it ports forwarded that were opened to all cloudflare ranges, or tunnels and a backend exploit? ---------------------------------------------------------------------- ElevenNotes · 2023-11-19 06:21 You can look online. Basically Cloudflares blocking features exclude Cloudflares own IP ranges. Someone used their own services (in their own IP range) to attack services and since the request came from a Cloudflare IP it was not blocked or filtered. Pretty embarassing if you ask me. But this is normal in the cloud. ---------------------------------------------------------------------- 2treesandatiger · 2023-11-19 09:41 Don’t you need to configure DDNS regardless? And port forwarding as well unless you went with tunnels? ---------------------------------------------------------------------- trisanachandler · 2023-11-19 12:08 I do agree, they should use the same address space for ingress and egress. Though tunnels I would hope would be immune, but perhaps not. ---------------------------------------------------------------------- chin_waghing · 2023-11-19 15:10 For cloudflare tunnels no, it does a nat punch through I think it's called, where it connects from inside your network out to 2 edge locations to cloudlfare, where it then can send traffic back and forwards. ​ If I wanted to expose by port forwarding, then yes you are correct, I could configure ddns. Personally, I would configure my own version of DDNS where it's just a cron job once every 5 minutes to run terraform and check if my public IP has changed, and if it has run an apply. ​ Does that answer the question? ---------------------------------------------------------------------- discoshanktank · 2023-11-19 17:08 Wait don’t you need the Cloudflare agent to be able to connect to a tunnel that’s set up? ---------------------------------------------------------------------- 2treesandatiger · 2023-11-19 17:32 Ye, I though tunnels needed a public ip still but it makes sense it doesn’t given there’s a service running in your network that can do that check ---------------------------------------------------------------------- discoshanktank · 2023-11-19 18:07 Whoa that’s a clever solution for ddns ---------------------------------------------------------------------- adamshand · 2023-11-19 19:17 Yes, you need `cloudflared`, but it's just a binary that ssh calls. ---------------------------------------------------------------------- GIRO17 · 2023-11-19 22:15 Do you happen to know the section number? ---------------------------------------------------------------------- chin_waghing · 2023-11-20 00:19 Thank you, I am more than happy to share the configuration/ give pointers if anyone wants to do something similar and is struggling ---------------------------------------------------------------------- zfa · 2023-11-20 02:02 Mainly covered by the CDN section of the non-Enterprise TOS: https://www.cloudflare.com/en-gb/service-specific-terms-application- services/#content-delivery-network-terms Specifically: > Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files. They even did a blog post clearing it all up: https://blog.cloudflare.com/updated-tos/ Specifically: > we made it clear that customers can serve video and other large files using the CDN so long as that content is hosted by a Cloudflare service like Stream, Images, or R2. ... **Video and large files hosted outside of Cloudflare will still be restricted on our CDN** There is no ambiguity, not sure why people get confused.