THIS could be a good alternative if you don't want to use Cloudflare tunnel, and it does not get talked about a lot here. reddit / selfhosted ---------------------------------------------------------------------- HorizonTGC · 2023-11-22 03:31 In response to the discussion on a recent thread about whether to trust Cloudflare, as some people are not very comfortable with it terminates HTTPS (MITM). There is this thing called Fast Reverse Proxy (FRP) [https://github.com/fatedier/frp](https://github.com/fatedier/frp) It's open source, very lightweight and I have used it in multiple instances. Frankly there doesn't seem to be a lot of people know/use it here. The idea is you deploy this on a VPS with public IP, and have your server at home connect to it. It is pretty much like your own Cloudflare tunnel, only you have much more control over it (ports, TCP/UDP/HTTP, auth, etc). I use it on the cheapest VPS ($5) I can find close to where I live. It acts as a simple TCP reverse proxy to my server, where Nginx Proxy Manager handles the actual HTTPS. (You *can* let FRP handle HTTPS but then you need to think about if you trust the VPS and also keep the certs updated there, so nah.) It's developed by a Chinese dude as it is pretty much a necessity for selfhosters (mostly minecraft servers) in China, since Public IP is scarce there and most people live behind CGNATs. ---------------------------------------------------------------------- garibaldi3489 · 2023-11-22 03:42 This type of tool is interesting, and provides some of the functionality that Cloudflare Tunnel does, but with frp, a vulnerability in your app (or its login screen) could be more easily exploited since you don't have the traffic protection features that Cloudflare provides, right? Maybe combining this with fail2ban (or is there another similar self-hosted tool) would not only act as a proxy but also help protect your app to a degree like Cloudflare does? ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-11-22 03:42 Personally, when I used to route my home services through a VPS- I used a simple VPN tunnel from my VPS to my home network, which my home router would establish (dynamic IP). From there, my firewall dictated what was actually allowed to enter through the tunnel... and the reverse proxy, did its thing. ---------------------------------------------------------------------- DIBSSB · 2023-11-22 04:10 Wiki I want to do the same ---------------------------------------------------------------------- HorizonTGC · 2023-11-22 04:14 I keep all my web apps behind Authelia, so all others can see is just the login screen. I suppose it's a good enough compromise? For risky stuff like SSH and RDP, FRP does have feature to require the client to also connect via FRP (with correct auth) before letting you access the actual service, kinda like an adhoc VPN. It's always the trade-off. If you want Cloudflare to handle your security, you kinda have to trust them to decrypt your traffic. BTW, I would not consider simply putting stuff in the tunnel "protected". ---------------------------------------------------------------------- HorizonTGC · 2023-11-22 04:20 This seems to be the most common solution here. But personally I'm not a big fan of it as it requires me to first connect to my VPN before able to access anything. Most mobile devices would only allow you to use one VPN at a time. If you need VPN to access work or geo-banned stuff then it's not that ideal. ---------------------------------------------------------------------- SnowyLocksmith · 2023-11-22 04:25 That true. But on the flip side, its much more secure. Only you can access it, rather than have it exposed to the world ---------------------------------------------------------------------- nguyening · 2023-11-22 04:26 Yep, not to mention lack of support for a lot of Smart TVs like Roku which is kind of needed for sharing a media server like jellyfin or plex ---------------------------------------------------------------------- Pi_ofthe_Beholder · 2023-11-22 04:28 This is just the kind of tool to get me back to this ---------------------------------------------------------------------- Tivin-i · 2023-11-22 05:24 Well, pretty much any type of tunneling software such as Tailscale or Wireguard will achieve the same, you just need to change a bit where your components are located. What I personally do is have swag proxy on the VPS with crowdsec and authelia, this redirects the traffic to the internal wireguard/tailscale mesh network to the specific service requested. If you are the only user of the services, create a tailscale or a netmaker; Not sure about tailscale but in Netmaker (wireguard based) you can choose to have your VPS as the relay host. ---------------------------------------------------------------------- JPH94 · 2023-11-22 05:36 This is interesting how do you use swag with crowdsec and how do use it with your mesh net would it not just be ip and port over Tailscale? I’d love to know more or see some config ---------------------------------------------------------------------- OhMyForm · 2023-11-22 05:46 I just use a vpn ---------------------------------------------------------------------- Tivin-i · 2023-11-22 05:50 Here is the document for crowdsec: [https://www.linuxserver.io/blog/blocking-malicious-connections-with- crowdsec-and-swag](https://www.linuxserver.io/blog/blocking-malicious- connections-with-crowdsec-and-swag) The only difference is that I use the crowdsec API on their community edition instead of the local API, also if you use the community edition + crowdsec docker, you can enroll that container to the console they offer with "cscli console enroll" command. You are correct on the tailscale network, the forwarding is by Tailscale IP and port to the requested service OR the internal DNS name that you can configure - you'll find that under "DNS->Tailnet Name" on your tailscale admin dashboard. my ufw configuration is: ``` sudo ufw allow in on tailscale0 sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw route allow from 100.64.0.0/10 to any ``` For your swag instance you'll also need `ufw allow 443` ---------------------------------------------------------------------- ElevenNotes · 2023-11-22 05:53 This. Just use plain old Wireguard. ---------------------------------------------------------------------- lilolalu · 2023-11-22 05:54 I think a lot of proxy servers have that functionality, HAproxy definitely has... With nginx you need the "plus" Version to proxy tcp. ---------------------------------------------------------------------- ItsAddles · 2023-11-22 06:12 I use tailscale and nginxproxymanager to do this. It was like 4 command ---------------------------------------------------------------------- garibaldi3489 · 2023-11-22 06:23 With Cloudflare Tunnels, if you disable [TLS decryption](https://developers.cloudflare.com/cloudflare- one/policies/gateway/http-policies/tls-decryption/), use [Full or Full (strict)](https://developers.cloudflare.com/ssl/origin- configuration/ssl-modes), and verify that the certificate in your browser is yours and not Cloudflare's certificate, wouldn't that mean that the SSL is unbroken from your server to the browser? Or can these options not be used with Cloudflare Tunnels? ---------------------------------------------------------------------- DecideUK · 2023-11-22 06:35 That's while you either do it at Router level, or spin up a "VPN gateway" VM if you want to be more selective. ---------------------------------------------------------------------- NekoLuka · 2023-11-22 06:59 I use this for all my services that need to be accessible from the outside world... For my private services I use tailscale + headscale ---------------------------------------------------------------------- p_235615 · 2023-11-22 07:02 Why do you really need this ? Why not just set up a VPS and deploy the NginxProxyManager to it together with a wireguard tunnel to your home system. You really dont need 2 proxies... Or if you want to keep the NPM localy on your home server, then you just setup wireguard on VPS with NAT and port forward to your tunnel. ---------------------------------------------------------------------- WiseCookie69 · 2023-11-22 07:14 I use a SSH tunnel. Doesn't need more then a barebones VPS running with OpenSSH. ---------------------------------------------------------------------- Old-Satisfaction-564 · 2023-11-22 07:16 It does the same as haproxy but haproxy is better ---------------------------------------------------------------------- Ebrithil95 · 2023-11-22 07:22 No, you dont connect to a vpn. You connect your vps to your home network via vpn. This is essentially exactly what cloudflare tunnel does just that you do it yourself ---------------------------------------------------------------------- PsychotherapistSam · 2023-11-22 07:37 Frp is a pretty cool tool, I mostly use Tailscale with a Reverse Proxy on a VPS for my remote access, but I tunnel my Minecraft Servers using frp, since it's lower latency and more stable than Tailscale. For Websites I couldn't notice a difference, and Tailscale + Caddy worked easier for me than frp ---------------------------------------------------------------------- sinofool · 2023-11-22 07:37 What recent thread about trust Cloudflare? Tunnel needs a client software, it's higher risk, larger attack surface than normal http reverse proxy. The Cloudflare tunnel feature is part of its zero-trust product. It make sense if you are capable of audit the client source code. If you trust the client as you trust nginx reverse proxy software, tunnel is safer. Regular free Cloudflare proxy include basic WAF, it is more useful than selfhosted VPS reverse proxy or fail2ban. These commercial services learn attack patterns much earlier. My homelab exposed services all have real HTTPS certs behind Cloudflare. My service is configured trust Cloudflare origin only so attackers cannot bypass WAF. This is also the same setup my workplace setup to protect multi-million transactions. If the tunnel is used not for security reason, but bypass CGNAT, it's at least not worse than selfhosted reverse proxy. ---------------------------------------------------------------------- sinofool · 2023-11-22 07:40 \+1 this. In order to serve IPv6, I have a VPS and IPv4 tunnel, just one proxy is enough. ---------------------------------------------------------------------- tomhung · 2023-11-22 07:53 For web stuff, put ninjafirewall in front of it as a simple WAF. ---------------------------------------------------------------------- sarkyscouser · 2023-11-22 07:58 I'm assuming the benefit over say Caddy + Authelia is that you don't need to open any local ports such as 80 and 443? ---------------------------------------------------------------------- Cybasura · 2023-11-22 08:27 Interesting, so is this like a uPNP in this case? ---------------------------------------------------------------------- mikhatanu · 2023-11-22 10:00 Isn't cloudflare tunnel a reverse proxy too? ---------------------------------------------------------------------- RowdyRidger19 · 2023-11-22 10:54 Isn't that something you accept when you self host anything? You're assuming more risk than just trusting a cloud provider to protect your data and service? Opnsense +IPS, fail2ban, and disallowing ips from other countries, plus 2fa are all tools you should deploy if you're selfhosting. ---------------------------------------------------------------------- EmanuelSchanderl · 2023-11-22 11:02 if you would proxy at home and have a trusted SSL encrypted (https) traffic from there the combination with a VPN would provide you with me -(https)-> VPs -(WG(https))-->home that right? ---------------------------------------------------------------------- ElevenNotes · 2023-11-22 11:07 I would do: WAN > VPS IPv4 > Wireguard VPN > Traefik Proxy > your /r/selfhosted stuff No need to terminate TLS on the VPS, you can just use the VPS as a L3 VPN router. ---------------------------------------------------------------------- EmanuelSchanderl · 2023-11-22 11:23 that's what I meant so having SSL encrypted traffic from user to proxy all the way along it would be additionally protected by wireguard in the tunnel between VPs and proxy which should be sufficient Enough! just taking a real-world counterexample who selfhosts their bank account at home? no one sure! what's the security measures? user -(https)-> banks-proxy(probably) so what point are we trying to make? ---------------------------------------------------------------------- lucaprinaorg · 2023-11-22 12:04 from Colin Percival empire we present "spiped": [https://github.com/Tarsnap/spiped](https://github.com/Tarsnap/spiped) [https://www.daemonology.net/blog/2012-08-30-protecting-sshd-using- spiped.html](https://www.daemonology.net/blog/2012-08-30-protecting- sshd-using-spiped.html) [https://www.daemonology.net/blog/2011-07-04-spiped-secure-pipe- daemon.html](https://www.daemonology.net/blog/2011-07-04-spiped- secure-pipe-daemon.html) yes, it's true and it's not black magic...if you understand tha simple technology behind...and yes it's a magic bullet enjoy ---------------------------------------------------------------------- LEpigeon888 · 2023-11-22 12:41 > Why not just set up a VPS and deploy the NginxProxyManager to it together with a wireguard tunnel to your home system. The issue is that NPM will decrypt the HTTPS traffic on the VPS, which was the issue in the previous thread (you have to trust the VPS host to not snoop on your data, by reading the RAM or just by having installed some backdoor on it). > Or if you want to keep the NPM localy on your home server, then you just setup wireguard on VPS with NAT and port forward to your tunnel. What do you mean? Forward every packet your VPS receive to your home server? ---------------------------------------------------------------------- Karyo_Ten · 2023-11-22 13:03 Use a reputable self-hosted VPN, for example https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ (Trail of Bits is one of the top auditor/security company) ---------------------------------------------------------------------- ochbad · 2023-11-22 13:04 Wireguard plus like 2 lines of nftables config will NAT (port forward) traffic over VPN to internal host. Technically i use freebsd/pf, because I prefer the syntax -- but I was previously doing the same thing with Debian/ntfales: # redirect port 80 and 440 to internal nginx rdr pass on $external_iface proto tcp to $vps_public_ip port { http, https } -> $internal_nginx # nat my home ip to server ip so that I can access service myself, not needed for external clients nat pass on $vps_private_ip proto tcp from $home_pubic_ip to $internal_nginx port { http, https } -> $vps_public_ip The advantage of this is (with configuration) it works with arbitrary UDP (games.) For just http(s), just using a proxy is probably the better solution. ---------------------------------------------------------------------- sevlonbhoi1 · 2023-11-22 13:17 I run an oracle free vps with caddy reverse proxy to route traffic to my home server over wireguard/tailscale. Been running this setup from last 4-5 years with zero issues. ---------------------------------------------------------------------- jwink3101 · 2023-11-22 13:51 I am not intending to be pedantic. I just want to be clear since I’m considering the same: you are using a *reverse* tunnel, right? ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-11-22 13:51 > requires me to first connect to my VPN before able to access anything Eh, your router does this part automatically. The tunnel is always up.... ---------------------------------------------------------------------- WiseCookie69 · 2023-11-22 13:52 Yes :) Sorry, should've been more clear. ---------------------------------------------------------------------- p_235615 · 2023-11-22 14:50 Just basically do a port forward to the tunnel, same as if you doing port forward+NAT from your router to your server on the local network. Only difference is, that you are forwarding from VPS public IP to your "local network" in the VPN tunnel. So sending every packet only to the forwarded ports. ---------------------------------------------------------------------- malastare- · 2023-11-22 16:31 1. It's not even close to the protection Cloudflare provides, but it might be enough for people who don't trust Cloudflare. 2. DDoS protection is pretty low, unless your VPS provider has that sitting in front of the VPS subnet. In my experience, that's not likely. Again, that might not be a problem. 3. This also prevents stateful inspection or filtering known-malicious attack patterns. They still need to be filtered at the server (where SSL terminates) 4. This is a good solution if you don't trust Cloudflare, a service that would disappear if it became untrusted by enterprise services, but do trust a service that sells you a $5 VPS. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-22 16:32 But why do double encryption? Everything between the VPS and your home in this scenario would be TLS-encrypted all the way between the client and the target app so the VPN would be redundant and only consume extra VPS CPU. ---------------------------------------------------------------------- Ebrithil95 · 2023-11-22 16:35 depends on the setup, if your reverse proxy is running on the vps its not double encrypted. Also this setup means you a) dont expose your home ip via dns and b) dont have to open any ports on your home network so in that sense its more secure ---------------------------------------------------------------------- KN4MKB · 2023-11-22 16:40 Cloudflare is not meant to protect you from vulnerabilities in your application. Your security posture needs to be good before using cloudflare. Cloudflare is there to protect from network level vulnerabilities, as a web application firewall isn't great for each individual app. ---------------------------------------------------------------------- Zach78954 · 2023-11-22 17:44 I use this and cloudflare. For my normal self hosted app’s cloudflare works great but for stuff that needs a lot of data (Plex) or custom ports I route I through FRP. ---------------------------------------------------------------------- HearthCore · 2023-11-22 17:56 So a VPN and a reverse proxy, any can be combined this way ---------------------------------------------------------------------- Tripanafenix · 2023-11-22 18:43 My choice was Caddy v2 and wg_easy as well as a Python script which updates the IP if changed automatically. My own dyndns if you will ---------------------------------------------------------------------- GolemancerVekk · 2023-11-22 18:59 I don't understand what you're saying. Both the reverse TCP proxy that OP posted and a VPN tunnel work the same: you initiate from your home server to the VPS so you don't have to open any ports. The only difference is the encryption. The TLS connections go client -> VPS -> [TCP proxy or VPN tunnel] -> home server -> NPM -> target app. This entire chain is encrypted with TLS. It doesn't matter if you use a TCP proxy for that segment or a VPN tunnel, you still have TLS encryption. In both cases the client will see the IP of the VPS not your home IP, because in both cases you point the domain name at the VPS IP. For all intents and purposes the segments after the VPS are invisible to the client; to them it looks like the app is on the VPS. ---------------------------------------------------------------------- Ebrithil95 · 2023-11-22 19:01 I was not talking about a tcp proxy but a https reverse proxy for that to work the connection has to be initated by the vps to the home server and thus you need either open ports or a vpn which can be established the other way round without opening ports ---------------------------------------------------------------------- GolemancerVekk · 2023-11-22 19:02 So don't use an HTTPS proxy. If you're going to do that you might as well use Cloudflare. ---------------------------------------------------------------------- Ebrithil95 · 2023-11-22 19:03 The point against cloudflare was that then you would have a third party that has access to the unencrypted traffic ---------------------------------------------------------------------- ChinoneChilly · 2023-11-22 20:51 Is there an app that’s friendly and quick to use to set the forwarding up for multiple applications? Or do you usually just do it manually? Cause doing it manually means that you’d have to create the tunnel then make sure the tunneled port is exposed on the VPS end to access the application remotely. I am kinda less inclined to setting this up manually because if you have a lot of applications running then keeping track of the tunnels manually becomes hard. ---------------------------------------------------------------------- geekywarrior · 2023-11-22 20:56 Have you seen this list? Lots of services like this. https://github.com/anderspitman/awesome-tunneling ---------------------------------------------------------------------- WiseCookie69 · 2023-11-22 20:59 You have to set up a tunnel for each port manually. I recommend having a look at `autossh` to manage your connections. And then: `autossh -N -M 0 -v -o StrictHostKeyChecking=yes -o IdentityFile=/ssh/id_rsa -o UserKnownHostsFile=/ssh/known_hosts -N $YOUR_SERVERS_IP -R 0.0.0.0:443:ingress-nginx-controller.ingress- nginx.svc.cluster.local:443 -l root` You can have multiple `-R` bits in the same call. [`0.0.0.0:443`](http://0.0.0.0:443) would be the bind address on your VPS and `ingress-nginx-controller.ingress-nginx.svc.cluster.local:443` your local forwarding target (as the name suggests, i just forward port 443 from my VPS to port 443 on my ingress-nginx in Kubernetes, which handles the proxying to all my applications). It might be possible that you have to set [`GatewayPorts yes`](https://man.openbsd.org/sshd_config.5#GatewayPorts) first in your server's OpenSSH config. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-22 21:12 If you use a HTTPS proxy on the VPS then the VPS provider can intercept your traffic. You want an uninterrupted TLS connection from the client all the way to your app, signed with your certificate. ---------------------------------------------------------------------- ChinoneChilly · 2023-11-22 21:31 Interesting, yeah this feels pretty standard actually, I might try looking more into autossh and see if it works for me, thanks! ---------------------------------------------------------------------- discoshanktank · 2023-11-22 21:34 I don’t see how the provider could intercept your traffic. Especially if you encrypt the volumes on your vps. TLs traffic would get decrypted on the vps and then sent thru a vpn tunnel to your home server ---------------------------------------------------------------------- zfa · 2023-11-22 21:38 AFAIK TLS Decryption is an option under Cloudflare Gateway not CLoudflare Access. ELI5 is that the former product concerns itself with egress and the latter with ingress. So the 'TLS Decryption' option refers to whether CF should simply not inspect certain outbound traffic from envs passing their traffic out via Cloudflare and instead just pass it straight through; whereas the 'TLS Mode' setting setting the the protocol CF should use to connect to your backends when proxying traffic for users outside of CF and accessing services through them. ---------------------------------------------------------------------- garibaldi3489 · 2023-11-22 21:59 Ok, thanks for the clarification! ---------------------------------------------------------------------- GolemancerVekk · 2023-11-22 22:02 > TLs traffic would get decrypted on the vps and then sent thru a vpn tunnel to your home server You've just answered your question. You're creating a gap between the TLS encryption and the VPN encryption, which gap takes place on the VPS. That's where the provider can sniff it. Why do that when you could have uninterrupted TLS all the way (and lower CPU cost). With full TLS the only way to intercept traffic (assuming you don't offer unencrypted HTTP and don't have HSTS disabled) is to get a secondary legit SSL cert for your domain, pose as your domain to the clients, terminate their cert on the VPS, sniff the traffic, then re- encrypt with your cert from the VPS to your app. While in theory a VPS provider could do that, it's really far-fetched. For Cloudflare it's trivial because they're also your DNS provider and your SSL cert provider. ---------------------------------------------------------------------- zfa · 2023-11-22 22:05 No worries - thinking about it you still get intercepted traffic even in my last hypothetical scenario as CF would still terminate traffic at the start of the CDN leg, and all that having TLS Decryption set off would do is mean they don't do it again. I'd imagine they kind of do this automatically in these rare cases anyway just for efficiency. Interesting thought though. ---------------------------------------------------------------------- visualdescript · 2023-11-22 22:07 With the TCP proxy, how does the VPS pass the request on to your home server? The ip has to be publicly exposed right? I guess you could lock it down to the VPS ip, but still that is less secure than a VPN connection. ---------------------------------------------------------------------- garibaldi3489 · 2023-11-22 22:10 But if you checked and saw your certificate (and not CF's certificate) in the browser, that would mean that *somehow* you managed to configure it not to terminate SSL traffic in the middle, when it first hits Cloudflare, right? ---------------------------------------------------------------------- zfa · 2023-11-22 22:15 If you checked and you saw that then yes that would be the case, assuming you hadn't accidentally set your CF proxying off (DNS entry grey-cloud) which would yield the same result. ---------------------------------------------------------------------- phin586 · 2023-11-23 05:09 Or you can run it on the local server. Either way, same results. ---------------------------------------------------------------------- chonkat2 · 2023-11-23 06:47 tailscale, anyone? ---------------------------------------------------------------------- murdaBot · 2023-11-23 13:36 Throughput on these "cheap" VPS providers is atrocious. I have 1Gbe into my home and none of the VPS providers can break more than a few hundred mbps, except for Cloudflare. The other issue is consistency, speeds fluctuate all over the map with these cheap VPS providers - even the big one like Vultr, Linode, and Hetzner aren't much better. ---------------------------------------------------------------------- murdaBot · 2023-11-23 13:38 You've got it backwards. CF won't protect you from network level vulns, it's *specifically* designed to protect you from application layer vulns. ---------------------------------------------------------------------- KN4MKB · 2023-11-23 17:05 Okay let me rephrase that. Cloudflare is not a great WAF because it attempts to cover a generic list of known web application exploit signatures that doesn't really protect you from specific application level vulnerabilities due to the nature of how their WAF works. An example like your JellyFin instance having a local file inclusion. Or your WordPress website having a SQL injection vulnerability. There are widely known ways that bypass Cloudflares WAF because attackers only need to slightly modify the payload to bypass the signature. That's why Cloudflare better protects on the session and presentation level of the OSI model. If you want a true WAF you need to really create and use signatures for your web application specifically like Snort, and databases for your app. ---------------------------------------------------------------------- grandfundaytoday · 2023-11-23 18:38 How is this any different than just running a reverse proxy in your home network - aside from allowing the HTTP/HTTPS ports to reach the proxy. If you're running pfsense you could run the reverse proxy ON the router (HAproxy.) ---------------------------------------------------------------------- Ebrithil95 · 2023-11-23 18:39 Main difference is that you dont have to expose your home ip via dns to the internet