So everyone is talking about cloudflare tunnels and I decided to give it a shot.
However, I find the learning curve quite hard and would really appreciate a short introduction into how they work and how do I set them up…
In my current infrastructure I am running a reverse proxy with SSL and Authentik, but nothing is exposed outside. I access my network via a VPN but would like to try out and consider CF. Might be easier for the family.
How does authentication work? Is it really a secure way to expose internal services?
Thanks!
@operator
Cloudflared tunnels are great. No firewall ports to open.
I installed the Cloudflared docker, which is headless, and fed it my API key. Then Cloudflared creates a VPN between your system and theirs. Then, think of Cloudflare as the reverse proxy, you just configure it on the CF site instead of locally. No need for a reverse proxy on your side.
I’ve not done anything with auth on it as what I run I don’t mind being public. If you still want to run a local auth, you can set it to hit your local reverse proxy instead and do it that way.
The benefits are you don’t need to open firewall ports and your local IP is irrelevant so no need for dynamic DNS.
Just a side note that “not opening firewall ports” is not inherently a security benefit if you’re exposing the same service on the same port on the same host anyway via your reverse proxy setup.
If you were to measure your level of “security” on having ports open or not alone, then using Cloudflare tunnels could be considered worse, since an outbound VPN connection to Cloudflare is essentially circumventing your firewall’s protection entirely, meaning you’re effectively opening all 65,535 TCP and UDP ports instead of one, albeit only to Cloudflare.
There are benefits to using Cloudflare tunnels but “not opening firewall ports” is not one of them. And you could just as easily accomplish the same thing without Cloudflare by using a VPS and Tailscale with the selfhosted Headscale coordinator.