Hello I’ve been using cloudflare to get remote access for the couple apps I selfhost, but lately I’ve been hearing about the wonders of tailscale.
It seems that the free tier is enough for my use.
Which would be a safe option to have remote access for my 3D printer?
Also how are both in terms of privacy?
Look man I get that you’re not very tech literate and as a hobbyist that’s perfectly ok but just because you don’t know much about technology doesn’t mean the technology doesn’t make sense. You wanted to know what’s different and I told you, you wanted to know how and I told you. If you still don’t understand something then you need to articulate that and ask an actual question. It took me years to earn a degree in network engineering I can’t just distill all of that knowledge into a single comment for you to cover every possible dependent piece of knowledge that you’re lacking because all you can communicate is “I don’t get it”. You have to be specific on what it is specifically that you’re not getting.
I will indulge you again here under what might be a false assumption that you genuinely want to know the answer.
Cloudflare MITMs your traffic because that’s how it was designed. Your traffic is encrypted to their servers, de encrypted, then reencrypted between Cloudflare and your server. They can see and modify any data you send through them. All your passwords, tokens, and personal information are readable by Cloudflare. Therefore there’s an incredible amount of trust you need to put in Cloudflare, and the security of their systems.
Tailscale on the other hand has a service called funnel, which is a direct replacement to Cloudflare tunnels, however they differ in that Tailscale is a company with privacy and security as a priority and they accomplish the same goal as CF tunnels but their solution is designed to keep your data encrypted end to tend, from your client to your server. You therefore don’t need to place all that trust with Tailscale because they can’t see or modify your data even if they wanted to.
Both services accomplish the task of proxying public traffic to your backend server, however CF opens up all your data, and Tailscale doesn’t. Think of them both like a postal service, except Cloudflare opens up all your mail and puts it into new envelopes before giving it to the carrier for delivery to your mailbox. A lot of us prefer the postal service that just leaves your mail sealed from origin to destination.
I apologize, I misread the chain of comments. Your explanation is perfectly adequate for someone who has a basic grasp on networking and VPN and tunnels and encryption.
I would just like to add that if your endpoints communicate via an encrypted transport (HTTPS, SSH, etc) then doesn’t matter if cloudflare tries to inspect your packets. There would be 2 layers of encryption while traversing the public web, then 1 layer when traversing CF’s network.
And to some, packet inspection is not a downside since they can offer more protection - but that is totally up to your attack vector tollerence
I would just like to add that if your endpoints communicate via an encrypted transport (HTTPS, SSH, etc) then doesn’t matter if cloudflare tries to inspect your packets. There would be 2 layers of encryption while traversing the public web, then 1 layer when traversing CF’s network.
Thats not how Cloudflare tunnels work. Your data is encrypted to Cloudflare’s network then decrypted. Then they encrypt a second connection between their server and yours via a connector service running in your server. It does matter if CF tries to inspect your packets because there is one layer of encryption over the internet, then briefly zero layers of encryption, then one layer of encryption while traversing CF network. I’m not aware of any product that Cloudflare provides that allows for them to tunnel your HTTPS traffic without them being able to decrypt your data to plain text.
hmm, I’m not sure I agree - or perhaps I didn’t explain myself well previously and caused confusion between us.
Yes I agree with you in your description of how cloudflare encrypts -> decrypts -> encrypts; they are allowing you to ride over their network. If you remove cloudflare from the picture entirely, then you just have the internet facing server.
What I’m saying is, if the client and endpoint (server) talk in an encrypted protocol, then cloudflare cannot MiTM the data, only the IP headers. This is similar if you were to connect to any ol’ website over an ISP’s network. If your session is not HTTPS, then your application data can be read. You can have encrypted sessions inside of CF tunnel-network-tunnel.
If your services support encryption, great. But you can also expose a wireguard endpoint so you have the following
wg client --(tunnel to CF)–> CF network --(tunnel to your server)–> wireguard server
the real advantage to CF tunnel is hiding your IP from the public internet, not poking any holes in your firewall for ingress traffic, and cloudflare can apply firewall rules to those clients trying to reach your server by DNS hostname.
You’re explaining yourself fine, you’re just mistaken about the way Cloudflare tunnels work. You’re confusing concepts between a L4 proxy and a L7 proxy.
What I’m saying is, if the client and endpoint (server) talk in an encrypted protocol, then cloudflare cannot MiTM the data, only the IP headers.
This is not the case. You are under the mistaken impression that CF tunnels work like a L4 tunnel, proxying a TCP stream from client to server, allowing you to maintain an encrypted TLS session from client to server. That would be closer to what Tailscale Funnel does (Which I’d advocate for). CF tunnels do not work this way. Cf tunnels work more like a L7 proxy. Your client and your server never talk, so there is no encrypted protocol between them. There is only encryption between you and Cloudflare, and then Cloudflare and your backend server. Cloudflare can and does MitM the data AND the IP headers.
This is similar if you were to connect to any ol’ website over an ISP’s network. If your session is not HTTPS, then your application data can be read.
You cannot establish an HTTPS connection with your application from your client. You establish an HTTPS connection with Cloudflare, which gives them plaintext access to all the data you send through them.
You can have encrypted sessions inside of CF tunnel-network-tunnel.
To be clear, no you can’t. This is your misunderstanding. At least, you can’t with Cloudflare tunnels. Cloudflare may offer a TCP proxy service, which is what you’re confusing CF tunnels with, if you sign up for an enterprise plan, but you don’t get that functionality in their free plan which OP, and self hosters in general would be using.
I am ready to accept everything you’ve said but there is the SSH case that keeps tripping me up. For reference, here is the CF docs on Connecting SSH through CF Tunnels.
Can you help me clear up the misunderstanding here? From the docs it appears you can create a SSH key pair on a client and then copy the public key to the server. It does not appear that the docs state you need to share those keys with CF, so I assume (perhaps incorrectly) that my session will be encrypted with my private key (on client) and public key (on server).
Again, what you said appears to make sense, perhaps SSH is the only edge case that is implemented differently?
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
Look man I get that you’re not very tech literate and as a hobbyist that’s perfectly ok but just because you don’t know much about technology doesn’t mean the technology doesn’t make sense. You wanted to know what’s different and I told you, you wanted to know how and I told you. If you still don’t understand something then you need to articulate that and ask an actual question. It took me years to earn a degree in network engineering I can’t just distill all of that knowledge into a single comment for you to cover every possible dependent piece of knowledge that you’re lacking because all you can communicate is “I don’t get it”. You have to be specific on what it is specifically that you’re not getting.
I will indulge you again here under what might be a false assumption that you genuinely want to know the answer.
Cloudflare MITMs your traffic because that’s how it was designed. Your traffic is encrypted to their servers, de encrypted, then reencrypted between Cloudflare and your server. They can see and modify any data you send through them. All your passwords, tokens, and personal information are readable by Cloudflare. Therefore there’s an incredible amount of trust you need to put in Cloudflare, and the security of their systems.
Tailscale on the other hand has a service called funnel, which is a direct replacement to Cloudflare tunnels, however they differ in that Tailscale is a company with privacy and security as a priority and they accomplish the same goal as CF tunnels but their solution is designed to keep your data encrypted end to tend, from your client to your server. You therefore don’t need to place all that trust with Tailscale because they can’t see or modify your data even if they wanted to.
Both services accomplish the task of proxying public traffic to your backend server, however CF opens up all your data, and Tailscale doesn’t. Think of them both like a postal service, except Cloudflare opens up all your mail and puts it into new envelopes before giving it to the carrier for delivery to your mailbox. A lot of us prefer the postal service that just leaves your mail sealed from origin to destination.
I apologize, I misread the chain of comments. Your explanation is perfectly adequate for someone who has a basic grasp on networking and VPN and tunnels and encryption.
I would just like to add that if your endpoints communicate via an encrypted transport (HTTPS, SSH, etc) then doesn’t matter if cloudflare tries to inspect your packets. There would be 2 layers of encryption while traversing the public web, then 1 layer when traversing CF’s network.
And to some, packet inspection is not a downside since they can offer more protection - but that is totally up to your attack vector tollerence
Thats not how Cloudflare tunnels work. Your data is encrypted to Cloudflare’s network then decrypted. Then they encrypt a second connection between their server and yours via a connector service running in your server. It does matter if CF tries to inspect your packets because there is one layer of encryption over the internet, then briefly zero layers of encryption, then one layer of encryption while traversing CF network. I’m not aware of any product that Cloudflare provides that allows for them to tunnel your HTTPS traffic without them being able to decrypt your data to plain text.
hmm, I’m not sure I agree - or perhaps I didn’t explain myself well previously and caused confusion between us.
Yes I agree with you in your description of how cloudflare encrypts -> decrypts -> encrypts; they are allowing you to ride over their network. If you remove cloudflare from the picture entirely, then you just have the internet facing server.
What I’m saying is, if the client and endpoint (server) talk in an encrypted protocol, then cloudflare cannot MiTM the data, only the IP headers. This is similar if you were to connect to any ol’ website over an ISP’s network. If your session is not HTTPS, then your application data can be read. You can have encrypted sessions inside of CF tunnel-network-tunnel.
If your services support encryption, great. But you can also expose a wireguard endpoint so you have the following
wg client --(tunnel to CF)–> CF network --(tunnel to your server)–> wireguard server
the real advantage to CF tunnel is hiding your IP from the public internet, not poking any holes in your firewall for ingress traffic, and cloudflare can apply firewall rules to those clients trying to reach your server by DNS hostname.
You’re explaining yourself fine, you’re just mistaken about the way Cloudflare tunnels work. You’re confusing concepts between a L4 proxy and a L7 proxy.
This is not the case. You are under the mistaken impression that CF tunnels work like a L4 tunnel, proxying a TCP stream from client to server, allowing you to maintain an encrypted TLS session from client to server. That would be closer to what Tailscale Funnel does (Which I’d advocate for). CF tunnels do not work this way. Cf tunnels work more like a L7 proxy. Your client and your server never talk, so there is no encrypted protocol between them. There is only encryption between you and Cloudflare, and then Cloudflare and your backend server. Cloudflare can and does MitM the data AND the IP headers.
You cannot establish an HTTPS connection with your application from your client. You establish an HTTPS connection with Cloudflare, which gives them plaintext access to all the data you send through them.
To be clear, no you can’t. This is your misunderstanding. At least, you can’t with Cloudflare tunnels. Cloudflare may offer a TCP proxy service, which is what you’re confusing CF tunnels with, if you sign up for an enterprise plan, but you don’t get that functionality in their free plan which OP, and self hosters in general would be using.
thanks for the masterclass in CF tunnels.
I am ready to accept everything you’ve said but there is the SSH case that keeps tripping me up. For reference, here is the CF docs on Connecting SSH through CF Tunnels.
Can you help me clear up the misunderstanding here? From the docs it appears you can create a SSH key pair on a client and then copy the public key to the server. It does not appear that the docs state you need to share those keys with CF, so I assume (perhaps incorrectly) that my session will be encrypted with my private key (on client) and public key (on server).
Again, what you said appears to make sense, perhaps SSH is the only edge case that is implemented differently?