Comment

Comment on tailscale vs cloudflare tunnel? which is better a homelab

what’s funny about your self proclaimed tech-literacy comment is, if you have encrypted traffic between you and your endpoint/server (TLS/HTTPS, SSH) then Cloudflare cannot MiTM your traffic.

That’s like saying your ISP MiTMs your traffic when you visit a website so don’t use an ISP. You can stop using the ISP and thus not reaching the web (what you’re suggesting) OR you can encrypt your HTTP traffic and then no one can MiTM you.

We should not behave so brashly toward users who are new and learning or perhaps just brief in their comments. This cultivates a toxic community.

source

Sort:hotnew top

EncryptKeeper@lemmy.world ⁨1⁩ ⁨year⁩ ago

I would just like to add that if your endpoints communicate via an encrypted transport (HTTPS, SSH, etc) then doesn’t matter if cloudflare tries to inspect your packets. There would be 2 layers of encryption while traversing the public web, then 1 layer when traversing CF’s network.

Thats not how Cloudflare tunnels work. Your data is encrypted to Cloudflare’s network then decrypted. Then they encrypt a second connection between their server and yours via a connector service running in your server. It does matter if CF tries to inspect your packets because there is one layer of encryption over the internet, then briefly zero layers of encryption, then one layer of encryption while traversing CF network.

source
- varsock@programming.dev ⁨1⁩ ⁨year⁩ ago
  hmm, I’m not sure I agree - or perhaps I didn’t explain myself well previously and caused confusion between us.
  
  Yes I agree with you in your description of how cloudflare encrypts -> decrypts -> encrypts; they are allowing you to ride over their network. If you remove cloudflare from the picture entirely, then you just have the internet facing server.
  
  What I’m saying is, if the client and endpoint (server) talk in an encrypted protocol, then cloudflare cannot MiTM the data, only the IP headers. This is similar if you were to connect to any ol’ website over an ISP’s network. If your session is not HTTPS, then your application data can be read. You can have encrypted sessions inside of CF tunnel-network-tunnel.
  
  If your services support encryption, great. But you can also expose a wireguard endpoint so you have the following
  
  wg client --(tunnel to CF)–> CF network --(tunnel to your server)–> wireguard server
  
  the real advantage to CF tunnel is hiding your IP from the public internet, not poking any holes in your firewall for ingress traffic, and cloudflare can apply firewall rules to those clients trying to reach your server by DNS hostname.
  
  source
  - EncryptKeeper@lemmy.world ⁨1⁩ ⁨year⁩ ago
    You’re explaining yourself fine, you’re just mistaken about the way Cloudflare tunnels work.
    
    What I’m saying is, if the client and endpoint (server) talk in an encrypted protocol, then cloudflare cannot MiTM the data, only the IP headers.
    
    This is not the case. You are under the mistaken impression that CF tunnels work like a L4 tunnel, proxying a TCP stream from client to server, allowing you to maintain an encrypted TLS session from client to server. That would be closer to what Tailscale Funnel does (Which I’d advocate for). CF tunnels do not work this way. Cf tunnels work more like a L7 proxy. Your client and your server never talk, so there is no encrypted protocol between them. There is only encryption between you and Cloudflare, and then Cloudflare and your backend server. Cloudflare can and does MitM the data AND the IP headers.
    
    This is similar if you were to connect to any ol’ website over an ISP’s network. If your session is not HTTPS, then your application data can be read.
    
    You cannot establish an HTTPS connection with your application from your client. You establish an HTTPS connection with Cloudflare, which gives them plaintext access to all the data you send through them.
    
    You can have encrypted sessions inside of CF tunnel-network-tunnel.
    
    To be clear, no you can’t. This is your misunderstanding. At least, you can’t with Cloudflare tunnels. Cloudflare may offer a TCP proxy service, which is what you’re confusing CF tunnels with, if you sign up for an enterprise plan, but you don’t get that functionality in their free plan which OP, and self hosters in general would be using.
    
    source
    varsock@programming.dev ⁨1⁩ ⁨year⁩ ago
    thanks for the masterclass in CF tunnels.
    
    I am ready to accept everything you’ve said but there is the SSH case that keeps tripping me up. For reference, here is the CF docs on Connecting SSH through CF Tunnels.
    
    Can you help me clear up the misunderstanding here? From the docs it appears you can create a SSH key pair on a client and then copy the public key to the server. It does not appear that the docs state you need to share those keys with CF, so I assume (perhaps incorrectly) that my session will be encrypted with my private key (on client) and public key (on server).
    
    Again, what you said appears to make sense, perhaps SSH is the only edge case that is implemented differently?
    
    source