Every public request to one of my sites used to go through a Cloudflare tunnel. I had a cloudflared deployment in my cluster, some routing rules, and everything just worked. And it was free! But that bugged me. TANSTAAFL right? The whole point of selfhosting is to not rely on big cloud company, and there are few bigger than Cloudflare. And Cloudflare’s tunnels decrypt every single packet, so they see everything you do. I really don’t like that.
So I’ve replaced Cloudflare tunnels with Erwan Leboucher’s towonel, a selfhosted tunnel implementation. I still have my DNS on Cloudflare, but no data is moving through them any more.
…
MangoPenguin@lemmy.blahaj.zone
RepleteLocum@lemmy.blahaj.zone
I don’t get the need for those tunnels.
Wouldn’t a simple wireguard setup be enough un less you are behind CG-NAT?
Wireguard it’s there, free, open source, doesn’t rely on any external server or company…
What does these “tunnels” actually add?
K3can@lemmy.radio 3 weeks ago
That’s exactly the use case for “tunnels”: allowing public, incoming connections behind CGNAT.
Wireguard requires a public IP on at least one side of the connection and only allows private access. If you want to host a blog or website AND you’re behind CGNAT, then a “tunnel” service is a very easy solution.
Undaunted@feddit.org 3 weeks ago
But going with a self-hosted approach like Towonel, you need a server with a public IP too. And I think what the commenter meant is, if you already have that, you can just setup a WireGuard connection to that public server, so that it can route the traffic to your local network.
stratself@lemdro.id 3 weeks ago
It bundles WireGuard transport layer and a SNI reverse proxy natively, along with optional authentication. Good enough for beginners or people who need quick deployments.
Ease of deployment / time savings generally. You can certainly do it yourself with wireguard and a reverse proxy.
non_burglar@lemmy.world 3 weeks ago
They are saying wireguard alone, no reverse proxy. No exposing any services at all to the outside, just tunnel in with WG and access locally.
hexagonwin@lemmy.today 3 weeks ago
yep, i used to use this behind a cgnat. being a broke kid i couldn’t have another machine with exposed ports proxy things
The benefit here is the software by design can’t read your traffic - it’s using SNI to route, not the host header, so SSL pass thru keeps the payload private. It’s billed as shareable for that reason.
Also this is open source and you can host it yourself.
You missed my point?
why can’t you just use a wireguard connection between your device and the server, or network?
BakedCatboy@lemmy.ml 3 weeks ago
I use a wireguard tunnel as a reverse proxy and it does ssl passthrough with sni. Termination happens on my local box and the reverse proxy host doesn’t do any certs.
purplemonkeymad@programming.dev 3 weeks ago
I checked and this does a similar thing. You can use WG to punch out a connection, and I have before. The linked program uses quic in a similar way to WG but doesn’t do any of the routing, just registers the connection to a hostname for application level forwarding.
It looks more that it provides an easy setup for an alternative.
Both methods can work on cg-nat as well since you are punching out.
feannag@sh.itjust.works 3 weeks ago
One would be CG-NAT as you mentioned, and some people want to host for other people too, potentially including too many people/too distant/too tech illiterate to easily set up WG.
eodur@piefed.social 3 weeks ago
Its a secure way to route the traffic from a public endpoint to your internal services without exposing your home IP address. You could do something similar with wireguard. I didn’t indicate you couldn’t.