84
Replacing Cloudflare Tunnel with a Selfhosted Towonel Tunnel (blog.jameswynn.com)
submitted 1 day ago by to c/selfhosted@lemmy.world
24 comments fedilink hide all child comments
 

Every public request to one of my sites used to go through a Cloudflare tunnel. I had a cloudflared deployment in my cluster, some routing rules, and everything just worked. And it was free! But that bugged me. TANSTAAFL right? The whole point of selfhosting is to not rely on big cloud company, and there are few bigger than Cloudflare. And Cloudflare’s tunnels decrypt every single packet, so they see everything you do. I really don’t like that.

So I’ve replaced Cloudflare tunnels with Erwan Leboucher’s towonel, a selfhosted tunnel implementation. I still have my DNS on Cloudflare, but no data is moving through them any more.

...

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 day ago* (last edited 22 hours ago) (2 children)

The benefit here is the software by design can't read your traffic - it's using SNI to route, not the host header, so SSL pass thru keeps the payload private. It's billed as shareable for that reason.

Also this is open source and you can host it yourself.

Edit: I concede BakedCatboy's point.

In either case I would probably just use FRP.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 1 day ago (2 children)

    You missed my point?

    why can't you just use a wireguard connection between your device and the server, or network?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 18 hours ago

    between your device

    Thats the part right there. Its for not your device to access.

    Like a self- hosted website/blog for example. Or taking the complexity of "start this before you try to connect to my eBook server" for your BIL, or "OK mom, when you want to watch the home videos I converted to digital you have to do it only from your phone, press this first, then share to your TV".

    That is the part I think you are missing. Use other than yourself and your own managed devices.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 day ago (1 child)

    I use a wireguard tunnel as a reverse proxy and it does ssl passthrough with sni. Termination happens on my local box and the reverse proxy host doesn't do any certs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 17 hours ago (1 child)

    What reverse proxy are you using?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 17 hours ago

    I use haproxy just for simplicity, with the https fronted in tcp mode with a tcp request inspect delay and acls using req_ssl_sni allows switching between multiple backend based on hostname, though if you only had 1 backend server then it could just be a raw tcp proxy. I have my stuff split between 2 local boxes that are both connected to the reverse proxy using wg so this works well for me.

  • permalink
  • fedilink
  • source
  • parent