Instead of using DDNS, I have been using Cloudflare tunnels to expose my home services to the internet. The setup is much simpler and it seems like it's more secure too
You specify a port and point it to a subdomain and it just immediately works, no maintenance necessary. The daemon only needs to be installed once with a simple terminal command
There are some limitations such as:
– TLS termination mandatorily happens at Cloudflare (i.e. your traffic is mitm'ed). That's because this free product is meant as a gateway drug (aka a loss leader) to Cloudflare's WAF/Anti-DDOS products (which require TLS termination to happen on their side for technical reasons).
– Other TCP protocols (including SSH) require every client to run the software too. So if you were thinking about bypassing the TLS termination restriction by creating a TCP tunnel instead of an HTTP(S) tunnel you can't.
– Max 100 MB uploads for HTTP(S).
– No media servers allowed.
Otherwise it's a really good service!
But on the flip side, this allows you to have a nice certificate on your outside connection without having to fiddle with letsencrypt or whathaveyou.
If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.
Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records.
Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance.
I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.
You don’t need automated DNS fiddling for lets encrypt. Certbot can either hook into Apache or NGINX, or run its own standalone server for verification.
Aside from sibling comment, you also need automated DNS fiddling if you want CloudFlare Strict TLS support, because if LE can only connect to CF proxy, it will never issue via HTTPS.
You don't necessarily need to do that, Cloudflare can generate you a long-lived certificate to install on your origin server which isn't publicly trusted but is trusted by their proxies, so it works with Strict TLS. YMMV with other CDNs though, you might need to fall back to using LE with a DNS challenge in some cases.
https://developers.cloudflare.com/ssl/origin-configuration/o...
Not true. I have a CF rule that matches . well-known/acme-challenge and sets SSL off. The main setting is on full strict but the rule disables the auto redirect to https and the strict checking so an acme client behind a CF tunnel can bootstrap a cert with the HTTP-01 method.
You do need DNS fiddling if you want a wildcard cert, LE only accepts DNS challenges for those.
Certbot has a Cloudflare extension so all you need to do is provide a credentials file and it will automatically apply everything. I have a monthly cronjob running that runs the cloudflare certbot in Docker.
Afaik, every major registrar allows you to add an NS record for the _acme-challenge subdomain, allowing you to put the _acme-challenge subdomain on a custom, self-hosted DNS server.
That in turn allows you to make the permissions as specific as you'd like. Personally I just run powerdns in docker for this.
Using CNAME delegation for the ACME challenge domain and directing that to a Route 53 zone is my preferred approach. Then (as long as you have CloudWatch configured) you get inherent auditing and very flexible privilege management.
That wouldn't work for this use case though would it? AWS doesn't allow downloading the certificate (I could be wrong)? Typically certificates can only be used with other AWS services. E.g. you can't download the certificate and serve it from a home server.
You're not wrong, but the idea here is not to use AWS' certificate manager but their DNS service on which you would only handle the acme-challenge subdomain. This would allow you to limit who can update which subdomain. The LE cert is obtained normally.
there is also https://github.com/joohoi/acme-dns and LE clients like lego supporting it.
I've had excellent controls using NearlyFreeSpeech.net for DNS (minor cost) and time4vps.com (free). Maybe very old registrars restrict DNS records..?
Parent did not say it was challenging.
I find fiddling with LE tedious because it has to be repeated too often.
certbot and crontab needs to be setup just once, to solve cert problem
HTTPS when used in the ubiquitous manner it is now always strikes me as unnecessary complexity and tedium, and reasonings like yours addressing them with even more complexity and tedium.
Whatever happened to KISS?
It happened that the last S changed from "stupid" to "secure". If I use HTTPS I can safely enough connect to my home services through an open cafe Wifi, for example
so public server via http only then?
The point of TLS is to prevent your traffic getting MITMed. This benefit disappears if you have to let someone MITM your traffic to get TLS.
This depends. The point of TLS is to protect your application from hostile networks. Cloudflare hasn't proven hostile yet.
Some good points, thanks.
FWIW, I have been using it with Plex (just two users, me and my parents) and haven't gotten banned. The ToS are kind of unclear on whether this is allowed if I have to be honest.
Video streaming in general is one of their red lines, you're not supposed to shove any kind of video through their CDN unless the origin is another Cloudflare product (e.g. CF Stream or R2).
From the discussions I've read, it's not as clear cut, e.g.:
https://old.reddit.com/r/PleX/comments/152wfdh/can_i_use_a_c...
It rarely is clear cut with Cloudflare, many of their policies are ambiguous so you never really know if you're stepping over the line until you get an email from sales asking you to either cut it out, start paying, or pay more. Others experience might give you a rough idea of what they'll tolerate, but since none of it is in writing they can change their minds on a whim.
As I've painfully learned, Cloudflare's "free bandwidth" is only free until a point.
Cloudflare threatened to terminate our $15k enterprise license last week for serving 76 TB of API JSON files last month (90% cache hits).
I moved half of the traffic to a new domain with a Business license to see what they say...
My email is jgc@cloudflare.com. You can email me about this.
Just don't show up on some motivated salesperson's prospects report.
https://news.ycombinator.com/item?id=40481808#40482405
FWIW that thread looks to be a casino being black listed after trying to negotiate down cloud flares enterprise plan.
Agreed with sibling, but TBH if you're just using it for personal streaming, it's not likely to trip any bandwidth alerts on a free account, and CF will probably be happy that you're using it for personal stuff (because you'll probably take it with you to your day job too)
They do allow ssh via a web browser. It may be a "beta" feature, but it doesn't require the client to run anything.
Requires your client to run a web browser though? That's a lot different from just an ssh client?
Not a web browser, the client has to install cloudflared to connect. It's pretty much exactly the Tailscale feature, but clunkier.
https://developers.cloudflare.com/cloudflare-one/connections...
GP was saying the client would require a web browser. The server of course needs cloudflared.
That said, personally I don't really have any devices that can use SSH but not a browser.
My past comment is wrong but you do need to install cloudflared on the client if you want to SSH without a browser.
Read the docs, you can do it either way.
I found it easier to use ssh over websocat over cloudflared. Then you just need websocat again on clientside and can use regular ssh client with it
No headless boxes?
At which point is the MITM happening? What I mean is: browser → Cloudflare server → cloudflared on my server → web service. Is TLS only from browser to Cloudflare server, or is it browser to cloudflared?
It's encrypted between the browser and Cloudflare, but you can also create a cert and encrypt between Cloudflare and your origin server. (but that isn't mandatory)
Do you get a cloudflare free subdomain or you need to supply your own ?
You need to have a domain that you manage DNS for in Cloudflare. Look up what a "registrar" is, a common one people go through would be Namecheap. Get a domain, and then look up how to set up a DNS zone in Cloudflare from an external registrar. If you plan on working in tech, this is one of those things you'll absolutely need experience with doing. Good luck!
Though it occurs to me their may just be a language barrier and you may have a domain that you manage your DNS in Cloudflare already. If that's the case, a subdomain is just an A record under your domain's DNS settings for anything other than the root domain. So, if your domain is "example.com", the A record could be like "service" with an IP of "192.168.1.10", and your subdomain would then be served on "service.example.com" for example. Subdomains are free, if you have a domain in the first place.
If you're asking if you would already need the subdomain configured in your DNS settings in Cloudflare, then yes, most likely. Though there are tools that create those for you, like external-dns in kubernetes.
You can buy domains directly through cloudflare
This is a small thing, but I think you should decouple providers in case shit hits the fan with one of them.
Let Cloudflare do DNS, let your registrar be a registrar.
Is this a real risk these days? I am interested (given I do use Cloudflare’s registrar and DNS (integrates nicely with IaC).
Not sure, honestly.
Interesting! also asked Claude Opus:
Using the same provider for both domain registration and DNS hosting can introduce several risks. Here are some of the main risks and ways to mitigate them:
1. Single point of failure: If the provider experiences an outage or security breach, both your domain registration and DNS hosting could be affected simultaneously. This can cause your website or services to become unavailable. Mitigation: Consider using separate providers for domain registration and DNS hosting to reduce the impact of a single provider's issues.
2. Provider lock-in: Some providers make it difficult to transfer your domain or DNS management to another provider, leaving you dependent on their services. Mitigation: Choose a provider that allows easy domain transfers and supports standard DNS management protocols like EPP (Extensible Provisioning Protocol). Familiarize yourself with the transfer process before committing to a provider.
3. Security vulnerabilities: If the provider's security measures are inadequate, attackers may be able to gain unauthorized access to your domain and DNS settings, potentially leading to domain hijacking or DNS tampering. Mitigation: Select a reputable provider with strong security practices, such as two-factor authentication, IP restrictions, and regular security audits. Enable additional security features like DNSSEC (Domain Name System Security Extensions) to protect against DNS spoofing.
4. Lack of redundancy: Relying on a single provider for both domain registration and DNS hosting means you don't have a backup if that provider experiences issues. Mitigation: Consider using secondary DNS services from a different provider to ensure redundancy and failover capabilities.
5. Limited control and flexibility: Some providers may offer limited control over your DNS settings or have restrictions on the types of records you can configure. Mitigation: Opt for a provider that offers a comprehensive and user-friendly DNS management interface with support for various record types and advanced features like GeoDNS or failover.
To further mitigate risks, consider the following best practices:
1. Keep your domain registration and DNS hosting accounts secure with strong, unique passwords and enable two-factor authentication.
2. Regularly monitor your domain and DNS settings for any unauthorized changes.
3. Keep your contact information up to date with your domain registrar to ensure you receive important notifications and can respond promptly to any issues.
4. Familiarize yourself with the domain transfer process and keep backups of your DNS configuration to ease migration to another provider if needed.
5. Choose reputable providers with a track record of reliability, security, and customer support.
By being aware of these risks and implementing appropriate mitigation measures, you can minimize the potential impact of using the same provider for domain registration and DNS hosting.
Those are valid. I would personally be worried about getting kicked off Cloudflare and the procedure for transferring domains being messy and time consuming.
(Although CF seems perfectly happy hosting really shady sites that host primarily illegal content)
I asked Perplexity: Using the same provider for both domain registration and DNS hosting can present several risks. Here are the primary risks and ways to mitigate or prevent them:
## Risks
1. *Single Point of Failure*: - If the provider experiences an outage, both your domain registration and DNS services could be affected, leading to downtime for your website and email services[2].
2. *Security Vulnerabilities*: - Using a single provider increases the risk of DNS hijacking, DNS cache poisoning, and other DNS attacks if the provider's security is compromised[3][4].
3. *Limited DNS Features*: - Some domain registrars that offer DNS services may not provide advanced DNS features like DNSSEC, Anycast, or DDoS protection, which are crucial for security and performance[2][5].
4. *Vendor Lock-in*: - It may be more challenging to transfer your domain or DNS services to another provider if both are managed by the same company, potentially leading to higher costs or service disruptions[1].
## Mitigation Strategies
1. *Use DNSSEC*: - Implement DNSSEC (Domain Name System Security Extensions) to protect against DNS hijacking and cache poisoning. DNSSEC adds a layer of security by enabling DNS responses to be verified using digital signatures[3][4].
2. *Redundancy and Backup*: - Use secondary DNS providers to ensure redundancy. This way, if your primary DNS provider experiences an outage, the secondary provider can handle DNS queries, minimizing downtime[2][5].
3. *Choose a Reputable Provider*: - Select a provider that specializes in DNS services and offers robust security features, including DDoS mitigation, Anycast networks, and DNSSEC. This ensures that you are using the latest DNS technologies and security measures[2][7].
4. *Regular Security Audits*: - Conduct regular security audits of your DNS configurations and keep your DNS software updated to protect against vulnerabilities and exploits[7].
5. *Enable Two-Factor Authentication (2FA)*: - Use 2FA for accessing your domain and DNS management interfaces to prevent unauthorized access. Additionally, consider IP whitelisting to restrict access to trusted IP addresses only[3][5].
6. *Client Lock*: - Utilize client lock features provided by your registrar to prevent unauthorized changes to your DNS records without approval from a specific individual within your organization[3][5].
By implementing these strategies, you can significantly reduce the risks associated with using the same provider for domain registration and DNS hosting, ensuring better security, reliability, and performance for your online services.
Sources [1] Everything About Website Domain Registration : Best Practices And ... https://monsterhost.com/everything-about-website-domain-regi... [2] Should you keep your DNS management and domain registration ... https://blog.dnsimple.com/2015/03/benefits-and-drawbacks-of-... [3] What is DNS Hijacking and Mitigation Methods - GlobalDots https://www.globaldots.com/resources/blog/what-is-dns-hijack... [4] DNS Attacks: Tutorial & Prevention Best Practices - Catchpoint https://www.catchpoint.com/dns-monitoring/dns-attack [5] How to Prevent DNS Attacks: DNS Security Best Practices https://www.esecurityplanet.com/networks/how-to-prevent-dns-... [6] Unraveling the roles of domain registrars and web hosting providers https://www.godaddy.com/resources/skills/roles-of-domain-reg... [7] Top Five DNS Security Attack Risks and How to Avoid Them | Blog https://www.humanize.security/blog/cyber-awareness/top-five-...
I do the same with tailscale, which has a nice friendly UI for setting everything up.
I setup some Cloudflare DNS records to the tail scale 100.x IPs to make them easy to remember.
Some ISP DNS servers will not return internal IPs, Verizon FiOS and 172.x specifically.
I use tailscale's DNS feature and run my own DNS server. That way I can have a subset of my services available on the internet via CF tunnels and when I connect to tailscale I get all of them directly, and I can use the same domain names
How can you claim it's simpler in the light of the revelations in noname120's comment?
Dynamic DNS is literally one little service you run to "phone home" to the dynamic DNS provider. This service is bundled in consumer routers; just find it in the WebUI, put in the credentials and turn it on.
You know what could be simple: a periodic job that figures out your public IP address, and if it has changed, generates a hosts file entry for it, and e-mails it to you. If all you care about is just you having access to home while you are roaming about, that could do it. It also occurs to me that it makes a good backup strategy in case something goes wrong with DDNS while you are traveling.
Consumer firewalls, the largest names in open source firewalls, and at least one webserver/reverse proxy that I know of.
There also dozens of existing DDNS daemons out there already with far more developer, testing, and user eyeballs on them.
The firewall solution is preferred because the firewall knows when the external interface changes IP addresses, so there's no system or network overhead from having an agent repeatedly testing if the IP has changed, nor any downtime between when the IP changes and when the next check happens.
"Instead of DDNS, I have been using Cloudflare tunnels to expose my home services to the internet."
Will this work if the "home services" include authoritative DNS.