A place to share, discuss, discover, assist with, gain assistance for, and critique self-hosted alternatives to our favorite web apps, web services, and online tools.
I've tried to understand cloudflare tunnels, but I just don't get it. How is a tunnel superior to DDNS and reverse proxy?
Need Help
Can someone please explain this to me? There's been a lot of chitchat about cloudflare in this sub recently, but I just don't understand it.
I currently use a DDNS and reverse proxy to access a couple of my personal self-hosted services (when I'm accessing them from devices don't support VPN). How would a cloudflare tunnel be superior to this setup?
Also, do I need to purchase a domain name to use cloudflare tunnels? Many thanks from a confused n00b.
Sort by:
Best
Open comment sort options
Best
Top
New
Controversial
Old
Q&A
+: cloudflare is applying their traffic security rules to your service. This cuts out like 95% of malicious traffic because they can analyze and block it on a wide scale. Similar to a very smart spam filter.
+: cloudflare obfuscates your IP address, good if you are a target of DDOS attacks. Usually not a problem unless you're poking hackers in the eye.
+: If you don't have a public IP, you don't really have a choice except to do this sort of tunnelling with cloudflare or a VPS service (manually).
-: Cloudflare is intercepting all of your traffic, so if you're sailing the high seas, that may be a concern
-: Cloudflare is essentially using you as a test subject for their commercial offerings. you're benefiting from it, but so are they
-: Tunnelling through cloudflare teaches you nothing about securing your services. In fact you can just as easily mess up your security posture through cloudflare as you can by port forwarding. It's not a free pass to disregard security.
You don't need a tunnel to take advantage of your first two points. Their basic DNS service provides that as well.
There are a couple of posts that highlight the benefits, so I'm going to do the opposite and list some of the downsides that I find about using Cloudflare tunnel without a real need.
First and most important, you are routing all your traffic through Cloudflare's internal network. This means they can and probably do analyze your data because there is no profit in providing a free service that consumes bandwidth while getting nothing in return. How trustworthy you find big companies is up to you.
Second, you are legally limited in what you can tunnel trough their service (unless you pay of course), as most content that selfhosters use in their setups would be considered against their Terms of Service. This includes tunneling video, pictures, music... you get the idea.
Third, the security you get through obscurity by not opening any ports... is just negligible at best in my opinion. Rerouting your traffic to a third party to avoid exposing port 443 just to stop random bots hitting your reverse proxy default blank landing page is just nuts to me, and not something I would call part of a secure setup. Now, in the case you believe/know for some reason your services can be the target of a DDOS attack, Cloudflare does provide great mitigation so keep that in mind.
And lastly, If you are not willing or capable of keeping your internet facing services up to date do yourself a favor and don't expose anything. Not through Cloudflare... not by allowing traffic to specific ports... nothing, because you will get exploited with or without Tunnels.
Thank you so much for this. I already have a VPN on a few VPS (from a provider I've chosen to trust).
With all the Cloudflare touting all over the place (in this sub and many others), I genuinely started asking myself if I had missed something. But in fact no, I'm fine with my infra as is. It might require a lot of tinkering and maintenance, but that's the whole point in my specific case (learning by doing).
This isn't necessarily the case: they've said before their reasoning behind having most things available for free is that they become so ubiquitous that everyone's already used to their services and will continue to use them when they get hired to do networking at an actual company i.e. why Adobe and other software companies will usually not come after individuals for pirating their products.
So they probably are analysing the traffic insofar as it helps them improve their services, but they're not necessarily data mining it in the way that Google or other ad companies would. That's not to say they aren't, either, but it's not a necessary consequence of being free, IMO.
Anyone knows what’s the throughput / bandwidth restriction of a free tier? It seems like Cloudflare tunnels are nice for a toy projects but you cannot put anything serious like Jellyfin or heavy use NextCloud.
“Use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited”
Poor me with 2.5Gbps/2.5Gbps fiber link
I have 100/40. yeah, poor you :-)
It's not really the volume but the 'ratio'. Image heavy site with a bazillion hits a month? Maybe OK. Same amount of video served with little to no HTML around it? Contravenes terms of service.
Exact clause you get found in violation of is 2.8 of the TOS and applies to all plans up to but not including Enterprise.
Getting back to 'what’s the throughput / bandwidth restriction of a free tier', that's kind of nebulus but I've heard of egregious users on a free tier being asked to move up to a paid plan lest proxying gets simply disabled on that record.
Yes you need your own domain name. Sounds like you are fine with what you are doing but it's good you're exploring your options.
I used to only access my network using a VPN but since I now have others accessing my network Cloudflare is an attractive option because I don't need to install software on anyone else's devices. I also like how it can keep my IP "unlisted" rather then being tied to my domain name. While I keep my network locked down I like the idea of Cloudflare between my network and the outside world because we(people running homelabs) aren't always the first to find out about zero days or are we always the first to receive patches.
Keep learning and keep an open mind your needs may change over time. If you are learning with the goal of finding a job it's definitely wise to explore Cloudflare since nearly 1 in 10 requests go through them.
Relevant reading: "You may not need Cloudflare Tunnel. Linux is fine."