Top
Best
New

Posted by jcbhmr 18 hours ago

Cloudflare Quick Tunnels(try.cloudflare.com)
696 points | 277 comments
TIPSIO 16 hours ago|
My wife and I have a mobile group/shared bot system where we can make mini apps and collab.

Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…

We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN.

Think shared Claude Artifacts that don’t live @ Anthropic.

Tried to first do this with Cloudflare Tunnels (because I love Cloudflare), but between the broken dashboard side of Zero Trust and nightmare of Warp… it was basically impossible to setup. I guess that’s all super enterprise, which seems to be very anti-Cloudflare philosophically to not be able to self do things.

Will check out Quick Tunnels but I think it’s missing the bigger integration offerings Tailscale has/does still.

theturtletalks 15 hours ago||
Tailscale is truly a cheat code. I have a web app that I run locally to control terminals on my Mac. I access the website on my phone using the 100.xx IP address and can code on the go. No need for a Mac or iOS app.

You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet. Be careful using Cloudflare tunnels because they are public and bots start poking around immediately.

0x1ch 14 hours ago|||
Alternatively, Netbird has been a dream to use over the last half year or so. I think their server software has had some hiccups on new releases, but I stagger those updates anyways. All self hosted, similar concept to Tailscale, very good management UI baked into the self hosted product.
garettmd 14 hours ago|||
Netbird's great. I've been using Pangolin (https://pangolin.net/) lately for my homelab. It's very similar in functionality to Netbird, but I like the UX of it better.
0x1ch 13 hours ago|||
Also a very good alternative. I went on a spree and tried out all of the self hostable alternatives and this was definitely a runner up to netbird. The self hosted tailscale is also good, just not as polished as these two projects are.
nickspacek 6 hours ago|||
Switched from Pangolin to Netbird recently and enjoy Netbird more!
BOOSTERHIDROGEN 4 hours ago||
Which features do you specifically benefit from?
drakenot 6 hours ago||||
For those who use Netbird or Pangolin, I'm trying to understand where it would come in handy over my Wireguard-Easy setup with my phone & laptops configured to connect to my Wireguard network externally.

Is this primarily for multi-user scenarios or complex setups?

usagisushi 3 hours ago||
Both support multi-user setups with SSO or built-in auth.

Beyond that, compared to a typical hub-and-spoke WireGuard setup, the main advantage is peer-to-peer connectivity. Clients connect directly to each other when possible, which lowers latency by bypassing a central relay.

AFAIK, they also have different origins:

Pangolin started as an internet-facing reverse proxy (Traefik) combined with a WireGuard server for backend nodes. It has gradually added VPN-like features, including client device access and an internal HTTPS proxy similar to Tailscale Serve.

NetBird is a self-hostable Tailscale alternative that started as a mesh VPN focused on P2P traffic. It recently added its own reverse proxy features (Traefik-based, coincidentally), also similar to Tailscale Serve.

Pangolin is centered on endpoint and ingress management, while NetBird focuses on mesh networking, though their feature sets are increasingly converging.

drcongo 13 hours ago|||
I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers - I wanted just the SSH features, with multiple users, but the paid tier up from free didn't include the SSH features.
allthetime 5 hours ago|||
What ssh features? You can have a hundred devices connected for free and they can all just ssh to each other directly
0x1ch 12 hours ago|||
I think Tailscale would've fit my needs perfectly fine, but the management makes access control and grouping dead simple in netbird. It also generates a nice little map of your peers, their groups, and connected nodes etc. Quick visual on your topology.
SparkyMcUnicorn 14 hours ago||||
> You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet

For public access, similar to these cloudflare tunnels, there's Tailscale Funnel.

https://tailscale.com/docs/features/tailscale-funnel

nacs 14 hours ago||
Tailscale funnel works well but you can only have 1 per Tailscale instance (1 per machine) at the https endpoint so if you want to have a few apps, the others will go on non-https, custom-port URLs.
justinc8687 5 hours ago|||
I have multiple funnels running at once. I just put a tailscale container into my compose stack and that way each compose stack gets its own tailscale instance and thus its own funnel. Happy to share the setup if at all interested.
bakkoting 13 hours ago||||
You can set up paths that route to different local ports. As long as your apps don't need to live at the root path you can have as many as you like. And you can still have something on the root path as long as it doesn't need the subpath.

Here's `tailscale funnel status` on my machine:

    $ tailscale funnel status
    
    # Funnel on:
    #     - https://my-machine.tailXXXX.ts.net
    
    https://my-machine.tailXXXX.ts.net (Funnel on)
    |-- /            proxy http://localhost:3000
    |-- /foo         proxy http://localhost:3001
    |-- /bar         proxy http://localhost:3002
    |-- /baz         proxy http://localhost:4004
MattCruikshank 13 hours ago||||
That's why I keep using tsnet directly, where you can have as many virtual machines, doing sharing or funneling, as you want to.

The CLI doesn't let you do as much as the go library does.

havnagiggle 4 hours ago||||
Reverse proxy to additional endpoints.
fragmede 14 hours ago|||
[dead]
_user_account 14 hours ago||||
just use wireguard; tailscale is just the SSO enterprise overlay with a pricing tab.
pocksuppet 12 hours ago|||
Wireguard is great for a point-to-point or multipoint VPN set up by a competent network administrator between machines with static addresses. But that's the only thing it does. It does not handle authentication or mobility very well.
matthewmacleod 13 hours ago||||
No, it’s not. It handles the keys, provisioning, DNS, NAT traversal, and a bunch of other stuff. WireGuard is a great technology - Tailscale is like a usability layer on top of it.
herpdyderp 14 hours ago||||
I pay Tailscale nothing, why switch?
titularcomment 13 hours ago|||
I think an important feature for homelabs is NAT traversal
girvo 10 hours ago||||
I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now
eloisius 8 hours ago|||
I have the same experience and I once found a GitHub issue about it. I don’t think it sounded like they planned to fix it anytime soon. I just added the Tailscale toggle button to my phone’s quick control panel and turn it on whenever I want to check all my syncthing nodes or something. I keep meaning to see if I can script up something with Shortcuts to make it turn back off automatically.
devilbunny 6 hours ago||||
Were you using an exit node? Because that really does hammer the battery, but vanilla TS without a bunch of traffic doesn't seem to do much to mine.

The only always-on TS service on my phone is Immich for photo backup, and I don't take enough photos for that to matter much.

aborsy 6 hours ago||
You should compare battery consumption of TS exit node with something like WG app which low
devilbunny 4 hours ago||
WG gonna punch through NAT for me?

My endpoint is a pretty stable (though technically dynamic) IPv4 on one end, but the other might be a cell phone with CGNAT, some random WiFi, blah blah etc. TS does that. If you don't want to use it, cool. Don't. I'm willing to make the tradeoffs to use TS for now. That could change in the future.

tenuousemphasis 9 hours ago|||
Strange, battery use is negligible on Android, particularly when the tunnel is not in active use.
prtmnth 8 hours ago||||
Using Tailscale in exactly the same way. It has been such a blessing!
dlopes7 13 hours ago|||
I use tailscale on my steam deck to play stardew valley with my son on my laptop, it truly is amazing
cbsks 15 hours ago|||
> My wife and I have a mobile group/shared bot system where we can make mini apps and collab.

> Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…

Can you elaborate on this? Sounds really cool!

dizzard 14 hours ago|||
Not OP- I think there’s been some cool solutions popping up around hosting personal apps. On the front page this week was Capsule (https://withcapsule.app/). My personal solution is Exhibit (https://github.com/momja/Exhibit) which also has the goal of being a self-hostable artifact store.
ilusion 4 hours ago||||
I have my own solution here that also works for sharing stuff with clients with configurable whitelists at artifacts.iofold.com (also open-source for self hosting on cf workers for almost free, github linked on the homepage)
rambleraptor 14 hours ago||||
I’ve been building something similar with [Homestead](https://myhomestead.dev). It’s my OSS solution for building mini apps. Each mini app is a Resct frontend and the backend (storage, auth, MCP, API, etc) just comes for free.
SwamyM 15 hours ago|||
Seconded.
U4E4 14 hours ago|||
I’m not GP, but run something that’s pretty close to GPs description. It’s been a fun journey to set up.

The core is chat+audio/video call server running locally on my m3 Mac Studio. Centrifugo has handled the chat concerns very well. LiveKit was a really nice foundation for video and audio calls. There are a few different options for local STT if you want that.

I used RN via expo for the client and have my friends and family on TestFlight as beta testers. Utility over polish.

With messages and call transcripts on my own box, I can prompt Claude code or Codex to operate on any message or transcript content. And follow up in chat with a message. I do most of that from Claude or ChatGPT mobile apps via remote control to my sessions running in the box.

From there, if I give enough of a specc, anything that happens in chat or call transcripts can become an additional custom workspace in the main app. I think GP calls these mini apps. But they’re essentially rich clients under the main app umbrella. There’s other details, but yeah it’s a strange new world. Check my profile and reach out directly if you want.

ezst 3 hours ago|||
I would say that I've been doing most of that already with a reverse proxy+SSO/IDP for a very long time. Not the same, but close-enough and open to the "traditional internet" in a manner that does not require my users to install and configure tailscale, which is a massive plus. I do appreciate tailscale for the option to keep my effective host IP address hidden/local, but then I've been having a front on the internet (with a public IP/domain/...) for decades and I don't see a problem continuing.
allthetime 5 hours ago|||
I use public dns routed to private Tailscale ips for all my home services. If i want to expose something for friends who don’t use Tailscale I connect a cloudflare tunnel… it’s pretty much a couple clicks and typing in a subdomain name once cloudflared is running on a server… what were you having trouble with?
pruneau 5 hours ago||
I use NextDNS instead of public DNS to do the same thing.
gibs0ns 7 hours ago|||
I have really enjoyed the experience of OpenZiti for this purpose. Being able to host dark services and impose granular access controls and routing for different clients is a game changer.

For the few services I host that require SSL (eg; WebUSB), I serve the dark service via a standard domain (example.com) so I can still get a LetsEncrypt cert, but public access to that domain resolves to a static page; "Plz connect to OpenZiti & try again". This allows me to have SSL on required dark services without requiring to install a private CA for each client.

gopalv 13 hours ago|||
> it’s missing the bigger integration offerings Tailscale has/does still.

Until I had tailscale serve generating valid certs, I had a good reason to use Cloudflare tunnels.

But in general I don't want to put everything on the internet side of things.

Mostly, I don't want something open, but more like a "share with" for people who are in the same office (virtually over tailnet, not physically on the same LAN).

This still works great for a demo instead of a product pitch, to send an link out to see something.

I'd still use a real host over a laptop for those.

noir_lord 16 hours ago|||
Only reason I have it (cloud flare tunnels) setup for personal use is because I had to do it for work years ago and yeah, Enterprise(tm) is a good description, haven't touched it in years so when it breaks I'll likely use something else.

Getting it to do what I wanted with a traefik front router with cloudflared talking to arbitrary subdomain that is spun up and broadcast from the other project side was very painful in a "this could be more friendly" way.

It has been truly bulletproof though since then so that's almost enough to make me go reread all the docs.

ramoz 7 hours ago|||
> Think shared Claude Artifacts that don’t live @ Anthropic.

Shameless plug, I've built a self-hosted capability here with things like live collaboration for humans and agents. There is a native cloudflare deplyoment and integration with Cloudflare Artifacts. PR for tunnel would be appreciated.

https://github.com/plannotator/artifact-server

nemosaltat 15 hours ago|||
Us too, consider using your bots to migrate your tailnet to headscale. Daily driving Headscale + Headplane + Tailscale’s graciously provided/compatible native apps makes me feel like my devices are truly under my control.
DaSHacka 12 hours ago||
If only headscale supported tailnet lock and multiple control servers. They consider both features "enterprise" even though the former is arguably a bare minimum and the latter nice even for home users in the event their lab gets taken offline.
roberttod 13 hours ago|||
Does this work with remote agents though? I want my claude.ai agents running on my phone to be able to hit my local MCPs on my Mac Mini - my understanding is that tailscale wouldn't work because the execution is being called remotely. But seems like these tunnels would support that.
threecheese 13 hours ago|||
If by local MCP you mean stdio, then a tailnet won't help you unless you proxy the local MCP using something like mcp-proxy: https://github.com/sparfenyuk/mcp-proxy . That local mcp is only exposed to apps on the machine. The flow is Phone client --> agent harness or whatev --> Tailnet --> Mac Mini --> mcp-proxy http listener --> local mcp. But you need to wrap the local mcp runner in the proxy (check the docs).

EDIT you don't mean running on your actual phone lol, you mean in the web browser at Claude.ai. Anyway, if you use mcp-proxy for a stdio mcp, or if it's an http mcp alone, then you would need a public endpoint for Claude.ai to connect to. Tailscale will only help you if you use Funnel, but this cloudflare thing is exactly what you need (w/o Tailscale).

dalberto 12 hours ago||||
I built something for this exact use-case using Cloudflare Tunnels:

https://github.com/dalberto/mcp-ferry

I also use CF managed auth to make auth easier.

parthdesai 13 hours ago|||
if both your mac mini and your phone are on the same tailnet, can't you just ssh to your mac mini from your phone's terminal emulator and have claude code/codex run on it?
wildzzz 11 hours ago||
I just use /remote-control. You can't do everything from remote but it's was easier just opening the Claude app than using ssh. And I don't need to be on my tailnet either.
pbreit 3 hours ago|||
How do I get this more persistent?
epolanski 1 hour ago|||
I never found cloudflare appealing for the small developer.
unixhero 12 hours ago|||
That's really cool! I really want something like that. Care to share what your stack is? My wife would love having that super power.
FridayCuriousit 15 hours ago|||
Interested in the the bot system and how your self publishing app artifacts that you've got running. Care to share more?
U4E4 14 hours ago||
I run something similar, and in my system an app artifact is typically just a rich react component in a React Native client. They usually start as prototypes in chat, similar to what the labs provide in their native apps. If I or someone else in my user group wants more depth than a chat widget, then the artifacts can grow into a “workspace”. Oddly enough my richest workspaces have most been for entertainment. DnD, MtG deck building, HN comment thread parsing. And system management. Intrusion detection, feature life cycle/LLM handoff management, call telemetry. I do have a workspace for public county permit lookup which has been handy too. Reach out and I can share more.
nijave 9 hours ago|||
Don't think we had any issues with Warp but Cloudflare APIs are a bit of a mess. Seems like they've cobbled together and then renamed/rearranged things multiple times now and it's a bit hard to keep up.

Terraform has worked decently well especially since there's a few random settings here and there that aren't exposed anywhere in the UI (facepalm)

_blk 15 hours ago|||
So you have a phone to phone VPN and each runs services or just a regular rapid/synology at home with containers?
fr2029 4 hours ago||
[dead]
noname120 10 hours ago||
Cloudflare Quick Tunnels have existed for more than 5 years (yes, including the anonymous quick tunnels). I copy-pasted the url of the HN link in archive.org, see for yourself: https://web.archive.org/web/20211202005430/http://try.cloudf...

Is a new vibe-coded landing page for a 5-year old product really worthy of being on the front page nowadays? There should at least be a [2021] in the title.

makingstuffs 13 minutes ago||
I saw the post and was literally thinking "I have been using these tunnels extensively for a couple years now"
malfist 10 hours ago|||
I did not know about them and I have a good use for them today. So I found it useful though I agree it needs the date disclaimer
nijave 9 hours ago|||
Didn't these used to be called Argo Tunnels a long time ago? I think Argo Tunnels got repositioned for connecting to origin servers without needing an incoming connection to the origin but I thought they originally did something like this/ngrok

Yeah, I just checked the page >can connect their server to the Internet with Argo Tunnel for free

jofzar 7 hours ago||
5 years ago imo it was less relevant, if you showed me this then I would be like "cool tech, but other then a specific scenario, why would I care"
stingraycharles 3 hours ago||
Why is it more relevant today?
adamfeldman 15 hours ago||
Cloudflare doesn't really seem to care about their tunnel product. "cloudflared service install broken on macOS" since 2021: https://github.com/cloudflare/cloudflared/issues/327
st3fan 13 hours ago||
Huh I brew installed it and got a working tunnel in like 15 seconds.
lysace 11 hours ago||
Install via brew worked. Getting the hostname to resolve took 30 mins of waiting. Have they heard of wildcard DNS?
judge2020 9 hours ago||
Cloudflare isn't going to wildcard every domain on their platform just to cure stale cache DNS issues.
lysace 6 hours ago||
That wasn’t the ask though.

The product is falsely advertised as is:

"Cloudflare Quick Tunnels"

This is on one (or two) particular domain(s) where setting up wildcard DNS should be relatively trivial, if they actually cared enough about the UX of this product to make a special case in their code.

I don't understand how people can launch stuff like this.

keeganpoppen 15 hours ago||
yeah am i crazy or could it not like already do this as well? i swear i’ve seen somesuch similar in the cloudflared options. maybe not. but i can second having had some problems over the year getting cloudflared to install/set up correctly. tbf the actual feature works amazing once you get it working.
robertlagrant 14 hours ago||
As I understand it you can make a tunnel, but it's under a domain you control and it's a few clicks in the dashboard to set up, and then a something to run in CLI. That's what my homelab uses. This is just a single CLI command and the whole thing is set up.
rplnt 16 hours ago||
Are we in an age where no one even bothers to open the product pages they generate? The first subtitle with the font color almost matching the background. Or it's even worse that a human looked at it and said "yep, that's OK"?
lkbm 16 hours ago||
It's fine on light mode. It's just the dark mode that's terrible. Seems likely they only tested the former.
Gigachad 11 hours ago|||
I'm viewing the site on lightmode, clicked one of the #links which scrolled down the page, when I scrolled back up all the sections lost their content and were unusable.

I've never seen someone fail a static page like this. And from a huge company like Cloudflare too..

rplnt 16 hours ago||||
I see, good point. Some might be confused about my comment then.
brazukadev 13 hours ago|||
which proves the point OP is making.
jeremyjh 11 hours ago|||
I find it shocking that they shipped this claudecopy.
eranation 9 hours ago||
I’m raising my eyebrows…
reaperducer 16 hours ago||
Are we in an age where no one even bothers to open the product pages they generate?

We live in an age of monkey-see-monkey-do management.

When Microsoft axed its QA team, it gave permission for everyone else to make the same stupid mistake.

rvz 13 hours ago||
We are in the age of where hype beats reasoning.
skhameneh 15 hours ago||
There's a number of comments already about how this page looks vibe coded, I'd add that I'm actually shocked at how much this looks like the output of a one-shot prompt. It's not so much that an LLM was used, but a callout on just how generic this page is. How much iteration went into this? At surface it looks like nearly no iteration.

Edit: Well, they just re-vibed it. Went from the most generic Claude 4.6 era to today’s models, quality wise. I wish I had saved a copy of the original, because it would have taken me actual solid effort to make a page that generic out of an LLM.

ruuda 12 hours ago||
"Traffic rides Cloudflare's network" Oh, hello Claude.
hackernud3s 9 hours ago||
How would you say that? I can't think of a clearer way to say it TBH.
jofzar 7 hours ago||
"Traffic routes via Cloudflare's network"?
hackernud3s 6 hours ago||
It routes from closest PoP to visitor -> closest PoP to origin. Your way doesn't convey that as clearly IMHO.
PufPufPuf 15 hours ago|||
Group of three cards, each with a left-aligned icon, heading and subheading stacked -- that's the m-dash of web design.
vlyan 15 hours ago||
I'll take that over corporate memphis of the previous decade.

(idk if it's really declining or I simply haven't noticed it in a while)

kincl 17 hours ago||
Is this their version of https://tailscale.com/tailcat ? I can't tell if you need to auth

edit: yeah, it says no account creation, neat!

Tepix 16 hours ago||
I believe with tailscale you don’t have to trust a 3rd party with your cleartext traffic
athrowaway3z 15 hours ago|||
But you do seem to get to host a https version of your app in case you need features locked behind secure context.
spwa4 15 hours ago|||
That can't be right. If they're hosting on a different DNS they have an absolute need to MITM ssl/tls traffic. Can't work otherwise.

So cloudflare sees your plaintext. Btw: tailscale does not (but ssl errors and warnings are unavoidable)

hermanradtke 17 hours ago|||
feels more like an ngrok competitor
israrkhan 16 hours ago||
This is a crowded space with lots of solutions (oss and commercial)

https://github.com/anderspitman/awesome-tunneling

alasano 16 hours ago||
More like their version of Tailscale funnel I think
israrkhan 16 hours ago||
For someone looking for an opensource solutions, following is an awesome resource for tunnelling

https://github.com/anderspitman/awesome-tunneling

I have played around with frp, bore and ngrok.

drdexebtjl 16 hours ago|
frp is nice. I have the tiniest Amazon Lightsail instance running a tunnel to a Minecraft server in my basement. It’s cheaper than getting a fixed IP from my ISP, at sufficiently low traffic.
aliasxneo 17 hours ago||
Tunneling was something that recently fell out of the work I've been doing [1]. I've used Cloudflare Tunnels before but I just have low trust with them recently with how big they are getting. All of these nice things come at the cost of pushing _a lot_ of traffic through their systems.

[1]: https://dntls.substack.com/p/the-new-internet

pstoll 16 hours ago||
Reality check - you are not pushing “_a lot_” of traffic relative to any hyperscaler or large scale CDN. They push hundreds of Tbps sustained. You don’t peak at a few Mbps.

They can monitor extreme outliers. It’s not an issue for them.

aliasxneo 16 hours ago|||
In hindsight, that was probably a confusing sentence. I was more pointing out how much traffic flows trough their systems which ends up making it an attractive honeypot, especially as a U.S. company.
pstoll 7 hours ago||
Sure any centralization of infra is an obvious risk for a myriad of reasons eg DoS, manipulation, honeypots, etc.

But again my point applies - the chances they get enough people using it that it becomes a meaningfully worse security target than lots of other existing things seems … super low.

It’s a big world, people make many choices I can’t understand (nix? Haskell? Php? <flame wars to /dev/null>). Even if this product nailed it - the number of people who can use it is minuscule - yes even as we add Claude-enabled PMs to the software dev ranks.

Alt view with the old saying - “put all your eggs in one basket … and watch that basket!”

ijustlovemath 16 hours ago|||
I think they're talking about market capture risks
simonw 16 hours ago|||
If there's any company in the world that can survive a lot of extra traffic being pushed through their systems it's Cloudflare.

I bet these new tunnels end up being a fraction of a percentage point of their network traffic.

aliasxneo 16 hours ago|||
Yeah, I don't doubt their infrastructure at all. In fact, I rate them fairly high in terms of reliability and performance. I've honestly been a fan of them for a very long time - it's just I'm watching all of this centralization happen and it sets my Spidey sense off. Like I'm waiting for the other shoe to drop.
simonw 16 hours ago|||
Gotcha, that totally makes sense.
swozey 15 hours ago|||
The "centralization" which is cloudflare basically running its own walled garden version of the interent (how often do you see a cloudflare page checking if you're human?) is exactly why a lot of people do NOT like cloudflare. And if you've known about CF and its leadership since their inception you'd be even more wary of sticking your stuff over there.

I've migrated many companies off of cloudflare, usually because they end up pissing off companies when a contract renewal comes up and they slam them with massively increased bills and almost useless support if you aren't very high paying enterprise. I don't know how many CF support tickets I've just given up on over the last 15 years, usually related to their admin page, workers or some weird thing their system does that wasn't documented and I just stop getting responses and definitely don't get fixes.

If you ever worked in webhosting the Cloudflare wordpress/etc extensions are everywhere and back when I did work in hosting tons of support tickets were made because of CF. Could be way better now, I don't go near that industry these days.

The casual CF user sticking it in front of a blog they rarely look at and the business forced CF user has a very different experience. I cringe and seriously consider if I'm interviewing for an infra role and they use cloudflare. Usually it's startups that grew into larger businesses.

ceejayoz 16 hours ago||||
I didn't take it as a capacity concern, but a "how much data do they get to look at" one.
bix6 16 hours ago||||
It’s a concentration of power issue.
robertlagrant 12 hours ago||
Given they seem to mostly offer services that are about as easy to switch away from as you could hope for, compared to, say, companies who write loads of CF that only runs on AWS, and I can't imagine why this keeps on being said for Cloudflare specifically. What power do they have?
mitxela 9 hours ago||
It doesn't matter that they're easy to switch away from. It matters that people haven't actually switched away from them.
eli 16 hours ago||||
Don’t the free tunnels have explicit limits on bandwidth and streaming?
Tepix 16 hours ago|||
They see all the traffic in cleartext. Plus you have to trust them not to maliciously alter your traffic. As a US company, their options may be limited if they are coerced by their government to do so.
insanitybit 16 hours ago||
Just use TLS / mTLS over the tunnel, no?
Perz1val 16 hours ago|||
Interesting how 4/4 other replies didn't get the centralisation concern despite it being a fairly often discussed topic
ozozozd 12 hours ago|||
Your opening piqued my interest, but:

“The substrate itself consists of a few systems…”

I doubt that this is how wordy your communication is.

“It consists of a few systems” would be adequate. And if we had prior context about what else exists that surrounds “the substrate” the “substrate itself” distinction would be meaningful, but it’s not, because you are referring to one object, which is the system you built, and I doubt any enzymes act on it, so it’s likely not a substrate.

done_lurking 14 hours ago|||
There are other reasons not to trust them as well, especially if you've seen how their sales team operates https://news.ycombinator.com/item?id=40481808
t_mahmood 16 hours ago|||
Yeah, it reminds me of Google. Fool me twice ...

I'm not trusting any of these corporates any more

inopinatus 16 hours ago|||
Cloudflare want you to push traffic through their systems. This is yet another traffic generator to drive up Cloudflare’s leverage when negotiating peering with carriers & service providers, in order to drive down the marginal cost of bandwidth for Cloudflare’s actual product viz. the enterprise DDoS protection.
mitxela 9 hours ago||
True. Same reason Hurricane Electric peers promiscuously. I'm surprised more networks don't, to be honest - wouldn't say DTAG prefer that you peer with DTAG than peer with HE upstream of DTAG?
afzalive 17 hours ago||
This is pretty great and I think this will be quite important in the age where everyone has their self-hosted services.
ghoshbishakh 14 hours ago||
This is a very good solution for HTTP(S) tunneling - which is the most frequently needed tunnel. However if you want to play a game, or use SSH, then Pinggy tunnels are very simple to use. One command:

ssh -p 443 -R0:localhost:443 tcp@free.pinggy.io

Disclosure: Co-founder of pinggy.io here.

Edit: I meant TCP tunnels, UDP tunnels, or also TLS tunnels for end-to-end encryption.

caymanjim 13 hours ago||
What kind of usage limits?
ghoshbishakh 13 hours ago||
A free session runs for 60 seconds after which it has to be restarted and the address changes.

You can get the address with an API call.. but we charge for convenience. Pays the infra bills.

ghoshbishakh 2 hours ago||
*60 minutes
tonymet 14 hours ago||
i love this! never understood why a proxy app was needed
fragmede 14 hours ago||
So you don't know my IP (DDoS target), and because of NAT.
tredre3 13 hours ago|||
I think tonymet meant he didn't understand why cloudflare didn't allow using ssh -R instead of cloudflared to create the tunnel, not not using a tunnel at all.
judge2020 9 hours ago|||
cloudflared is a bit unique in that it makes multiple outbound connections to CF DCs to do the tunneling and fails over if a DC has an issue (or, more likely, when a DC is near-capacity and they need to divert lower-tier traffic away from it[0]). SSH would reintroduce a single point of failure to this.

Also, the _main_ use case of `cloudflared` tunneling is using it as a long-term way to host production websites on your own hostname. the ability to create ad-hoc tunnels is more of a gimmick / advertising opportunity.

0: https://github.com/judge2020/cloudflare-connectivity-test/wi...

tonymet 11 hours ago|||
precisely (thanks!)
tonymet 13 hours ago|||
any app will connect with an IP am I missing something . a socket is exactly (IP, port) (src, target) tuple
c0wb0yc0d3r 13 hours ago||
For me, it’s as much about ease of use as much as it is about minimizing attack surface area.

Also the lifetime I need the connection open. For something quick, ssh tunnel. For something normies use, reverse proxy. Ain’t trying to teach my parents about IP addresses and port numbers.

tonymet 11 hours ago||
tredre3 explained it above
dangoodmanUT 17 hours ago|
Historically, we’ve found that their tunnels have really high latency variance. For example something that’s normally 30-50ms to ec2 is now 115ms-750ms
hackernud3s 9 hours ago|
Because it travels along their edge. It's apples and oranges to your AWS tunnel.
dangoodmanUT 8 hours ago||
No, they claim their edge is better for residential connections to your backend. We tried multiple SF to us-east-1 and it was always substantially worse
More comments...