tailscale VS cloudflared

My plan is to set up an EC2 instance and host a VPN, considering options like Netmaker, OpenVPN, or Tailscale. The goal is to connect these devices to the VPN, enabling SSH access from any connected node. This method seems cost-effective(Considering I want to use 100s of devices and potentially 1000s) and straightforward, requiring a simple setup with a sudo apt command on the Raspberry Pi.

It's likely just `tailscale serve https / `.

https://github.com/tailscale/tailscale/blob/main/ipn/serve.g...

And they also support direct embedding:

https://tailscale.dev/blog/embedded-funnel

I think this is built on the wireguard-go + gvisor mashup, that allows you to do this with just Wireguard:

https://github.com/WireGuard/wireguard-go/tree/master/tun/ne...

One of my favorite applications of this is this little tool that turns Wireguard VPNs into SOCKS5 proxies (which you can selectively enable in your browser)

https://pkg.go.dev/github.com/octeep/wireproxy

I agree, it's a feature that I find sorely lacking in my tailnet.

These are the relevant Github issues to follow, hopefully they address these someday:

https://github.com/tailscale/tailscale/issues/465

tailscale runs a continuous netcheck to an unroutable IP (203.0.113.1:12345:UDP) [1] for whatever reason. This triggered Hetzner's ghetto-ass DDOS protection, thinking my server was compromised or something. They sent me an email saying my server was compromised and I had 24hrs to remedy it.

I responded to the email and filled out this attestation form declaring that my server was not under attack and it was a false positive etc. They still null routed my server and refused to turn it back on, and their arrogant support told me there was no way I was in control of this server etc.

Anyway, took my box offline during a peak user day, migrated to AWS and never looked back.

Don't do anything of importance on Hetzner. No wonder they only get people running pirated plex boxes.

[1] https://github.com/tailscale/tailscale/blob/94304819263b0553...

Fond memories of using DDNS on old Netgear routers at home in the aughts and port forwarding services with some rudimentary firewall rules and tcpwrappers to try and lock down access.

Now I use a combination of Tailscale[1] for private services only to me and Tailscale Funnels[2], and Cloudflare Tunnels[3] for public service exposure.

This accomplishes the same thing I was doing with DDNS and my ISP IP, but in a much more secure and stable manner.

1. https://tailscale.com/

2. https://tailscale.com/kb/1223/tailscale-funnel/

3. https://developers.cloudflare.com/cloudflare-one/connections...

Tailscale: Seems to have quite good NAT support and seems to do DNS resolution. Clients for most relevant platform - a well rounded package. But I find their plans to be prohibitive. Only 20 devices on the free plan. The first paid tier is 5 devices per 1 user, so 5 devices for me paying? A head scratcher. There is an open source control plane https://github.com/juanfont/headscale but given the clients are not open source it feels a bit scary to rely on. My knowledge of wireguard is not good enough, but I am also wondering if it is really meant for a mesh setup?

# Install apt dependencies !apt install dotnet-sdk-7.0 git # Install Clouldflared (not on apt) !wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb !dpkg -i cloudflared-linux-amd64.deb # Download StableSwarmUI !git clone https://github.com/Stability-AI/StableSwarmUI # Download ComfyUI backend %cd /content/StableSwarmUI !mkdir /content/StableSwarmUI/dlbackend %cd /content/StableSwarmUI/dlbackend !git clone https://github.com/comfyanonymous/ComfyUI %cd /content/StableSwarmUI/dlbackend/ComfyUI # Setup ComfyUI !pip install -r requirements.txt

Something like cloudflared would be awesome. https://github.com/cloudflare/cloudflared

if you're on windows, you can install it with the exe: https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe (or https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-386.exe if your using 32bit windows.)

%cd /content/naifu !pip install virtualenv && bash ./setup.sh !curl -Ls https://github.com/ekzhang/bore/releases/download/v0.4.0/bore-v0.4.0-x86_64-unknown-linux-musl.tar.gz | tar zx -C /usr/bin !curl -Lo /usr/bin/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 && chmod +x /usr/bin/cloudflared !/content/naifu/venv/bin/python -m pip install -qq pytorch_lightning==1.7.7

As an alternative to traditional ingress, you can use cloudflared to expose web apps on Cloudflare via encrypted tunnels: https://github.com/cloudflare/cloudflared

It's not an issue anymore. Your main concerns are power and internet stability. Plus, upload speed. The rest can be worked out.

https://www.cloudflare.com/products/tunnel/

https://github.com/cloudflare/cloudflared

https://developers.cloudflare.com/cloudflare-one/connections...

I would suggest a reverse proxy tunnel. There is a great and mostly free one I personally use by Cloudflare. You will need a domain, cloudflare account and install the cloudflared client on your machine. For security you can lock down this tunnel in many ways as cloudflare gives you many many options. Zero trust is a good one to look at if you are wanting to secure what ever you want to expose with a login through google or GitHub.

I shared the same feeling until I gave up on "fixing" nextcloud for external access. Slapped cloudflared tunnel on it. You may have to disable Rocket Loader to get the homepage to work properly but after that it just works.

mariadb: # https://github.com/linuxserver/docker-mariadb/releases image: lscr.io/linuxserver/mariadb:${MARIADB_VERSION:-latest} container_name: nextcloud_mariadb environment: - PUID=${PUID} - PGID=${PGID} - TZ=${TZ} - MYSQL_ROOT_PASSWORD=${NEXTCLOUD_MARIADB_ROOT_PASSWORD} - MYSQL_DATABASE=nextcloud - MYSQL_USER=nextcloud - MYSQL_PASSWORD=${NEXTCLOUD_MARIADB_PASSWORD} volumes: - ${NEXTCLOUD_PATH}/mariadb:/config security_opt: - no-new-privileges:true restart: unless-stopped labels: - "com.centurylinklabs.watchtower.enable=true" redis: # https://hub.docker.com/\_/redis?tab=tags image: redis:${REDIS_VERSION:-latest} container_name: nextcloud_redis security_opt: - no-new-privileges:true restart: unless-stopped labels: - "com.centurylinklabs.watchtower.enable=true" cloudflared: # https://github.com/cloudflare/cloudflared/releases image: cloudflare/cloudflared:${CLOUDFLARED_VERSION:-latest} container_name: nextcloud_cloudflared_tunnel command: tunnel run environment: - TUNNEL_TOKEN=${CLOUDFLARED_TUNNEL_TOKEN} restart: unless-stopped labels: - "com.centurylinklabs.watchtower.enable=true" watchtower: ## https://containrrr.dev/watchtower/ image: containrrr/watchtower:${WATCHTOWER_VERSION:-latest} container_name: nextcloud_watchtower environment: - WATCHTOWER_CLEANUP=${WATCHTOWER_CLEANUP:-false} - WATCHTOWER_LABEL_ENABLE=${WATCHTOWER_LABEL_ENABLE:-false} - WATCHTOWER_SCHEDULE=${WATCHTOWER_SCHEDULE:-0 0 0 * * *} ## https://pkg.go.dev/github.com/robfig/[email protected]#hdr-CRON\_Expression\_Format volumes: - /var/run/docker.sock:/var/run/docker.sock - /etc/localtime:/etc/localtime:ro restart: unless-stopped