Cloudflare Tunnels encryption
Hello everyone, due to being behind a CGNAT I need to tunnel my traffic. I know that cloud flare offers a free service, which allows you exactly to do that. The issue is, that I need to encrypt my traffic beforehand, otherwise the traffic is…
Hello everyone, due to being behind a CGNAT I need to tunnel my traffic. I know that cloud flare offers a free service, which allows you exactly to do that. The issue is, that I need to encrypt my traffic beforehand, otherwise the traffic is accessible/readable by them. I know that it allows you to use SSH. This means in theory I could use SSHs (ssh -L) build in local port forwarding to transmit data to services running on my local server correct? I could also set up a VPN over SSH (aka. create a tunneling device and send traffic over this device + setup routing on my Homeserver so each packet goes to the correct running service). This would allow a secure and authenticated encryption via ssh. The thing is, that this approach will probably work on my Linux PCs without any issues, but I am unsure on how I can establish a secure connection via my Phone for example. My plan is to use Immich and I have no clue how to establish an end to end encrypted connection between my phone (iPhone, IOS 26) and my server. Any ideas? I would need something like an app, allowing me to tunnel certain apps network packet via SSH. I also know that this setup idea is kinda hacky, so if there are better options please let me know. I know that I could rent a cheap VPS and use this as a server for tunneling, but then again, the data there is unencrypted for a short time.
Collected discussion
Expand the replies to this comment to learn how AI was used in this post/project.
Prepare for unreal latency and slowdown on a $1 vps
Mine is good enough. Not going to stream a 4K movie but it gets the job done. Even runs a TeamSpeak 6 server in parallel. Edit: Just did a speed test on the 1€ IONOS XS VPS, getting 500 Mbps down and 250 Mbps up. Much faster than my home upload.
Wait what are you talking about? If you have a VPS that is either a wireguard server or a TLS termination point you control (e.g. reverse proxy with a real certificate, could be handling them or forwarding to an internal wireguard network, doesn't matter), the provider can't read anything.
Do you really KNOW that the VPS provider doesn't break encryption and act in YOUR name? Du you really KNOW that the VPS provider doesn't controll on hardware level the I/O on your virtual hard disk, your virtual RAM, your virtual CPU? Simple question: are you abel to audit that VPS with your OWN EYES? If you cannot enter the location where your VPS is located, than you NEVER EVER can trust ultimatively. Yes, the probability is small and there are regulations, but it is NOT physically impossible. Be aware that due to the patriot act and the cloud act all US companies are FORCED to give the authorities access to the data of their customers for investigation. If the don't have access, they have to do so that the HAVE access. I don't say "don't use it", I simply say "be aware of the possibility". I don't use any VPS at all, I simply host myself in MY home and I take responsibility if I do something shitty (never occourred).
Well, they only see encrypted traffic. Don't really care if they see who is connecting.
Maybe you’re better off self hosting Pangolin on a $1 VPS. That’s how I’m doing it. You can either expose your resources publicly or make them accessible only for your devices with Pangolin Client. You can install Newt on your server with Immich, and install Pangolin Client on your iPhone. This will make an encrypted VPN connection to your server with Immich. (Or relay through the IPv4 VPS when your iPhone is in a network without IPv6.)
So you trust the $1 VPS provider to not be reading people's traffic?
No, Cloudflare only proxies HTTP and does TLS termination on their end. You have to rust them with your clear text traffic, that's how their service is designed (otherwise WAF, analytics, ... wouldn't work). I recommend you use IPv6 instead, no CGNAT (or any NAT for the matter) to worry about. If you don't have IPv6, get yourself a small VPS for ~$5 a month. You can tunnel everything you like through Wireguard, and potentially use a reverse proxy on the VPS to expose your stuff to the Internet as well.
It sounds like you should just be using Tailscale really
You don't trust Cloudflare but you trust in a VPS on a third party provider that could do the same? As long as you don't own the hardware and have them in YOUR home, you cannot trust it. So use Cloudflare as you want. Encryption ist nice but you simply move the "trust point" to another entity. I would recommend to search for an ISP that doesn't lock you behind CGNAT, alternatively switch in using IPv6, if possible.
I know that I could rent a cheap VPS and use this as a server for tunneling, but then again, the data there is unencrypted for a short time. Only if you use Pangolin or a reverse proxy without understanding what you're doing. What you need to do on a VPS is forward the HTTPS connections untouched through a VPN or SSH tunnel. That way the connections are never unencrypted, and are even double encrypted on the way home. Run a WireGuard or OpenVPN VPN server on the VPS. Connect to the VPN server from home. On the VPS, forward port 443 from the VPS public interface into the VPN interface. You can use nftables/iptables but it's much easier to just run socat (and perhaps a systemd unit to keep it alive). At home, make your reverse proxy listen on the local end of the VPN interface. Your reverse proxy and your HTTPS certificates will be at home. On the VPS will only be a VPN server certificate that can only be used to accept incoming connections. The VPS will need very little CPU and RAM because all it's doing is forwarding TCP connections. You can also use SSH to do the forwarding, with a single command.
this is not how Cloudflare works, it proxies http traffic with TLS termination on their end. You can run a proxy on a rented VPS, but you need to know what you’re doing. If you don’t want to deal with middlemen, just use IPv6 or if they can’t do this yet, switch to an ISP that supports it.
This is something I was going to try at some point. My current thoughts are: VPS with xray core set up with inbound vless+encryption+xhttp/grpc/httpupgrade transport. Open port to cloudflare (maybe with mtls) Pangolin on the VPS provides access to services Clients connect with shadowrocket
As far as I'm aware SSH forwarding is a paid feature for Tunnels, at which point you might as well just configure them to forward TLS instead (Cloudflare let's you configure Tunnels to run without TLS termination on paid plans)