Thread

Cloudflare Quick Tunnels

844 points · 316 comments · jcbhmr

Loading the complete thread in the background. This saved snapshot is available now. Refresh

smalltorch · 1789743161 · focus · HN ↗
It's a nice ability, but I dont like the terms of use.
1. ZeroCool2u · 1789744715 · focus · HN ↗
  Anything specific to watch out for?
2. whizzter · 1789744936 · focus · HN ↗
  On what url were those? Or Cloudflare's TOS in general ?
user3939382 · 1789744551 · focus · HN ↗
I just spent a week writing a harness around the existing tunnels to make this by hand.
dangoodmanUT · 1789744565 · focus · HN ↗
Historically, we’ve found that their tunnels have really high latency variance. For example something that’s normally 30-50ms to ec2 is now 115ms-750ms
1. hackernud3s · 1789773206 · focus · HN ↗
  Because it travels along their edge. It's apples and oranges to your AWS tunnel.
  1. dangoodmanUT · 1789778829 · focus · HN ↗
    No, they claim their edge is better for residential connections to your backend. We tried multiple SF to us-east-1 and it was always substantially worse
ThrowawayTestr · 1789744658 · focus · HN ↗
No-ip gives out free dynamic DNS with a static URL. I use it for Sunshine desktop streaming when I travel.
1. cuu508 · 1789745170 · focus · HN ↗
  Yeah, but then you are always exposing your public IP.
  1. monster_truck · 1789746100 · focus · HN ↗
    Exposing it to what exactly? The internet? Yes that's how it works
    johng · 1789747569 · focus · HN ↗
    This requires no port forwarding, so someone brute force scanning your IP won't find this and your open port. they also might have a harder time figuring out what service has been exposed since the port number itself will be unknown.
    cuu508 · 1789752185 · focus · HN ↗
    If somebody learns that such-and-such DynDNS URL is mine, they can always do a DNS lookup to find my current IP address. They can:
    - find my approximate physical location
    - regularly scan ports on my IP and wait for me to accidentally expose a service I didn't mean to
    - track me in any access logs they have access to
    mitxela · 1789775075 · focus · HN ↗
    They can, and do, do this with or without DynDNS.
    cuu508 · 1789807156 · focus · HN ↗
    Do you mean by getting the information from Cloudflare, or some other way? With DynDNS though, finding out my IP is trivial and does not require any special powers or skills, it is just a DNS lookup.
    PS. Just re-watched your matrix LED pendant video. It is so well done, both the project, and the accompanying video!
    mitxela · 1789823097 · focus · HN ↗
    They're scanning all IPs all the time. If your home router has a public IP and a firewall log, check it
    cuu508 · 1789848456 · focus · HN ↗
    But with Cloudflare tunnel (and similar tools), there are no open ports on the origin server.
altmanaltman · 1789744743 · focus · HN ↗
Claude worked overtime on this webpage
kincl · 1789744770 · focus · HN ↗
Is this their version of <a href="https://tailscale.com/tailcat" rel="nofollow">https://tailscale.com/tailcat ? I can't tell if you need to auth
edit: yeah, it says no account creation, neat!
1. hermanradtke · 1789744997 · focus · HN ↗
  feels more like an ngrok competitor
  1. israrkhan · 1789747242 · focus · HN ↗
    This is a crowded space with lots of solutions (oss and commercial)
    <a href="https://github.com/anderspitman/awesome-tunneling" rel="nofollow">https://github.com/anderspitman/awesome-tunneling
2. alasano · 1789747229 · focus · HN ↗
  More like their version of Tailscale funnel I think
3. Tepix · 1789748250 · focus · HN ↗
  I believe with tailscale you don’t have to trust a 3rd party with your cleartext traffic
  1. athrowaway3z · 1789753196 · focus · HN ↗
    But you do seem to get to host a https version of your app in case you need features locked behind secure context.
  2. spwa4 · 1789753680 · focus · HN ↗
    That can't be right. If they're hosting on a different DNS they have an absolute need to MITM ssl/tls traffic. Can't work otherwise.
    So cloudflare sees your plaintext. Btw: tailscale does not (but ssl errors and warnings are unavoidable)
ZeroCool2u · 1789744796 · focus · HN ↗
This is handy, but I wonder how much it will cannibalize their services. I have a simple app deployed on cloudflare for a very niche single purpose use, but I wouldn't have bothered if I had this. Serving it from my own machine would have been fine.
1. aniviacat · 1789745222 · focus · HN ↗
  Cloudflare Tunnels has been a free service of Cloudflare for quite a while now. What's new is being able to use them without needing an account.
  1. bakugo · 1789745623 · focus · HN ↗
    [delayed]
2. roncesvalles · 1789745714 · focus · HN ↗
  Not many people run their local machine 24/7.
  1. berofeev · 1789746618 · focus · HN ↗
    What does reality look like on this nowadays?
    My initial thought was desktops generally run 24/7, with laptops running when in use. At least for the customer at the market intersection for this type of product.
    JavierFlores09 · 1789748257 · focus · HN ↗
    I often tell my dev colleagues to avoid having their PC turned on all the time, be it because of the electricity bill cost, environmental impact or simply to make the longevity of the hardware a little longer. Granted almost everyone just ignores those things even if they're conscious of it, so I'd say you're right
    seabrookmx · 1789756923 · focus · HN ↗
    There's pros and cons on the longevity side. 24/7 use causes more wear to mechanical parts (fans for instance) but can be better for the electronics, as heat cycles are a big part of the problem there.
    roncesvalles · 1789749432 · focus · HN ↗
    Very few people own desktops anymore. Generally people only buy desktops if they need to run a GPU, such as for gaming or running a local model.
    SoftTalker · 1789752902 · focus · HN ↗
    Yeah my desktop is on 24/7. Laptop is on when in use. Phone is on all the time too, of course, but I don't use it for browsing or work nearly as much as my desktop.
  2. sophacles · 1789748100 · focus · HN ↗
    There are people who turn off their computer?
  3. cmacleod4 · 1789754945 · focus · HN ↗
    You do if you're hosting a website on it :-)
3. danserfaty · 1789747078 · focus · HN ↗
  Maybe it's a nice way to quickly test a new service or change over the internet without going through the git process, same way one would use ngrok - I could see that being helpful when prototyping / pocs, etc - before deploying changes to your app via the proper channel. As other people said, it probably would not be practical or scalable for most people to run an app 24/7 from their laptop using their home or office internet connection.
aliasxneo · 1789744916 · focus · HN ↗
Tunneling was something that recently fell out of the work I've been doing [1]. I've used Cloudflare Tunnels before but I just have low trust with them recently with how big they are getting. All of these nice things come at the cost of pushing _a lot_ of traffic through their systems.
[1]: <a href="https://dntls.substack.com/p/the-new-internet" rel="nofollow">https://dntls.substack.com/p/the-new-internet
1. afzalive · 1789746286 · focus · HN ↗
  This is pretty great and I think this will be quite important in the age where everyone has their self-hosted services.
2. simonw · 1789746884 · focus · HN ↗
  If there's any company in the world that can survive a lot of extra traffic being pushed through their systems it's Cloudflare.
  I bet these new tunnels end up being a fraction of a percentage point of their network traffic.
  1. aliasxneo · 1789747007 · focus · HN ↗
    Yeah, I don't doubt their infrastructure at all. In fact, I rate them fairly high in terms of reliability and performance. I've honestly been a fan of them for a very long time - it's just I'm watching all of this centralization happen and it sets my Spidey sense off. Like I'm waiting for the other shoe to drop.
    simonw · 1789749861 · focus · HN ↗
    Gotcha, that totally makes sense.
    swozey · 1789752871 · focus · HN ↗
    The "centralization" which is cloudflare basically running its own walled garden version of the interent (how often do you see a cloudflare page checking if you're human?) is exactly why a lot of people do NOT like cloudflare. And if you've known about CF and its leadership since their inception you'd be even more wary of sticking your stuff over there.
    I've migrated many companies off of cloudflare, usually because they end up pissing off companies when a contract renewal comes up and they slam them with massively increased bills and almost useless support if you aren't very high paying enterprise. I don't know how many CF support tickets I've just given up on over the last 15 years, usually related to their admin page or some weird thing their system does that wasn't documented and I just stop getting responses and definitely don't get fixes.
    If you ever worked in webhosting the Cloudflare wordpress/etc extensions are everywhere and back when I did work in hosting tons of support tickets were made because of CF. Could be way better now, I don't go near that industry these days.
  2. eli · 1789747216 · focus · HN ↗
    Don’t the free tunnels have explicit limits on bandwidth and streaming?
  3. bix6 · 1789747392 · focus · HN ↗
    It’s a concentration of power issue.
    robertlagrant · 1789764240 · focus · HN ↗
    Given they seem to mostly offer services that are about as easy to switch away from as you could hope for, this seems an odd problem to raise. Compare that to people who write loads of CF that only runs on AWS or something and I can't imagine why this keeps on being said for Cloudflare.
    mitxela · 1789774308 · focus · HN ↗
    It doesn't matter that they're easy to switch away from. It matters that people haven't actually switched away from them.
    robertlagrant · 1789820164 · focus · HN ↗
    Can you explain why it doesn't matter that they're easy to switch away from?
    mitxela · 1789823122 · focus · HN ↗
    Because it only matters whether people actually switch away from them.
    robertlagrant · 1789908807 · focus · HN ↗
    Why?
  4. ceejayoz · 1789747395 · focus · HN ↗
    I didn't take it as a capacity concern, but a "how much data do they get to look at" one.
  5. Tepix · 1789748115 · focus · HN ↗
    They see all the traffic in cleartext. Plus you have to trust them not to maliciously alter your traffic. As a US company, their options may be limited if they are coerced by their government to do so.
    insanitybit · 1789748248 · focus · HN ↗
    Just use TLS / mTLS over the tunnel, no?
3. pstoll · 1789748000 · focus · HN ↗
  Reality check - you are not pushing “_a lot_” of traffic relative to any hyperscaler or large scale CDN. They push hundreds of Tbps sustained. You don’t peak at a new Mbps.
  1. ijustlovemath · 1789748551 · focus · HN ↗
    I think they're talking about market capture risks
  2. aliasxneo · 1789748690 · focus · HN ↗
    In hindsight, that was probably a confusing sentence. I was more pointing out how much traffic flows trough their systems which ends up making it an attractive honeypot, especially as a U.S. company.
    pstoll · 1789780791 · focus · HN ↗
    Sure any centralization of infra is an obvious risk for a myriad of reasons eg DoS, manipulation, honeypots, etc.
    But again my point applies - the chances they get enough people using it that it becomes a meaningfully worse security target than lots of other existing things seems … super low.
    It’s a big world, people make many choices I can’t understand (nix? Haskell? Php? <flame wars to /dev/null>). Even if this product nailed it - the number of people who can use it is minuscule - yes even as we add Claude-enabled PMs to the software dev ranks.
    Alt view with the old saying - “put all your eggs in one basket … and watch that basket!”
4. inopinatus · 1789748225 · focus · HN ↗
  [delayed]
  1. mitxela · 1789774366 · focus · HN ↗
    True. Same reason Hurricane Electric peers promiscuously. I'm surprised more networks don't, to be honest - wouldn't say DTAG prefer that you peer with DTAG than peer with HE upstream of DTAG?
5. Perz1val · 1789750134 · focus · HN ↗
  Interesting how 4/4 other replies didn't get the centralisation concern despite it being a fairly often discussed topic
6. t_mahmood · 1789750341 · focus · HN ↗
  Yeah, it reminds me of Google. Fool me twice ...
  I'm not trusting any of these corporates any more
7. done_lurking · 1789754476 · focus · HN ↗
  There are other reasons not to trust them as well, especially if you've seen how their sales team operates <a href="https://news.ycombinator.com/item?id=40481808">https://news.ycombinator.com/item?id=40481808
8. ozozozd · 1789764398 · focus · HN ↗
  Your opening piqued my interest, but:
  “The substrate itself consists of a few systems…”
  I doubt that this is how wordy your communication is.
  “It consists of a few systems” would be adequate. And if we had prior context about what else exists that surrounds “the substrate” the “substrate itself” distinction would be meaningful, but it’s not, because you are referring to one object, which is the system you built, and I doubt any enzymes act on it, so it’s likely not a substrate.
whizzter · 1789745031 · focus · HN ↗
Don't all these free proxy services always fall prey to blacklists because scammers,etc abuse them until they're useless?
1. Imustaskforhelp · 1789745230 · focus · HN ↗
  Yes they actually do, but because its cloudflare which is offering this, blacklisting it might lead to blacklisting can be more negative and cloudflare has a much higher incentive to not make these tunnels useless. They are also more powerful and can fix things which would be harder for smaller companies to handle (atleast within the context of cloudflare tunnels)
  1. mitxela · 1789774467 · focus · HN ↗
    Spain blacklisted Cloudflare and everyone hates it, but it proves it can happen.
2. axus · 1789745673 · focus · HN ↗
  Wow, exfiltrating data has never been easier!
3. srichard16 · 1789751839 · focus · HN ↗
  Can confirm. Coming from ngrok, the main reason we had to make tunneling not anonymized etc was because of scammers, etc on the internet. Other players in the space bypass this by open sourcing the tech, or separating the architecture entirely. This is cool and all, but ultimately gives nefarious actors on the internet more opportunities.
  1. noname120 · 1789770666 · focus · HN ↗
    How does “open sourcing the tech” “give nefarious actors on the internet more opportunities”?
4. uxjw · 1789752037 · focus · HN ↗
  Probably why they used the trycloudflare.com domain as they expect it to be blocked.
JV00 · 1789745060 · focus · HN ↗
Does this have a more generous allowance than ngrok? From what I can read no limits are mentioned
1. daemonologist · 1789745283 · focus · HN ↗
  I don't know if there's an overall limit, but their regular tunnels have a limit of 100 MB per request which breaks stuff like Immich.
2. raahelb · 1789748634 · focus · HN ↗
  These are the limitations mentioned on the docs [1]: - Quick Tunnels are subject to a hard limit on the number of concurrent requests that can be proxied at any point in time. Currently, this limit is 200 in-flight requests. If a Quick Tunnel hits this limit, the HTTP response will return a 429 status code. - Quick Tunnels do not support Server-Sent Events (SSE).
  [1]: <a href="https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/#limitations" rel="nofollow">https://developers.cloudflare.com/cloudflare-one/networks/co...
Narciss · 1789745671 · focus · HN ↗
My AI discovered this days ago when I wanted to deploy a new vibe coded website (it was to keep score while playing whist and rentz)
Thought it was very cool
smalltorch · 1789745817 · focus · HN ↗
If your a hobbiest or dev just testing your services, it makes more sense to utilize onion services imho.
It does the exact same thing, except supported by a global network of volunteers around the world.
Sure, you get some latency, but this is actually ideal for testing. You should know how your service operates in non optimal lightning fast conditions.
1. thenewnewguy · 1789746244 · focus · HN ↗
  I honestly can't tell if you're trolling or this is an HN out of touch moment.
  The obvious difference (and thus massive advantage) of the cloudfare product is that it is accessible over the normal internet without needing to install Tor.
  I'm sure that works for some subset of the population where all potential users are already comfortable using Tor; but imagine trying to share your PoC website with the designer/client and you are asking them to install Tor browser.
  1. smalltorch · 1789747027 · focus · HN ↗
    >hobbiest or dev just testing your services
    Is different than sharing your work with a client.
    I personally wouldnt make it SOP to utilize a complely free service like this to share my work. I'm not saying it's not convient, it definitely is.
    But you shouldn't subject a clients product to terms they probably aren't aware of.
himata4113 · 1789746170 · focus · HN ↗
This has existed for a long time and has been abused by quite a few people. I've seen some cc nodes using a random known cloudflare site and spoofing hostname to a temporary cloudflare site. IMO this should require a login at bare minimum.
1. booi · 1789748652 · focus · HN ↗
  if you think people won't abuse it because you're making them log in with a free email address...
  1. himata4113 · 1789748722 · focus · HN ↗
    This requires zero effort and you can deploy hundreds to thousands while maintaining 1000 gmail, proton etc takes resources and money.
    booi · 1789749834 · focus · HN ↗
    They already do this. the email accounts already exist
    himata4113 · 1789820626 · focus · HN ↗
    It's the same reason that exists for PoW captcha, it's just way more annoying. Also accounts offer traceability versus a new identity every time you want to do something unless you want to go through hundreds of accounts a day.
cute_boi · 1789746736 · focus · HN ↗
what a sloppy website, did cloudflare fired bunch of ui/ux designer? Every text is slop lol.
1. usewik · 1789749784 · focus · HN ↗
  yep, and all those fired and remaining are busy ai-native proofing their careers and tokenmaxxing everything including copy
2. cub-creature · 1789750213 · focus · HN ↗
  I swear if I see one more "pill-badge callout -> header -> subtitle" with gradient background and hover-cards landing page I'm going to crash out
  1. freakynit · 1789751917 · focus · HN ↗
    Kinda like this one? <a href="https://serverbox.stupidlabs.lol/" rel="nofollow">https://serverbox.stupidlabs.lol/ ( ⸝⸝´ ᵕ `⸝⸝)
xeornet · 1789746802 · focus · HN ↗
Looks like they straight up vibe coded the landing page lol.
1. rozab · 1789747166 · focus · HN ↗
  I find it quite shocking that orgs with some great designers like cloudflare are doing this. Broken layouts, trios of random uppercase words sprinkled around. It's crazy. How does it inspire confidence in a product, knowing that the landing page was created in 10 seconds?
  1. maipen · 1789753280 · focus · HN ↗
    AI took all the effort, so I guess nobody sees value in these little pages anymore. Not even those being paid. It's actually scary.
tombert · 1789746918 · focus · HN ↗
I like Cloudflare Tunnels a lot, but something that annoys me is that officially you're not allowed to use them for streaming video, meaning I can't put it in front of my Jellyfin without breaking TOS.
I think that rule is more of a "we reserve the right to..." rule, but it makes me sad because I'd rather not open up ports on my router to expose my Jellyfin to my parents.
1. TonyStr · 1789747421 · focus · HN ↗
  I discovered and set this up the other day, added jellyfin, immich and forgejo and was really happy about the result for five minutes, before I discovered that limitation in the TOS. Now I only use it for forgejo. Have you found a different solution to exposing jellyfin?
  1. tombert · 1789747845 · focus · HN ↗
    I have a proxy set up with the Oracle Always Free VMs they provide. It works well enough.
  2. madeforhnyo · 1789748024 · focus · HN ↗
    For free idk, I personally use a VPS (with unlimited traffic) and Tailscale. Someone has to pay for the public IP and proxy.
  3. guluarte · 1789750414 · focus · HN ↗
    i just use wireguard or tailscale, provision a subdomain with a custom ssl and resolve to a nat ip.
2. tamimio · 1789747997 · focus · HN ↗
  Use pangolin, been using it for a while and it’s great, under the hood it’s a vpn+reverse proxy which you can do yourself too. In pangolin you can have public or private resources, where private ones you need to authenticate through pangolin first (either pass or others like pin number for your parents so easy to remember). When you link your domain for public ones, I suggest you make a sub domain for it, so your apps will be a sub to your subdomain, that way you keep control of your main domain while having automatic assignment for your apps rather than manually, and if you didn’t issue a certificate, that sub.subdomain is basically invisible on the internet unless you host a service to expose it.
3. bityard · 1789748204 · focus · HN ↗
  Bandwidth costs money and streaming video costs several orders of magnitude more than just your random web/dev apps. Asking CF to foot the bill for entertainment streaming is really quite a lot.
  1. tombert · 1789748339 · focus · HN ↗
    I know. I'm not "upset" over it, just that it makes the service less useful for me.
4. mitxela · 1789774956 · focus · HN ↗
  You can put nginx with basic auth in front of jellyfin
rplnt · 1789746933 · focus · HN ↗
Are we in an age where no one even bothers to open the product pages they generate? The first subtitle with the font color almost matching the background. Or it's even worse that a human looked at it and said "yep, that's OK"?
1. reaperducer · 1789747043 · focus · HN ↗
  Are we in an age where no one even bothers to open the product pages they generate?
  We live in an age of monkey-see-monkey-do management.
  When Microsoft axed its QA team, it gave permission for everyone else to make the same stupid mistake.
  1. rvz · 1789758365 · focus · HN ↗
    We are in the age of where hype beats reasoning.
    pocksuppet · 1789843794 · focus · HN ↗
    Since before 2016 actually
2. lkbm · 1789747156 · focus · HN ↗
  It's fine on light mode. It's just the dark mode that's terrible. Seems likely they only tested the former.
  1. rplnt · 1789747600 · focus · HN ↗
    I see, good point. Some might be confused about my comment then.
  2. brazukadev · 1789759772 · focus · HN ↗
    which proves the point OP is making.
  3. Gigachad · 1789767979 · focus · HN ↗
    I'm viewing the site on lightmode, clicked one of the #links which scrolled down the page, when I scrolled back up all the sections lost their content and were unusable.
    I've never seen someone fail a static page like this. And from a huge company like Cloudflare too..
3. jeremyjh · 1789767143 · focus · HN ↗
  I find it shocking that they shipped this claudecopy.
  1. eranation · 1789774836 · focus · HN ↗
    I’m raising my eyebrows…
  2. brazukadev · 1789822343 · focus · HN ↗
    Cloudflare is going full vibecoding for at least one year. They are high on AI psychosis.
4. nake89 · 1789889837 · focus · HN ↗
  The thing that made me the most sad was that nobody cares about narrow screen phones like my iPhone SE
075326899532 · 1789746950 · focus · HN ↗
[ad]
israrkhan · 1789747129 · focus · HN ↗
For someone looking for an opensource solutions, following is an awesome resource for tunnelling
<a href="https://github.com/anderspitman/awesome-tunneling" rel="nofollow">https://github.com/anderspitman/awesome-tunneling
I have played around with frp, bore and ngrok.
1. drdexebtjl · 1789749325 · focus · HN ↗
  frp is nice. I have the tiniest Amazon Lightsail instance running a tunnel to a Minecraft server in my basement. It’s cheaper than getting a fixed IP from my ISP, at sufficiently low traffic.
damsta · 1789747248 · focus · HN ↗
The website looks broken in dark mode on Firefox.
ggg011012 · 1789747812 · focus · HN ↗
Quick Tunnels look great for demos and temporary dev environments. I’d still be hesitant to make them part of a long-lived production setup.
1. pstoll · 1789748437 · focus · HN ↗
  You should be more than hesitant - don’t do it. They literally market them for quick demos. And not long lived production.
2. rinconrex · 1789751621 · focus · HN ↗
  I use for the exact same thing. Running "cloudflared tunnel" sets up a temp solution. No log in needed, pretty convenient.
kelvinjps10 · 1789747878 · focus · HN ↗
What's the difference between this and their previous Cloudflare Tunnels solution?
1. raahelb · 1789748889 · focus · HN ↗
  From their docs [0]:
  > Free tunnels are meant to be used for testing and development, not for deploying a production website.
  [0: <a href="https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/#why-does-cloudflare-provide-this-service-for-free" rel="nofollow">https://developers.cloudflare.com/cloudflare-one/networks/co...
2. awwaiid · 1789757620 · focus · HN ↗
  As far as I can tell, the difference is that they made a new website? The cloudflared instant tunnels have been around for years, including json output as far as I know.
3. opengrass · 1789769850 · focus · HN ↗
  This gives a random trycloudflare.com subdomain each run, the other requires a domain and tunnel key on your account.
singpolyma3 · 1789748191 · focus · HN ↗
It looks like tunnels can do some non https stuff these days? But it's a bit unclear
AtNightWeCode · 1789748981 · focus · HN ↗
Cool but the obvious flaw with this is that CF leaks DNS-records. So bots will find these urls instantly. Not sure why they have not fixed that or if it is even possible to fix.
nullbyte · 1789749434 · focus · HN ↗
Love this, very cool.
I used to use a service called ngrok for this, but it's nice that Cloudflare is offering one now.
usewik · 1789749697 · focus · HN ↗
how long until someone's agent sets up a tunnel for the world to see one's most sensitive, private and embarrassing information or insecure work-in-progress app? granted, for the brew install some massive permissions are needed, so hopefully for those running their agent's in a sandbox, you should be safe.. should be..
frankcostanza · 1789749722 · focus · HN ↗
So... Cloudflare built Ngrok?
_pdp_ · 1789749835 · focus · HN ↗
It will be nice if it had persistent URLs and and SDK for desktop applications. It could solve a lot of small issues for a project I am currently busy with.
1. yodon · 1789750487 · focus · HN ↗
  That's handled by the prior versions of tunnels
2. srichard16 · 1789752106 · focus · HN ↗
  ngrok does this free, but with an account
3. cmacleod4 · 1789754801 · focus · HN ↗
  I've been running a couple of websites* on a home machine behind a Cloudflare tunnel for 2-3 years now. The only thing I had to pay for was the DNS registration. There are limits on the traffic you can serve on their free plan, but I'm nowhere near reaching those. I don't know what an SDK would add, you just set up a web server using whatever method suits you, then configure the cloudflared to connect to that. I did find that the online dashboard could not support all the options I wanted, so I switched to using the config file method - it would have been easier if I used that method from the start.
  One caveat - there is an option to inject Javascript into your pages for traffic measurement which is ON BY DEFAULT, you have to go to "Web Analytics" and turn this off if you don't want it!
  * <a href="https://cmacleod.me.uk" rel="nofollow">https://cmacleod.me.uk & <a href="https://newsgrouper.org" rel="nofollow">https://newsgrouper.org
TIPSIO · 1789750146 · focus · HN ↗
My wife and I have a mobile group/shared bot system where we can make mini apps and collab.
Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…
We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN.
Think shared Claude Artifacts that don’t live @ Anthropic.
Tried to first do this with Cloudflare Tunnels (because I love Cloudflare), but between the broken dashboard side of Zero Trust and nightmare of Warp… it was basically impossible to setup. I guess that’s all super enterprise, which seems to be very anti-Cloudflare philosophically to not be able to self do things.
Will check out Quick Tunnels but I think it’s missing the bigger integration offerings Tailscale has/does still.
1. noir_lord · 1789750344 · focus · HN ↗
  Only reason I have it (cloud flare tunnels) setup for personal use is because I had to do it for work and yeah, Enterprise(tm) is a good description, haven't touched it in years so when it breaks I'll likely use something else.
  Getting it to do what I wanted with a traefik front router with cloud flared talking to arbitrary subdomain that is spun up and broadcast from the other project side was very painful in a "this could be more friendly" way.
2. nemosaltat · 1789750571 · focus · HN ↗
  Us too, consider using your bots to migrate your tailnet to headscale. Daily driving Headscale + Headplane + Tailscale’s graciously provided/compatible native apps makes me feel like my devices are truly under my control.
  1. DaSHacka · 1789764737 · focus · HN ↗
    If only headscale supported tailnet lock and multiple control servers. They consider both features "enterprise" even though the former is arguably a bare minimum and the latter nice even for home users in the event their lab gets taken offline.
3. _blk · 1789750738 · focus · HN ↗
  So you have a phone to phone VPN and each runs services or just a regular rapid/synology at home with containers?
4. cbsks · 1789750823 · focus · HN ↗
  > My wife and I have a mobile group/shared bot system where we can make mini apps and collab.
  > Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…
  Can you elaborate on this? Sounds really cool!
  1. SwamyM · 1789752958 · focus · HN ↗
    Seconded.
    TIPSIO · 1789753883 · focus · HN ↗
    I was planning to open source the project @ oh0.ai but paused because of all the crazy developer hostile things Anthropic was/has been doing. I still might, ChatGPT is super good now as an agent. Anyone can also probably do this with OpenClaw or vibe code.
    The gist of it simple: Telegram (goated for AI, in-app web views, threads, groups, etc) + private network + clever architectural decisions.
    Example you load a skill it auto loads a CLI interface for the bot:
    - $ groceries add broccoli
    And also a rest API
    - POST /groceries/add/broccoli
    For the web views/apps (all private, family VPN only).
    U4E4 · 1789756157 · focus · HN ↗
    I’m not GP, but run something that’s pretty close to GPs description. It’s been a fun journey to set up.
    The core is chat+audio/video call server running locally on my m3 Mac Studio. Centrifugo has handled the chat concerns very well. LiveKit was a really nice foundation for video and audio calls. There are a few different options for local STT if you want that.
    I used RN via expo for the client and have my friends and family on TestFlight as beta testers. Utility over polish.
    With messages and call transcripts on my own box, I can prompt Claude code or Codex to operate on any message or transcript content. And follow up in chat with a message. I do most of that from Claude or ChatGPT mobile apps via remote control to my sessions running in the box.
    From there, if I give enough of a specc, anything that happens in chat or call transcripts can become an additional custom workspace in the main app. I think GP calls these mini apps. But they’re essentially rich clients under the main app umbrella. There’s other details, but yeah it’s a strange new world. Check my profile and reach out directly if you want.
  2. dizzard · 1789756734 · focus · HN ↗
    Not OP- I think there’s been some cool solutions popping up around hosting personal apps. On the front page this week was Capsule (<a href="https://withcapsule.app/" rel="nofollow">https://withcapsule.app/). My personal solution is Exhibit (<a href="https://github.com/momja/Exhibit" rel="nofollow">https://github.com/momja/Exhibit) which also has the goal of being a self-hostable artifact store.
  3. rambleraptor · 1789757107 · focus · HN ↗
    I’ve been building something similar with [Homestead](<a href="https://myhomestead.dev" rel="nofollow">https://myhomestead.dev). It’s my OSS solution for building mini apps. Each mini app is a Resct frontend and the backend (storage, auth, MCP, API, etc) just comes for free.
  4. ilusion · 1789791091 · focus · HN ↗
    I have my own solution here that also works for sharing stuff with clients with configurable whitelists at artifacts.iofold.com (also open-source for self hosting on cf workers for almost free, github linked on the homepage)
5. FridayCuriousit · 1789750854 · focus · HN ↗
  Interested in the the bot system and how your self publishing app artifacts that you've got running. Care to share more?
  1. U4E4 · 1789756880 · focus · HN ↗
    I run something similar, and in my system an app artifact is typically just a rich react component in a React Native client. They usually start as prototypes in chat, similar to what the labs provide in their native apps. If I or someone else in my user group wants more depth than a chat widget, then the artifacts can grow into a “workspace”. Oddly enough my richest workspaces have most been for entertainment. DnD, MtG deck building, HN comment thread parsing. And system management. Intrusion detection, feature life cycle/LLM handoff management, call telemetry. I do have a workspace for public county permit lookup which has been handy too. Reach out and I can share more.
6. theturtletalks · 1789751108 · focus · HN ↗
  Tailscale is truly a cheat code. I have a web app that I run locally to control terminals on my Mac. I access the website on my phone using the 100.xx IP address and can code on the go. No need for a Mac or iOS app.
  You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet. Be careful using Cloudflare tunnels because they are public and bots start poking around immediately.
  1. SparkyMcUnicorn · 1789754234 · focus · HN ↗
    > You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet
    For public access, similar to these cloudflare tunnels, there's Tailscale Funnel.
    <a href="https://tailscale.com/docs/features/tailscale-funnel" rel="nofollow">https://tailscale.com/docs/features/tailscale-funnel
    nacs · 1789755084 · focus · HN ↗
    Tailscale funnel works well but you can only have 1 per Tailscale instance (1 per machine) at the https endpoint so if you want to have a few apps, the others will go on non-https, custom-port URLs.
    riffic · 1789756430 · focus · HN ↗
    a reverse proxy service in front will help you route to multiple apps.
    fragmede · 1789756727 · focus · HN ↗
    [dead]
    MattCruikshank · 1789758365 · focus · HN ↗
    That's why I keep using tsnet directly, where you can have as many virtual machines, doing sharing or funneling, as you want to.
    The CLI doesn't let you do as much as the go library does.
    bakkoting · 1789760023 · focus · HN ↗
    You can set up paths that route to different local ports. As long as your apps don't need to live at the root path you can have as many as you like. And you can still have something on the root path as long as it doesn't need the subpath.
    Here's `tailscale funnel status` on my machine:
    $ tailscale funnel status # Funnel on: # - https://my-machine.tailXXXX.ts.net https://my-machine.tailXXXX.ts.net (Funnel on) |-- / proxy http://localhost:3000 |-- /foo proxy http://localhost:3001 |-- /bar proxy http://localhost:3002 |-- /baz proxy http://localhost:4004
    Natfan · 1789880923 · focus · HN ↗
    or just use a tailscale sidecar[0] in a docker container and give it any hostname you want
    [0]: <a href="https://tailscale.com/blog/docker-tailscale-guide" rel="nofollow">https://tailscale.com/blog/docker-tailscale-guide
    justinc8687 · 1789789700 · focus · HN ↗
    I have multiple funnels running at once. I just put a tailscale container into my compose stack and that way each compose stack gets its own tailscale instance and thus its own funnel. Happy to share the setup if at all interested.
    havnagiggle · 1789792844 · focus · HN ↗
    Reverse proxy to additional endpoints.
  2. 0x1ch · 1789754645 · focus · HN ↗
    Alternatively, Netbird has been a dream to use over the last half year or so. I think their server software has had some hiccups on new releases, but I stagger those updates anyways. All self hosted, similar concept to Tailscale, very good management UI baked into the self hosted product.
    garettmd · 1789756387 · focus · HN ↗
    Netbird's great. I've been using Pangolin (<a href="https://pangolin.net/">https://pangolin.net/) lately for my homelab. It's very similar in functionality to Netbird, but I like the UX of it better.
    0x1ch · 1789761215 · focus · HN ↗
    Also a very good alternative. I went on a spree and tried out all of the self hostable alternatives and this was definitely a runner up to netbird. The self hosted tailscale is also good, just not as polished as these two projects are.
    nickspacek · 1789783712 · focus · HN ↗
    Switched from Pangolin to Netbird recently and enjoy Netbird more!
    BOOSTERHIDROGEN · 1789790251 · focus · HN ↗
    Which features do you specifically benefit from?
    drcongo · 1789761080 · focus · HN ↗
    I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers - I wanted just the SSH features, with multiple users, but the paid tier up from free didn't include the SSH features.
    0x1ch · 1789761314 · focus · HN ↗
    I think Tailscale would've fit my needs perfectly fine, but the management makes access control and grouping dead simple in netbird. It also generates a nice little map of your peers, their groups, and connected nodes etc. Quick visual on your topology.
    allthetime · 1789786560 · focus · HN ↗
    What ssh features? You can have a hundred devices connected for free and they can all just ssh to each other directly
    drcongo · 1789906868 · focus · HN ↗
    With more than 3 users?
    drakenot · 1789784845 · focus · HN ↗
    For those who use Netbird or Pangolin, I'm trying to understand where it would come in handy over my Wireguard-Easy setup with my phone & laptops configured to connect to my Wireguard network externally.
    Is this primarily for multi-user scenarios or complex setups?
    usagisushi · 1789795633 · focus · HN ↗
    Both support multi-user setups with SSO or built-in auth.
    Beyond that, compared to a typical hub-and-spoke WireGuard setup, the main advantage is peer-to-peer connectivity. Clients connect directly to each other when possible, which lowers latency by bypassing a central relay.
    AFAIK, they also have different origins:
    Pangolin started as an internet-facing reverse proxy (Traefik) combined with a WireGuard server for backend nodes. It has gradually added VPN-like features, including client device access and an internal HTTPS proxy similar to Tailscale Serve.
    NetBird is a self-hostable Tailscale alternative that started as a mesh VPN focused on P2P traffic. It recently added its own reverse proxy features (Traefik-based, coincidentally), also similar to Tailscale Serve.
    Pangolin is centered on endpoint and ingress management, while NetBird focuses on mesh networking, though their feature sets are increasingly converging.
  3. _user_account · 1789757246 · focus · HN ↗
    just use wireguard; tailscale is just the SSO enterprise overlay with a pricing tab.
    herpdyderp · 1789757410 · focus · HN ↗
    I pay Tailscale nothing, why switch?
    titularcomment · 1789759429 · focus · HN ↗
    I think an important feature for homelabs is NAT traversal
    matthewmacleod · 1789759581 · focus · HN ↗
    No, it’s not. It handles the keys, provisioning, DNS, NAT traversal, and a bunch of other stuff. WireGuard is a great technology - Tailscale is like a usability layer on top of it.
    pocksuppet · 1789761328 · focus · HN ↗
    Wireguard is great for a point-to-point or multipoint VPN set up by a competent network administrator between machines with static addresses. But that's the only thing it does. It does not handle authentication or mobility very well.
    jallmann · 1789810487 · focus · HN ↗
    git : github :: wireguard : tailscale
  4. dlopes7 · 1789760493 · focus · HN ↗
    I use tailscale on my steam deck to play stardew valley with my son on my laptop, it truly is amazing
  5. girvo · 1789768918 · focus · HN ↗
    I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now
    tenuousemphasis · 1789775278 · focus · HN ↗
    Strange, battery use is negligible on Android, particularly when the tunnel is not in active use.
    eloisius · 1789775828 · focus · HN ↗
    I have the same experience and I once found a GitHub issue about it. I don’t think it sounded like they planned to fix it anytime soon. I just added the Tailscale toggle button to my phone’s quick control panel and turn it on whenever I want to check all my syncthing nodes or something. I keep meaning to see if I can script up something with Shortcuts to make it turn back off automatically.
    devilbunny · 1789783094 · focus · HN ↗
    Were you using an exit node? Because that really does hammer the battery, but vanilla TS without a bunch of traffic doesn't seem to do much to mine.
    The only always-on TS service on my phone is Immich for photo backup, and I don't take enough photos for that to matter much.
    aborsy · 1789784724 · focus · HN ↗
    You should compare battery consumption of TS exit node with something like WG app which low
    devilbunny · 1789793268 · focus · HN ↗
    WG gonna punch through NAT for me?
    My endpoint is a pretty stable (though technically dynamic) IPv4 on one end, but the other might be a cell phone with CGNAT, some random WiFi, blah blah etc. TS does that. If you don't want to use it, cool. Don't. I'm willing to make the tradeoffs to use TS for now. That could change in the future.
    yesb · 1789849126 · focus · HN ↗
    No but hole punching isn't really needed in that scenario. Open a port on the IPv4 side + dyanmic DNS. More than likely that is what tailscale is doing for you. Opening a port on that end w/UPnP. But can't argue with how simple it is with tailscale.
    devilbunny · 1789886280 · focus · HN ↗
    Yeah, I could do that, and it would work for most of the time, but TS does it for even the weird cases when I’m away from home and can’t play with it.
    girvo · 1789813529 · focus · HN ↗
    I wasn't, no. I'm not the only one whos hit it either, not sure what the cause is :(
  6. prtmnth · 1789778745 · focus · HN ↗
    Using Tailscale in exactly the same way. It has been such a blessing!
  7. timwis · 1789811167 · focus · HN ↗
    Fyi you can point a domain/subdomain (eg lan.mysite.com) at that 100.x IP and it will only work for those on your tailnet.
  8. peter_retief · 1789820646 · focus · HN ↗
    I use both (also Headscale)
  9. layerv-ai · 1790299546 · focus · HN ↗
    [dead]
7. roberttod · 1789758379 · focus · HN ↗
  Does this work with remote agents though? I want my claude.ai agents running on my phone to be able to hit my local MCPs on my Mac Mini - my understanding is that tailscale wouldn't work because the execution is being called remotely. But seems like these tunnels would support that.
  1. parthdesai · 1789759576 · focus · HN ↗
    if both your mac mini and your phone are on the same tailnet, can't you just ssh to your mac mini from your phone's terminal emulator and have claude code/codex run on it?
    wildzzz · 1789765113 · focus · HN ↗
    I just use /remote-control. You can't do everything from remote but it's was easier just opening the Claude app than using ssh. And I don't need to be on my tailnet either.
  2. threecheese · 1789760165 · focus · HN ↗
    If by local MCP you mean stdio, then a tailnet won't help you unless you proxy the local MCP using something like mcp-proxy: <a href="https://github.com/sparfenyuk/mcp-proxy" rel="nofollow">https://github.com/sparfenyuk/mcp-proxy . That local mcp is only exposed to apps on the machine.
    The flow is Phone client --> agent harness or whatev --> Tailnet --> Mac Mini --> mcp-proxy http listener --> local mcp. But you need to wrap the local mcp runner in the proxy (check the docs).
  3. dalberto · 1789764724 · focus · HN ↗
    I built something for this exact use-case using Cloudflare Tunnels:
    <a href="https://github.com/dalberto/mcp-ferry" rel="nofollow">https://github.com/dalberto/mcp-ferry
    I also use CF managed auth to make auth easier.
8. gopalv · 1789758641 · focus · HN ↗
  > it’s missing the bigger integration offerings Tailscale has/does still.
  Until I had tailscale serve generating valid certs, I had a good reason to use Cloudflare tunnels.
  But in general I don't want to put everything on the internet side of things.
  Mostly, I don't want something open, but more like a "share with" for people who are in the same office (virtually over tailnet, not physically on the same LAN).
  This still works great for a demo instead of a product pitch, to send an link out to see something.
  I'd still use a real host over a laptop for those.
9. unixhero · 1789762722 · focus · HN ↗
  That's really cool! I really want something like that. Care to share what your stack is? My wife would love having that super power.
10. nijave · 1789774111 · focus · HN ↗
  Don't think we had any issues with Warp but Cloudflare APIs are a bit of a mess. Seems like they've cobbled together and then renamed/rearranged things multiple times now and it's a bit hard to keep up.
  Terraform has worked decently well especially since there's a few random settings here and there that aren't exposed anywhere in the UI (facepalm)
11. ramoz · 1789780737 · focus · HN ↗
  > Think shared Claude Artifacts that don’t live @ Anthropic.
  Shameless plug, I've built a self-hosted capability here with things like live collaboration for humans and agents. There is a native cloudflare deplyoment and integration with Cloudflare Artifacts. PR for tunnel would be appreciated.
  <a href="https://github.com/plannotator/artifact-server" rel="nofollow">https://github.com/plannotator/artifact-server
12. gibs0ns · 1789782412 · focus · HN ↗
  I have really enjoyed the experience of OpenZiti for this purpose. Being able to host dark services and impose granular access controls and routing for different clients is a game changer.
  For the few services I host that require SSL (eg; WebUSB), I serve the dark service via a standard domain (example.com) so I can still get a LetsEncrypt cert, but public access to that domain resolves to a static page; "Plz connect to OpenZiti & try again". This allows me to have SSL on required dark services without requiring to install a private CA for each client.
13. allthetime · 1789786504 · focus · HN ↗
  I use public dns routed to private Tailscale ips for all my home services. If i want to expose something for friends who don’t use Tailscale I connect a cloudflare tunnel… it’s pretty much a couple clicks and typing in a subdomain name once cloudflared is running on a server… what were you having trouble with?
  1. pruneau · 1789787138 · focus · HN ↗
    I use NextDNS instead of public DNS to do the same thing.
14. fr2029 · 1789790670 · focus · HN ↗
  [dead]
15. ezst · 1789793760 · focus · HN ↗
  I would say that I've been doing most of that already with a reverse proxy+SSO/IDP for a very long time. Not the same, but close-enough and open to the "traditional internet" in a manner that does not require my users to install and configure tailscale, which is a massive plus. I do appreciate tailscale for the option to keep my effective host IP address hidden/local, but then I've been having a front on the internet (with a public IP/domain/...) for decades and I don't see a problem continuing.
16. pbreit · 1789795374 · focus · HN ↗
  How do I get this more persistent?
17. epolanski · 1789802117 · focus · HN ↗
  I never found cloudflare appealing for the small developer.
18. neop1x · 1789900472 · focus · HN ↗
  >> because I love Cloudflare
  Sad to read. Do people in China also love CCP and the Great Firewall? I know CF is more than just that MITM proxy as a service but that's their main product.
dbmikus · 1789750391 · focus · HN ↗
Now that is one vibe-coded website
afisxisto · 1789750439 · focus · HN ↗
I quite like pinggy for this. You don't need to install anything, since it uses a plain SSH tunnel.
ssh -p 443 -R0:localhost:9051 free.pinggy.io
(Free for 1h each session)
1. ghoshbishakh · 1789755149 · focus · HN ↗
  Thanks for sharing.
  - Co-founder of Pinggy.
2. mitxela · 1789774536 · focus · HN ↗
  You can also do this on any server you have:
  ssh -R 0.0.0.0:80:localhost:9051 myserver
  Make sure server sshd config has: GatewayPorts yes
scosman · 1789750445 · focus · HN ↗
The number of vibe coded apps accidentally hosted on dev laptops is about to explode.
corvad · 1789750482 · focus · HN ↗
This is not anything new they have been around since the tunnels project launched. What is more concerning is the AI slop webpage and just the "AI" centered relaunch of an existing product.
smetannik · 1789750760 · focus · HN ↗
So is this basically a ngrok from CF?
adamfeldman · 1789751092 · focus · HN ↗
Cloudflare doesn't really seem to care about their tunnel product. "cloudflared service install broken on macOS" since 2021: <a href="https://github.com/cloudflare/cloudflared/issues/327" rel="nofollow">https://github.com/cloudflare/cloudflared/issues/327
1. keeganpoppen · 1789753151 · focus · HN ↗
  yeah am i crazy or could it not like already do this as well? i swear i’ve seen somesuch similar in the cloudflared options. maybe not. but i can second having had some problems over the year getting cloudflared to install/set up correctly. tbf the actual feature works amazing once you get it working.
  1. robertlagrant · 1789756391 · focus · HN ↗
    As I understand it you can make a tunnel, but it's under a domain you control and it's a few clicks in the dashboard to set up, and then a something to run in CLI. That's what my homelab uses. This is just a single CLI command and the whole thing is set up.
2. st3fan · 1789758047 · focus · HN ↗
  Huh I brew installed it and got a working tunnel in like 15 seconds.
  1. lysace · 1789766130 · focus · HN ↗
    Install via brew worked. Getting the hostname to resolve took 30 mins of waiting. Have they heard of wildcard DNS?
    judge2020 · 1789773183 · focus · HN ↗
    Cloudflare isn't going to wildcard every domain on their platform just to cure stale cache DNS issues.
    lysace · 1789785363 · focus · HN ↗
    That wasn’t the ask though.
    The product is falsely advertised as is:
    "Cloudflare Quick Tunnels"
    This is on one (or two) particular domain(s) where setting up wildcard DNS should be relatively trivial, if they actually cared enough about the UX of this product to make a special case in their code.
    I don't understand how people can launch stuff like this.
    inemesitaffia · 1789828766 · focus · HN ↗
    Works on someone's computer.
    It's "free". That's all you need to understand.
    st3fan · 1789850977 · focus · HN ↗
    I don’t understand what you are complaining about. Do you think there is an actual bug?
rock_artist · 1789751305 · focus · HN ↗
What's surprised, just earlier of seeing this today I've let Codex write a minor PR for simple webapp. so it needs HTTPS for some secured context.
While testing it locally Codex by itself suggests using CF Tunnels but what's more interesting it actually used the Quick Tunnels.
Coming from days where I get warnings of vibe-coded generated code using deprecated code or older APIs, I must say using something so fresh is quite impressive.
1. awwaiid · 1789757466 · focus · HN ↗
  As far as I know this has been a provided feature of cloudflare for several years. I don't understand why it was posted today.
everybodyknows · 1789751314 · focus · HN ↗
[delayed]
rinconrex · 1789751442 · focus · HN ↗
Oh I use this for testing and demos between my phone and computer. Ngrok is fine, probably better off using Tailscale, but it's very easy to just run a quick tunnel with "cloudflared tunnel --url localhost:XXXX".
spprashant · 1789751721 · focus · HN ↗
Off-topic: That web page looks exactly like my vibe-coded utilities.
freakynit · 1789751807 · focus · HN ↗
Just tried.. not working.
superkuh · 1789751811 · focus · HN ↗
Cloudflare's only goal here is to put themselves between everyone and charge a toll. They are running a protection racket where they themselves are causing much of the damage they offer protection from. This is another example.
bilater · 1789751812 · focus · HN ↗
So this is basically ngrok?
bitlad · 1789751827 · focus · HN ↗
So it is ngrok 10 years later?
skhameneh · 1789752110 · focus · HN ↗
There's a number of comments already about how this page looks vibe coded, I'd add that I'm actually shocked at how much this looks like the output of a one-shot prompt. It's not so much that an LLM was used, but a callout on just how generic this page is. How much iteration went into this? At surface it looks like nearly no iteration.
Edit: Well, they just re-vibed it. Went from the most generic Claude 4.6 era to today’s models, quality wise. I wish I had saved a copy of the original, because it would have taken me actual solid effort to make a page that generic out of an LLM.
1. PufPufPuf · 1789752761 · focus · HN ↗
  Group of three cards, each with a left-aligned icon, heading and subheading stacked -- that's the m-dash of web design.
2. vlyan · 1789752862 · focus · HN ↗
  I'll take that over corporate memphis of the previous decade.
  (idk if it's really declining or I simply haven't noticed it in a while)
3. ruuda · 1789762930 · focus · HN ↗
  "Traffic rides Cloudflare's network" Oh, hello Claude.
  1. hackernud3s · 1789773081 · focus · HN ↗
    How would you say that? I can't think of a clearer way to say it TBH.
    jofzar · 1789780852 · focus · HN ↗
    "Traffic routes via Cloudflare's network"?
    hackernud3s · 1789783086 · focus · HN ↗
    It routes from closest PoP to visitor -> closest PoP to origin. Your way doesn't convey that as clearly IMHO.
    tefkah · 1789813363 · focus · HN ↗
    Claude has a habit of always talking in an overly active voice, sort of personifying subjects that feels off. I don't think many people would choose to say "Traffic rides" here.
4. ttul · 1789834598 · focus · HN ↗
  I’m not sure your comment is load-bearing enough…
infogulch · 1789752316 · focus · HN ↗
I made my own tunnel system with a $5/mo vps that runs kernel wireguard and accepts my nas' public key. Once connected it DNATs 80/443 traffic down the tunnel to the nas, where its routed to caddy.
The vps runs a custom image that is 2.54 Megabytes. It has a custom kernel with almost everything but networking and wireguard disabled, a fixed-size fs with pre-allocated blocks and inodes to hold the vps wireguard key, and a single pid 1 binary that calls the kernel directly to set up the routing rules, generate a new wireguard key on first boot and save it to the fs, print out the wireguard public key to the console, and loops reap. Updating involves building and uploading a new image, assigning the vps to use it, reboot, wait for the public key in the console then set it on the nas so they can talk.
1. RedCinnabar · 1789757749 · focus · HN ↗
  Very cool, do you use some an atomic distro like nix or something entirely self built using Yocto/Buildroot? I do something similar with a simple SSH tunnel and a NFT rule. Though, I don’t need your kind of ephemeral setup and so I just use Debian.
  1. infogulch · 1789778132 · focus · HN ↗
    Thanks! The build system is nix, but the result is more of an appliance than a distro. Updates are rebuild-redeploy with the provider API; it can't update itself. The filesystem is a fixed-size image (even omitting resize2fs, so no growing onto the VPS disk), and it remounts read-only after boot. The boot log is 270 kernel lines then 4 userspace: 1 nftables loaded, 2 printing the gate's wg0 public key, 1 remounting ro.
2. cyberamirul · 1789801063 · focus · HN ↗
  Self hosting might win on control, but it’s harder to manage so I went managed (CF Tunnel). Edge terminates TLS, my Caddy only speaks HTTP, nothing to cert renew (unless you cerbot, but that’s not a guarantee if Let’s encrypt is down).
general_reveal · 1789752430 · focus · HN ↗
Could we turn this into p2p cloud hosting for all?
1. mitxela · 1789775031 · focus · HN ↗
  No, by definition it's not P2P because it's all going through Cloudflare.
maipen · 1789753176 · focus · HN ↗
I'm sorry to be offtopic, but this website looks like an hallucination generated by chatgpt 4.
This type of quality downgrade is scary, and it's everywhere now.
rkovashikawa · 1789753563 · focus · HN ↗
cloudflare rocks
mgw · 1789753766 · focus · HN ↗
Can anyone elaborate on what's new? This exact product has existed from Cloudflare for years. Is it just that they added a new marketing site for it?
1. 6thbit · 1789755366 · focus · HN ↗
  "quick" tunnels you can make by installing cloudflare software and running a command, without a cloudflare account, using a fixed "trycloudflare.com" domain and not your own domain.
  existing (slow) tunnels you can create once you've set up your own domain for cloudflare to manage its DNS, installing cloudflare software, logging in to your account, and running a similar command.
  edit: my bad, quick ones aren't new at all
  1. misnome · 1789755664 · focus · HN ↗
    This has been the behaviour when you launch but don’t connect a specific tunnel for at least a couple of years
  2. mmoustafa · 1789757209 · focus · HN ↗
    Quick tunnels have existed since at least 2022 (when I was using them)
2. mmoustafa · 1789757290 · focus · HN ↗
  Nothing is new, quick tunnels were launched in 2021
  <a href="https://blog.cloudflare.com/quick-tunnels-anytime-anywhere/" rel="nofollow">https://blog.cloudflare.com/quick-tunnels-anytime-anywhere/
rcarmo · 1789754467 · focus · HN ↗
I want this with TOTP or passkeys. Just giving me a hostname doesn't cut it these days.
partloyaldemon · 1789755474 · focus · HN ↗
Tailscale is one of the most profoundly useful technologies I’ve ever used as small business person. It’s also one I would have never thought to invent despite feeling its lack daily.
ghoshbishakh · 1789755768 · focus · HN ↗
This is a very good solution for HTTP(S) tunneling - which is the most frequently needed tunnel. However if you want to play a game, or use SSH, then Pinggy tunnels are very simple to use. One command:
ssh -p 443 -R0:localhost:443 tcp@free.pinggy.io
Disclosure: Co-founder of pinggy.io here.
Edit: I meant TCP tunnels, UDP tunnels, or also TLS tunnels for end-to-end encryption.
1. tonymet · 1789756649 · focus · HN ↗
  i love this! never understood why a proxy app was needed
  1. fragmede · 1789757011 · focus · HN ↗
    So you don't know my IP, and because of NAT.
    tonymet · 1789758556 · focus · HN ↗
    any app will connect with an IP am I missing something . a socket is exactly (IP, port) (src, target) tuple
    c0wb0yc0d3r · 1789760298 · focus · HN ↗
    For me, it’s as much about ease of use as much as it is about minimizing attack surface area.
    Also the lifetime I need the connection open. For something quick, ssh tunnel. For something normies use, reverse proxy. Ain’t trying to teach my parents about IP addresses and port numbers.
    tonymet · 1789766718 · focus · HN ↗
    tredre3 explained it above
    tredre3 · 1789761249 · focus · HN ↗
    I think tonymet meant he didn't understand why cloudflare didn't allow using ssh -R instead of cloudflared to create the tunnel, not not using a tunnel at all.
    tonymet · 1789766694 · focus · HN ↗
    precisely (thanks!)
    judge2020 · 1789773672 · focus · HN ↗
    cloudflared is a bit unique in that it makes multiple outbound connections to CF DCs to do the tunneling and fails over if a DC has an issue (or, more likely, when a DC is near-capacity and they need to divert lower-tier traffic away from it[0]). SSH would reintroduce a single point of failure to this.
    Also, the _main_ use case of `cloudflared` tunneling is using it as a long-term way to host production websites on your own hostname. the ability to create ad-hoc tunnels is more of a gimmick / advertising opportunity.
    0: <a href="https://github.com/judge2020/cloudflare-connectivity-test/wiki/Explanation" rel="nofollow">https://github.com/judge2020/cloudflare-connectivity-test/wi...
2. caymanjim · 1789758119 · focus · HN ↗
  What kind of usage limits?
  1. ghoshbishakh · 1789758900 · focus · HN ↗
    A free session runs for 60 seconds after which it has to be restarted and the address changes.
    You can get the address with an API call.. but we charge for convenience. Pays the infra bills.
    ghoshbishakh · 1789797479 · focus · HN ↗
    *60 minutes
3. gpugreg · 1789841675 · focus · HN ↗
  When running this ssh command in qterminal, I can not click on the URL because it refreshes faster than I can right-click and click on "Open Link". Do I have to type the URL by hand or is there a workaround?
yuchi · 1789755885 · focus · HN ↗
I still remember when ngrok came out. The experience was more or less the same.
It’s interesting that 10 (more?) years later the product has not evolved and, apparently, hasn’t found a way to finance itself without removing the pure free tunneling option.
vansh_sethi_vs · 1789756571 · focus · HN ↗
[dead]
sparc24 · 1789756944 · focus · HN ↗
Worst marketing ever. ngrok had a similar slogan:
something like - "We help you put localhost on the Internet."
What could possibly go wrong?
1. m00x · 1789757162 · focus · HN ↗
  How many ways can you convey doing the same thing? All the banks out there have almost identical slogans because they do very similar things.
2. hashstring · 1789757444 · focus · HN ↗
  Hm, yeah, depends who you’re marketing this to.
  Also, the “0 ports opened” marketing is misleading. It still binds to a port and then also lets people access your resources over it.
  I dislike that Cloudflare Engineering has become more… marketingy as of late. Also with their Cloudflare OS misnomer. Their products used to make more sense, what happened?
  1. mitxela · 1789774638 · focus · HN ↗
    Marketing is meant to be misleading. That's how it works.
    hashstring · 1789812135 · focus · HN ↗
    No, marketing is about communicating valuable offers.
    Misleading communication is what I am describing, that is a subset of all communications.
_user_account · 1789757162 · focus · HN ↗
The main use case: cloud harnesses to access your local network; I highly recommend to run the harness in your local network instead, then you own the session, no tunnel needed.
The other use case for webhooks is ok, but is exactly what ngrok already does since forever with a pretty high free quota.
1. derefr · 1789757946 · focus · HN ↗
  Is that really the main use-case you expect this to solve for in practice?
  What about the use-case of hosting a persistent "full-fat" web application on a computer that lives in your house (when your residential ISP drops inbound traffic to ports 80/443 of your gateway's public IP, so you can't just do it "the normal way")?
  This is explicitly the use-case that `tailscale funnel` (which is basically the same feature) puts front-and-center in its own documentation: <a href="https://tailscale.com/docs/features/tailscale-funnel" rel="nofollow">https://tailscale.com/docs/features/tailscale-funnel
  (I suppose that if Cloudflare really wanted to offer first-class support for that use-case, Cloudflare DNS would let you point an arbitrary subdomain at a Quick Tunnel, the same way you can point an arbitrary subdomain at a Worker. Though, of course, you could do that today by having a Worker proxy requests to a Quick Tunnel... it'd just have billable costs that a Quick Tunnel alone wouldn't.)
rvz · 1789757568 · focus · HN ↗
Seems like the quality of software engineering is now going to zero and just vibe coding unstable alternatives since 2023.
nickgray · 1789757746 · focus · HN ↗
This is cool. I like it! Also Cloudflare design has stepped up so much over the past 2 years.
emadabdulrahim · 1789758823 · focus · HN ↗
Does this make working with agents in cloud more interesting? Maybe now I can see my changes right away without waiting for the build and deploy? By running the dev server and tunneling from the sandbox giving me a direct url access somehow?
Can someone chime in here?
blocke · 1789759594 · focus · HN ↗
Ah yes. We can't let self hosted app traffic flow across the Internet in a way that escapes the vast Internet surveillance system run by the Americans called Cloudflare.
Hmm, Tailscale is too convenient and that traffic is going dark from Cloudflare's all seeing eye. Quick... The all seeing Five Eyes needs to convince people to use their compromised version instead!
pocksuppet · 1789761240 · focus · HN ↗
This is obviously vibe written, and I can't wait to see how quickly it will be shut down after someone uses it in combination with Mullvad to host child pornography.
Mullvad already turned off port forwarding because people were using it to host child pornography.
1. throawayonthe · 1789761337 · focus · HN ↗
  they've been running the tunnels service for years
  and they also provide web hosting..
  1. kalcode · 1789761531 · focus · HN ↗
    It's the AI witch-hunt these days. Salam trails coming soon to you're nearest artist! "That's AI!!!"
    Sigh... HN littered with it these days.
inconshreveable · 1789762845 · focus · HN ↗
hi y'all, ngrok creator/founder here.
we removed anonymous usage of our product many years ago because it was far and away the largest source of abuse on our entire platform.
i believe at this point that that anonymous, account-less tunneling services like this are net negative for the security of the internet
happy to answer any questions from the community
1. jeremyjh · 1789767282 · focus · HN ↗
  Would you ever ship a product where all the ad copy was written by an AI and read by no one?
2. Gigachad · 1789768212 · focus · HN ↗
  The marketing from Cloudflare around this being for agents feels like the intended use case is for agents to exfiltrate data off your laptop without pesky hurdles like asking the user to set up an account first.
3. opengrass · 1789769080 · focus · HN ↗
  It's not a security issue, it's a liability issue for you.
4. mitxela · 1789774419 · focus · HN ↗
  I'd expect an anonymous inbound tunnel to be better than an anonymous outbound proxy and we have plenty of the latter.
tobih · 1789765156 · focus · HN ↗
json output is nice, my agents always had to parse the text output before
opengrass · 1789765449 · focus · HN ↗
This is my docker compose for sharing files with randoms online <a href="https://pastebin.com/raw/cYV7ksw9" rel="nofollow">https://pastebin.com/raw/cYV7ksw9
Don't pass -d, your tunnel URL prints in the console and you can download dirs as tarball.
saejox · 1789766347 · focus · HN ↗
Needs to support tcp and udp
dzonga · 1789766594 · focus · HN ↗
I have been considering using my other laptop as a place to run my agents in production since 1. my laptop is more powerful than the vps I can rent for cheap.
then just use Cloudflare tunnels to connect to the laptop.
cryptolobster · 1789766671 · focus · HN ↗
For small-scale personal or family applications serving just a few users, does it make sense to choose Quick Tunnels over Tailscale or Pangolin?
jdthedisciple · 1789767797 · focus · HN ↗
Interesting but what a horribly vibe coded website that barely works on mobile
1. Gigachad · 1789767905 · focus · HN ↗
  It's broken on desktop too...
girvo · 1789768754 · focus · HN ↗
This is super neat! I rely on normal Cloudflare Tunnels for my self-hosted website/web apps, works shockingly well all things considered.
JeremyJaydan · 1789769441 · focus · HN ↗
I used Cloudflared tunnels for a while in production, they worked very well but the config was a bit of a pain sometimes. It's nice to see a simpler version even if it's just for testing.
narmiouh · 1789770119 · focus · HN ↗
I'm not sure how safe this is...
vibe coded app with may be no security and now available from the internet for anyone to RCE into my laptop?
dools · 1789770432 · focus · HN ↗
I’ve been using cloudflare tunnels quite a bit in places where I would have traditionally gone for a reverse port forward and they’re working really well. The quick tunnel concept seems really great but the non-quick tunnels are also very useful and can be entirely automated.
noname120 · 1789771298 · focus · HN ↗
Cloudflare Quick Tunnels have existed for more than 5 years (yes, including the anonymous quick tunnels). I copy-pasted the url of the HN link in archive.org, see for yourself: <a href="https://web.archive.org/web/20211202005430/http://try.cloudflare.com/" rel="nofollow">https://web.archive.org/web/20211202005430/http://try.cloudf...
Is a new vibe-coded landing page for a 5-year old product really worthy of being on the front page nowadays? There should at least be a [2021] in the title.
1. malfist · 1789771810 · focus · HN ↗
  I did not know about them and I have a good use for them today. So I found it useful though I agree it needs the date disclaimer
  1. ckvibubueu · 1789859381 · focus · HN ↗
    Web page can't even render on mobile properly
2. nijave · 1789774215 · focus · HN ↗
  Didn't these used to be called Argo Tunnels a long time ago? I think Argo Tunnels got repositioned for connecting to origin servers without needing an incoming connection to the origin but I thought they originally did something like this/ngrok
  Yeah, I just checked the page >can connect their server to the Internet with Argo Tunnel for free
  1. wbl · 1789835107 · focus · HN ↗
    There was a problem with the name: toxic mine trailings weren't what was wanted. <a href="https://en.wikipedia.org/wiki/Argo_Tunnel" rel="nofollow">https://en.wikipedia.org/wiki/Argo_Tunnel
3. jofzar · 1789780736 · focus · HN ↗
  5 years ago imo it was less relevant, if you showed me this then I would be like "cool tech, but other then a specific scenario, why would I care"
  1. stingraycharles · 1789795872 · focus · HN ↗
    Why is it more relevant today?
4. makingstuffs · 1789807250 · focus · HN ↗
  I saw the post and was literally thinking "I have been using these tunnels extensively for a couple years now"
  1. fjbarrett · 1789842347 · focus · HN ↗
    There are at least 57 alternatives to this exact tool from independent developers. Not one of them seems like it'd be safe.
5. kqp · 1789811826 · focus · HN ↗
  Why do you think it’s vibe coded? Just asking to see if I can learn something. I can see it’s very standard corpo-aesthetic, uses callouts for the sake of callouts, and is horribly laggy, but corpo websites were doing all that long before AI. It also seems to be using a bunch of Cloudflare-specific terminology that I’d think would take longer to review and correct an AI on than to type yourself.
  1. tefkah · 1789813122 · focus · HN ↗
    Other than the general vibe, there's a number of extremely specific Claude-isms you could pick up on:
    1. the blinking "now with JSON output for coding agents". It loves to create these blinking badges
    2. "Some text, and then <Text in a different color>"
    Then further along the page, the "Your agent needs a URL, not a laptop" has a lot of tells of just being a straight Claude (design) output
    - The small all-caps "built for the agent era" eyebrow. Once you start noticing this it's EVERYWHERE
    - The 01 02 03 list
    If you have access to Claude you should try have it generate a landing page for a tech product. It will almost always look like this.
    rgoulter · 1789826505 · focus · HN ↗
    The punch and profound-sounding phrasing is also Claude; but pre-LLM it might make sense for a marketing page.
    "Your laptop stays private. The URL goes everywhere."
    A URL ... goes, does it?
    I've seen it pointed out (& have noticed) that anthorpomorphising like this is an LLM smell.
    In this case, although "URL goes" can be valid, it's just awkward here.
    tylerhou · 1789858525 · focus · HN ↗
    [delayed]
    kqp · 1789886956 · focus · HN ↗
    Thanks! I have indeed used Claude only for text, not websites, so wasn’t familiar with the visual clues.
  2. efortis · 1789821462 · focus · HN ↗
    One tell is: if you can code that hero there's no excuse for the silly bugs.
    For example, the hero is fairly impressive in mobile but it's broken in desktop. And then you scroll down to the next section and there's overflowing text.
    IOW, the skill level is inconsistent.
6. peter_retief · 1789820536 · focus · HN ↗
  Yet so many developers do not know about it.
7. hypercube33 · 1789826691 · focus · HN ↗
  They are useful for taking local llm models and delivering them with HTTPS to harnesses that expect it or to another machine. Other than that I'm not sure what I'd personally use them for.
ouch-blurred52 · 1789772735 · focus · HN ↗
[dead]
greyhound1 · 1789773556 · focus · HN ↗
i find it hard to read any text when the site has many animations that can't be stopped
nojvek · 1789779445 · focus · HN ↗
I so hate codex speak.
nyxtom · 1789779924 · focus · HN ↗
I've used these tunnels all the time when I wasn't at my computer. Insanely helpful when doing agentic work on the go
mintflow · 1789780690 · focus · HN ↗
perhaps this is the most easy to use networking product that ever shipped, but given ngrok did this many years before, maybe they just think for the agentic era? though one must take care for the authentification
I also think it seems cloudflare enter into a stage keep adding products but generally because it's not public company we do not know how it goes
Do you still remember cloudflare mesh and use and stick to it?
reddec · 1789785612 · focus · HN ↗
I have been developing for my own use something like that but self hosted. There are other solutions, but this one simple, reliable and secure in a way I see it.
Originally didn't want to share but here it is <a href="https://github.com/reddec/tunnel-me" rel="nofollow">https://github.com/reddec/tunnel-me
UI: fully LLM assisted (not vibe coded, but guided with a lot of iterations). Backend: hand written, but before release polished via LLM. Docs: me - input, LLM - output.
The things I am proud:
- it very reliable
- its single binary with reasonable defaults and low memory usage
- SSO out of the box (cause I am using pocketid in my homelab)
- very simple backend
Nevin1901 · 1789786068 · focus · HN ↗
Cloudflare tunnels are really useful when dealing with webhooks. Way better than Ngrok and you can set it up on a custom subdomain you own. eg: site.yourdomain.com
1. zahidrasool · 1789966467 · focus · HN ↗
  [dead]
geroge_kyaw · 1789793579 · focus · HN ↗
Lol Codex UI!!!
shmde · 1789794396 · focus · HN ↗
I have used this extensively previously when I had to quickly share a UI prototype with my Product manager. There used to be all sorts of cors error when I also had a backend. Then I realised its just better to make a branch and deploy it in amplify and add the cors origin in the backend. But its good for quick UI sharing
cliftonc · 1789794432 · focus · HN ↗
I use this a lot, but find it a bit hard to manage if you want a persistent tunnel locally to use for dev (e.g. webhooks etc), so I added a wrapper around it that you can easily use: <a href="https://github.com/cliftonc/cfld" rel="nofollow">https://github.com/cliftonc/cfld
itvision · 1789801755 · focus · HN ↗
The RAM pricing crisis is doing wonders to the software industry. Amazing.
cbsmith · 1789808661 · focus · HN ↗
[delayed]
shiftnotes · 1789814515 · focus · HN ↗
[dead]
apolloswave · 1789815612 · focus · HN ↗
[dead]
peter_retief · 1789820483 · focus · HN ↗
I have been using CF tunnels for quite some time, very useful if you want to ingest mail on a local server without a public IP and hosting anything locally.
They are providing this for free up to a point, I wonder if all developers are aware of this amazing offering?
adamch · 1789829120 · focus · HN ↗
Lovely to see Cloudflare Tunnel frontpage on HN. Working on Tunnel was the highlight of my career. It was a fun product with a lot of bugs to fix, features to add, architecture to design. We were all working in-person, solving incidents together, getting lunch together every day. Taught me so many important skills that have helped me in every other project I've ever worked on.
abalashov · 1789829340 · focus · HN ↗
Ah, an ngrok competitor. It's what we elderly (~40 myself), yelling-at-clouds types call "reverse SSH tunnels", but this is an anachronism from the era of knowing how to do things rather than paying for managed SaaS products to do them. Don't mind me, just yelling at clouds...
appleappleapple · 1789875066 · focus · HN ↗
Lol this landing page looks almost exactly like something my company just put out. Holy AI
AlisaYoki · 1789876917 · focus · HN ↗
[dead]
whydoineedthis · 1790091545 · focus · HN ↗
If you want to host your own version of this in AWS, automated with terraform, you can use <a href="https://github.com/nelsonenzo/tolocal" rel="nofollow">https://github.com/nelsonenzo/tolocal
It uses basic auth at the edge to protect the endpoint being used by anyone. The technical advantage to self hosting is bandwidth throughput. For instance, If your using a css framework that is bulky on dev, but then minimized for prod, you will often find the ngrok/cloudflare tunnels too slow to load the local host assets.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.