Well, I’ve been thinking about Cloudflare Tunnel for a while, and last week I figured it was time. Honestly, it doesn’t feel quite right, but hey, what does nowadays? Things change, and so should we.
Back in the day, we didn’t have firewalls, NAT, or DDoS protection- just connect your machine directly to the net and go. I still remember when all this changed. I put unpatched Windows machines on the net and soon after got infected – man, what a time that was.
Nowadays, a firewall is standard, NAT is a must, and if you want to run your own web server, well… you better keep your eyes on it all the time, and even that is probably a bad idea. I used to run a few things on the server, but gradually decided to reduce the surface area to avoid trouble. Finally, I ended up with only HTTP/HTTPS, and even that I moved behind the Cloudflare proxy and locked down the router to accept connections only from Cloudflare IPs.
Considering the present and future, where zero-day exploits start taking off hours after discovery, perhaps it is prudent to add yet another layer of defence and move behind Cloudflare Tunnel. While it will not prevent everything under the sun- hello, WordPress vulnerability – it is just another layer of protection.
So, what are the upshots of the tunnel? There are a few:
- no more DDNS
- no more configuring NAT
- no longer at the mercy of your ISP if it blocks ports 80/443 or gives you a private WAN address
- no need to configure the firewall to allow or block direct connections
- easy to move – connect and go, with no special configuration
What makes the deal pretty sweet is the $0 cost and how easy it is to set up Cloudflare tunnelling. The cherry on top is the ability to retain and run a reverse proxy if you want to have public and private services – local LAN only – or in case you decide to go back to the old ways.
Like I mentioned above, I don’t think sticking a reverse proxy on the internet is such a good idea nowadays, but in case I want to move away from Cloudflare, well, not much needs to be done since all the routing is still handled by the reverse proxy.
In any case, that’s the present, and I don’t expect a reversal in the near future… unless AI fixes all the code and we live happily ever after.