I finally understand Cloudflare Zero Trust tunnels

But is this vendor-lockin, as in CloudFlare being the vendor here? Because at least with Tailscale there's no vendor lock-in.

what's the difference between this and a reverse SSH tunnel, for example making a local port on your laptop accessible to a public-facing internet server or even running on localhost on that same server... or using sshuttle to access your local network from a remote server

I stopped reading at "everything goes through the Cloudflare network, no direct p2p"

https://github.com/alecbcs/hyprspace has penetrated every NAT I've ever encountered. No megacorporation required.

I've experimented with Cloudflare tunnels before to sit in front of my Immich instance in my homelab. Only issue is the 100MB upload size for videos. But Immich added upload chunking support to their roadmap so its possible this will work very well in the future.

Don't ISPs now provide ipv6 addresses? Why not just connect directly home via ipv6 address. I think many ISPs in Asia where ipv4 addresses are scarce have been moving to MAP-e, which is ipv6 centric.

I don't see why I want to loop in a 3rd party to connect back to my house.

I'm using Netbird [0] for my home / private needs: - Synology NAS - All the laptops and desktops my family uses - All family mobile phones

Given i work in Tmux, its super convenient to take a laptop with me and just use it as a thin client to my Desktop wherever I am.

[0] https://netbird.io/

Thanks a lot. Both the post itself and the comments are very useful. Can't really comment on the content at this post; but the images in the article seem to be broken — produce 404 errors. Like this one: https://david.coffee/targets-config-screen.png

Big fan of Cloudflare Tunnel here, too.

We use our Windows workstations as WSL SSH tunnels, protected with email verification (only for our domain), and it’s been working perfectly.

I’m curious, though, about how we can expose Docker services. It would be fantastic to have a remote build server set up with Cloudflare Tunnel.

Oh man, someone has to talk about this!! Cory told me about CF's gold issues and it really does seem problematic to me, I'm glad ZT is finally being criticised.

With that it becomes clear that some service is self hosted (the DNS record points to a private IP). It can be a security issue when the Whois record or the domain name allows the identification of the hosting entity. Finding its physical address can be an easy task depending on its social presence.

Then probably the hosting place is an easier target than a data center.