Ditching the VPN and port forwarding the selfhosted way
For folks that are unable to port forward on the local router (eg CGNAT) I made this post on doing it via a VPS. I've scoured the internet and didn't find a complete guide.
You're viewing a single thread.
another option is to use Cloudflare's tunnels. it's free, I use it all the time. really great.
I've set up some tunnels. Works nice but then the voices came. 'Why would you trust a company like Cloudflare with all your data?' 'Why rely on this one company for all your services?'
Nearly a year into my selfhosting journey and I'm more confused than ever.
tl;dr: classic convenience/privacy. depends on your threat model. surely better than Google. models of zero trust will help.
That's a great question, that I have asked myself before too. It doesn't have one answer, and any one would make their own choices based on their own respective threat model. I'll answer you with some of my thoughts, and why I do use their services.
I'll take as an example my usage of NextCloud, coming as a replacement to Google Drive for example.
let's break up the setups:
It's oversimplified, but to the point: In Google's setup, you have control of 0 out of three things.
In NextCloud's setup,
From just this look, NC is clearly better off. now, it's not perfect, and each one will do their own convenience vs privacy deal and decide their deal.
If you deploy some sort of e2ee, the severity level of CF drops even more, because they're exposed to less data. specifically for NC they do do e2ee, but each solution to its own. https://nextcloud.com/encryption/ this goes as an example for zero trust model. if you handle the encryption yourself (like using an e2ee service), you don't have to trust the medium your data is going through. like the open internet.
Thanks. I agree with your conclusion. I probably have spent too much time in privacy communities. In the end you'll have to trust someone.
that's not to wear off of the importance of awareness. you should be aware always, even if you don't take action.
surely better than Google
This contradicts your threat model comment, though. If you fear Google's access to your data, you fear nation states, or hate Google. Cloudflare is in the same boat for size, scope, and US ownership.
Obviously I'm not avoiding it all together, but I'm taking a step in the right direction.
And it's not just replacing Google by CF, because CF has much less access in comparison as I explain.
you can deploy some zero trust models in your setup, and eliminate the threat even further. for example end to end encryption
Oh yes, wasn't trying to say it was a bad decision at all. If it fits your threat model, and it makes life easier, it's probably the right choice.
Yeah it's a popular choice for various things. But wouldn't it be against TOS using it for p2p and that amount of traffic?
gotta admit I haven't read the ToS, but I didn't encounter any problems. I'm streaming GBs of music via the tunnel and it still works. p2p I didn't try, but I don't really see a reason to?
Just remember that Cloudflare decrypts and re-encrypts all your data, so they can read absolutely everything that passes through those tunnels.
mind elaborating?
If I let them handle the TLS for me then I can see that. but if, for example, I'm using NextCloud, which implement end to end encryption from client to server, then I wouldn't care if they did, no?
Huh, good to know. I'm out remember some of us have traffic in the TBs pretty month!