cantankerous_cashew

joined 1 year ago
 

I've been using Cloudflare tunnels in my homelab. I'm wondering how well they resist subdomain discovery/enumeration by bots/malicious actors. I’m aware that security through obscurity isn’t a real strategy, but I am curious about this from a purely academic standpoint. Aside from brute force guessing, are there any other strategies that could be used to find the subdomains of services tunneled through cloudflare?

gluetun bundles a control server on port 8000 which you can query for the port number (don't worry about openvpn being in the url path, it still works with Wireguard). In my bash script (running on the host system), I use curl to retrieve the forwarded port number and then do a POST with that data to the API of my qbt client which is running in another container on port 8080.

There’s a reason why most providers don’t allow that feature anymore

Yes, cheese pizza

It’s said that port forwarding is a security risk

Says who? Assuming a fully patched system/client and a properly configured firewall/network, I'd love to hear more about these "risks".

Also, qBitTorrent works just fine without it.

Only if you don't care about seeding

[–] cantankerous_cashew@lemmy.world 7 points 5 months ago (5 children)

Based. I use gluetun with qbt and ProtonVPN (with port forwarding). Despite this being a tricky config, it was still pretty easy to setup. Can share bash scripts if anyone is interested.

I’m personally a big fan of bore. It’s easy to setup/use and there’s a free public instance operated by the developer.

Here's a link to the PR for anyone who's interested

Faster downloads (sometimes significantly), easier to connect to seeders.

[–] cantankerous_cashew@lemmy.world 3 points 10 months ago

This. I switched over to protonvpn, but I’d switch back in a heartbeat if Mullvad re-enables port forwarding.