I’ve seen a post on here before about Cloudflare tunnels being unsafe for exposing your locally hosted services to the web which I totally get.
However I’m a bit of a noob with complex VPN set ups and I tried to get Wireguard working in Docker but couldn’t. I got a tunnel configured and exchanged all the peer keys and things but I think my initial networking docker-compose stack was incorrect possibly. Also the windows client for it is a bit ugly but that’s by the by.
I’ve also used Tailscale in the past which is great but it feels like a temporary solution to me as you still have to remember ports and things (there may be a way around that if I remember correctly but I’d rather stay away from Tailscale. I prefer having control myself or through my domain name - probably illogical I know).
Instead I decided to try to protect the Cloudflare tunnel to my home network and I’ve made a policy in Cloudflare Access that won’t let you in without emailing you a code (only my email address works) and having you enter it. I’d also rather adjust that to my 2FA app but I can’t seem to get that to work here.
My question is: is that secure enough? And if not, what would you all suggest as an alternative (preferably an alternative that is pretty easy and means I can use my domain name)?
How exactly are Cloudflare tunnels “unsafe”? And what makes you think VPNs are a better option?
I’ve used CF quite a lot and the major downside is that you have to have decent authn/authz on at least one end of your tunnel but CF does not necessarily provide this. VPNs provide authn but not necessarily authz depending on the setup. In either case, how you set up and manage identities and credentials is key.
The best way to achieve this depends entirely on what applications you are exposing and what options they give you for identity management.