I’ve migrated from cloudflare pages to cloudflare tunnels as I wanted to do a little bit more.
I can’t segregate my network as my ISPs router is rather limited, which means no vLANs. Connecting another router would introduce a double nat as they don’t allow bridging. So I’m running my website basically “raw” in a hyperV virtual machine. the website is semi-static and made out of flatfiles, therefore it’s is quite impossible to login into it. as stated before i’m using cloudflare tunnels to expose a nginx server to the interner. what are the chances someone or something (bot) inflataring my network? 100% safety is not possible but how safe am i?
Run your hosting inside a docker container. If someone were to hack you they, in theory, would only have access to whatever is in that container and not your entire server. Someone with more expertise please feel free to correct me if I’m wrong. I am not an expert in this, just offering what I (think I) know.
Exactly. Even if they make it into your network (which would be somewhat unlikely already, since CF obfuscates your home IP), as long as you don’t run your docker containers in “privileged” mode (or give the containers RW access to important directories on your server), you’d be fine except for the most end-of-world scenarios.
If you keep up to date with all the vulnerabilities for the software you use you should be generally pretty safe.
Do you have any auth in cloudflare? If so, that mitigates a lot of zero-days. First they have to get past cloudflare, then a zero-day in your nginx.
no auth as personal blog is supposed to be public and accessible to everyone.
however, until i can have more control of my internal network, i moved back to a vps :)
Meh. Safeish. Until one of your servers has a zero day.
Everything has some sort of vulnerability, the qestion is will someone be assed to abuse it.(rheotical question)
Not so much will someone be assed about it, it’s whether a script will pick you up your server. There’s a ton of aggregation search engines that scan most IPv4 addresses and list them on what ports are open etc. such as Shodan.io
Like I said, safeish.
As far as i understood it a cloudflare tunneled service should not be visible when port scanning. Or am i completely wrong here? I started using tunnels just so i can avoid opening ports to the internet. I also restricted the access to my services to specific countries.
You can’t get rid of the ISP router? Can you contact your ISP to put the router into bridge mode?