VPN service for hosting public-facing services on non-hosting ISP circuits

https://holepunch.io/

by voidmain0001 • 7 years ago

63 46 7 years ago

holepunch.io

giancarlostoro• 7 years ago

Nice but be careful when doing this sorta thing at work that you dont compromise company policy.

diminoten• 7 years ago

Oh jesus don't do this at work without permission!

leetbulb• 7 years ago

It might just be me, but I feel like this is going to be abused...badly. I know of a few other similar services that have had huge abuse issues.

geocrasher• 7 years ago

Yeah, the very first thing I thought of was along the lines of "Oh, so this is how attackers will compromise a machine and run http://my-favorite-bank.com.holepunch.io/login-and-give-me-a... on a compromised computer."

I do see the benefit of the service, but I think it would be cool if they offered a self-hosted version. A LowEndBox for $20/year gets you a box and an IP to tunnel through.

jlogsdon• 7 years ago

I am using a free tier instance in GCP and using tinc to accomplish exactly this. It's not "click and play" but setting it up is simple. If I ever outgrow the f1-micro its easy enough to add another node with a public IP.

It has the added benefit of being a full-on VPN, though I don't generally use it for regular internet browsing.

fulafel4• 7 years ago

Well, this is working around externally imposed lack of internet connecivity after all. It might be called abuse by your local Mordac^Wperson disagreeing with you about risk assessments. You may want to try getting your net fixed, as an alternative to this proxying.

sandov• 7 years ago

I'll try to use this for SSH.

What's the best way to embed an SSH session inside of HTTP requests?

fulafel4• 7 years ago

stunnel?

graton• 7 years ago

Usually you can just port forward a port above 1024 on your router to port 22 (SSH) on your computer inside your home network. This has worked for me for the ISPs I have used.

cbluth• 7 years ago

https://github.com/jpillora/chisel

vinay_ys2• 7 years ago

It seems to be using ssh to tunnel your http connection in the first place. So, if ssh is blocked in your network, this won't work.

lohszvu2• 7 years ago

That's not how networking works. Incoming connections are usually blocked which is what this is for. It punches a hole through your firewall by using an established ssh tunnel to forward traffic over. You don't need to allow incoming anything to use this service

iamnothere• 7 years ago

Running SSH as a Tor service might be easier if you're confident in the security of your SSH setup. (Key authentication is highly recommended for any public-facing SSH setup.)

https://www.howtoforge.com/anonymous-ssh-sessions-with-tor

fulafel4• 7 years ago

This might actually be the future of running net-accessible stuff on your own devices, if the NAT-imposed unreachability continues to cement itself as the default expectation for people. Great that they have a free tier.

Though I think you can do this same thing with many existing tunnel providers too, no?

sdwisely2• 7 years ago

This might actually be the future of running net-accessible stuff on your own devices

I sure hope not, demand ipv6.

fulafel4• 7 years ago

Yes, this kind of proxying is the plan D.

altfredd• 7 years ago

Possession of an IPv6 address does not automatically imply that your ISP allows incoming connection to your ports.

thinkmassive• 7 years ago

Tor is another helpful tool for working around NAT.

steve_taylor• 7 years ago

How does this compare with ngrok?

old-gregg• 7 years ago

Why don't you find out and tell us?

stedaniels• 7 years ago

The website looks good. Obviously early days since pricing is missing. Probably sorting out value proposition, how much they can get away with charging, etc.

A comparative point is using Cloudflare and Argo tunnel which I'm currently using.

Tepix2• 7 years ago

If you are technically capable to set it up by yourself using OpenVPN, you can get a dirt cheap VPS with one IPv4 address for less than $1/month ($12/year). lowendtalk.com is a community that discusses these deals.

dannyw• 7 years ago

My experiences have been that these businesses generally disappear after a few months and leave you holding the bag, with a service disruption and data loss.

Recommendations for any “low end box” that’s about $12 a year and not a fly by night scam would be appreciated.

vinay_ys2• 7 years ago

Looking through the https://github.com/CypherpunkArmory/punch/blob/master/tunnel... seems to indicate it is just using a ssh connection between your box and their server and then forwarding traffic through that ssh connection.

If ssh is blocked by your IT admin, this will not work. In that sense this isn't doing any holepunching. In a more traditional definition of holepunching it meant to establish connection between two machines behind NAT stateful firewall and neither have static public IP addresses.

Also, looking at the code, there seems to not much emphasis on security w.r.t ssh host key verification or bootstrapping the chain of trust with pre-verified credentials etc. Weird choices for a project with cypherpunk in it's name.

prater• 7 years ago

Author here. You're right. The project is still in beta - so we're still working on ironing out some of the kinks. The host key verification issue is being worked on today actually. I'm not sure what you mean by "bootstrapping the chain of trust with pre-verified credentials" though. If you want to open an issue on https://github.com/CypherpunkArmory/holepunch we'd love to get your feedback about how we can improve security prior to a general release.

CodeWriter23• 7 years ago

Typo: “With our low cost, secure tunneling service, you won't run out __or__ reasons or ways to use it.“

mirimir2• 7 years ago

Another option is algo using wireguard with port forwarding.

https://github.com/trailofbits/algo

syntonym• 7 years ago

I'm really confused why this creates an IPsec server AND an wireguard server, or do I read that wrong? Managing two server which basically do the same thing seems to double the attack surface without any gains. One selling point of wireguard is to be an easier but still as least as secure alternative to IPsec.

mirimir2• 7 years ago

I've only used it once. As I recall, you can install IKEv2 or WireGuard. Or both.

ubercow13• 7 years ago

It is so that you can use the same VPN server with devices which support wireguard and which only support IPsec.

random45345• 7 years ago

Remind me of http://pagekite.net It has been around for a few years, their software is open source and seems pretty easy to use. Never used it myself though so I cannot vouch for their stability.

EugeneOZ• 7 years ago

Never shut down your computer and pay electricity bills. Don't reboot too often. And hope your provider will never have outages.

I know, some people have always-on computers, some people have low prices for electricity, some don't care about downtimes. But it all looks so fragile, too many "if".

If only there would be some layer to cover main instance outages...

ronsor• 7 years ago

There's also Serveo[0] which I use pretty often:

[0] https://serveo.net

Ttlequals0• 7 years ago

This is an option to build on demand disposable openvpn endpoints on AWS https://github.com/ttlequals0/autovpn

peter_d_sherman• 7 years ago

Looks like a service many people could use -- I wish you the best of luck in your business endeavor!

One thing I'd like to see though is an "About Us" page, if you're a company; or maybe a link to your LinkedIn profile if you're an individual...

Reason: I'd like to know more about the company or person that I'd be dealing with before establishing a business relationship... I'm sure I'm not alone, either.

Anyway, best of luck with your venture!

VPN service for hosting public-facing services on non-hosting ISP circuits

Related Stories