Figro Posted October 18, 2022 Share Posted October 18, 2022 (edited) I have created a discord server for those interested in getting support that way: https://discord.gg/q32QQFf5gs Unraid-Cloudflared-Tunnel  The only thing needed to get the container up and running is the token from Coudflare's zero trust dashboard under Acess > Tunnels. Once you create a tunnel you will be given your token. The token will look similar to the string of text seen below.  eyJhIjoiNjAwNGU3OTkxMDUzZjc1ZDNkY2e5MWMyZmI5MTViNDMiLCJ0IjoiZDgwZZZmZGUtOTQ3ZS00MWRhLWJmYzgtZmQzZGJmMmNmOTg1IiwiCyI6Ik1TWm1NR1JtWWpBdFlqSXlaQzAWWVRVNExUbGhaV1F0WXpsallqZzNOEEEzTmpoaiJ9  Leave a message on this thread or send a message on Discord and I will support you as well as I can when I get the chance.  Cloudflared Docs: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/ https://hub.docker.com/r/cloudflare/cloudflared https://github.com/cloudflare/cloudflared  Github: https://github.com/AriaGomes/Unraid-Cloudflared-Tunnel DockerHub: https://hub.docker.com/r/figro/unraid-cloudflared-tunnel Discord: https://discord.gg/q32QQFf5gs  Flood-UI  Dont use `:dev` for regular use. Installing the `:latest` container and setting a port should be all you need to do. You should be able to then link an instance using the webUI on the port you are using with the container.  Source code building is available with the :dev branch:  Setup the appdata path and change the port (if needed). Will take a couple minutes to spin up. Check the logs and you should see when its up and running. You can mess around with the files for the app in the configured path as you can with Leon-AI. Check the bolded portion in Leon-AI above. Those instructions can be replicated to do development work on this container as well.  The entire configuration is done once the server is up and running and you can add your torrent client instance and view and manipulate your client using flood-ui. Please let me know if you run into any issues and I will do my best to assist  Flood Docs: https://github.com/jesec/flood/wiki  Github: https://github.com/AriaGomes/Flood-UI DockerHub: https://hub.docker.com/r/figro/flood-ui Discord: https://discord.gg/q32QQFf5gs Edited March 31 by Figro Removed Ory-Kratos Added discord Server 1 Quote Link to comment
Omri Posted October 22, 2022 Share Posted October 22, 2022 (edited) Hi, Thanks for this container, it's seems to work great and very easy   Edited October 22, 2022 by Omri 1 Quote Link to comment
Figro Posted October 22, 2022 Author Share Posted October 22, 2022 9 hours ago, Omri said: Hi, Thanks for this container, it's seems to work great and very easy    No problem, Glad it was useful to other people 1 Quote Link to comment
Omri Posted October 23, 2022 Share Posted October 23, 2022 Hi Just a little question (which isn't directly connected to your project) when I set (public hostname) *.mydomain.com to (service) https://swag:443 it's working only if I check "No TLS Verify" mydomain.com has a wildcard certificate by let's encrypt (which obviously isn't being used while using cloudflare proxy/tunnel) my local host/ip (swag/192.168.X.X) doesn't have a certificate (do I need one? and if so, how to issue one?) Thanks in advance  Quote Link to comment
Figro Posted October 23, 2022 Author Share Posted October 23, 2022 (edited) 18 minutes ago, Omri said: Hi Just a little question (which isn't directly connected to your project) when I set (public hostname) *.mydomain.com to (service) https://swag:443 it's working only if I check "No TLS Verify" mydomain.com has a wildcard certificate by let's encrypt (which obviously isn't being used while using cloudflare proxy/tunnel) my local host/ip (swag/192.168.X.X) doesn't have a certificate (do I need one? and if so, how to issue one?) Thanks in advance   Hello, While I have not done this myself, I belive this can be done a couple of ways through cloudflares domain managment dashboard. You can create or download existing certs as shown in the screenshot below and you can use these instead of the lets encrypt certs.  If you prefer to use the letsencrypt certs I believe you can also upload them to cloudflare, however it looks like this is a paid feature under cloudflare. (screenshot below) You can also turn off SSL completly from cloudflare's side and only use letsencrpt however this will be globally across all subdomains (Not sure if thats what you are looking for) The way I use the tunnel is by adding them without SSL with a HTTP connection and once you access through the subdomain cloudflare will encrpyt the connection via HTTPS with their certs. Hope this was helpful and if you have any more questions or need to clear anything up let me know Edited October 23, 2022 by Figro 1 Quote Link to comment
ryry Posted October 23, 2022 Share Posted October 23, 2022 I'm assuming to get the token you go to setup docker tunnel in cloudflared first?  The next step is a bunch of inputs. Apologies, but although I've gotten this working with a tunnel to my home assistant VM, I'm lost when it comes to setting this stuff correctly.  Quote Link to comment
ryry Posted October 23, 2022 Share Posted October 23, 2022 I got it working - in case it helps anyone else: -the subdomain is what you want it to be to access publicly, domain is the selected path. -the type can be http then the url to access your unraid instance locally (assumed static IP) e.g. 192.168.2.32 Quote Link to comment
Figro Posted October 23, 2022 Author Share Posted October 23, 2022 1 minute ago, ryry said: I got it working - in case it helps anyone else: -the subdomain is what you want it to be to access publicly, domain is the selected path. -the type can be http then the url to access your unraid instance locally (assumed static IP) e.g. 192.168.2.32 Â Glad you got it working just going to leave this here for other having issues finding their tokens. The token can be found in the blurred out portion in the second screenshot. You will need to get rid of the other text and make sure to only copy your token. It looks similar to the text in the first forum post here. Â Quote Link to comment
WizP Posted October 24, 2022 Share Posted October 24, 2022 I have a question... As I'm behind a double NAT CGNAT config, I was want to set up a tunnel so that I can access by home LAN remotely on the road. Â Has anyone been successful in getting this to work? I can access the tunnel OK using my android mobile and the WARP 1.1.1.1 app, but can't seem to access any of my LAN servers/resources using the 192.168.0.1 IP address range. Â Any pointer would be appreciate. (I have already the 192.168.0.0 arrange range routed in the Cloudlfare dashboard.) Quote Link to comment
Figro Posted October 24, 2022 Author Share Posted October 24, 2022 2 hours ago, WizP said: I have a question... As I'm behind a double NAT CGNAT config, I was want to set up a tunnel so that I can access by home LAN remotely on the road.  Has anyone been successful in getting this to work? I can access the tunnel OK using my android mobile and the WARP 1.1.1.1 app, but can't seem to access any of my LAN servers/resources using the 192.168.0.1 IP address range.  Any pointer would be appreciate. (I have already the 192.168.0.0 arrange range routed in the Cloudlfare dashboard.) I wasn't aware this was something that could be achieved with the WARP client. As such I do not know much about this however I found this documentation explaining that you have to change a setting under split tunnels to include instead of exclude and configure your IP's. Not sure this helps or not but I will leave the link for that below. Feel free to update with any information and progress made as I find this feature quite interesting. Currently I use Unraid's Wireguard VPN to achieve that. I wish you luck and hope there are others that may be able to better answer this.  Documentation: https://developers.cloudflare.com/cloudflare-one/tutorials/warp-to-tunnel/#route-private-ip-ranges-through-warp Quote Link to comment
WizP Posted October 24, 2022 Share Posted October 24, 2022 48 minutes ago, Figro said: I wasn't aware this was something that could be achieved with the WARP client. As such I do not know much about this however I found this documentation explaining that you have to change a setting under split tunnels to include instead of exclude and configure your IP's. Not sure this helps or not but I will leave the link for that below. Feel free to update with any information and progress made as I find this feature quite interesting. Currently I use Unraid's Wireguard VPN to achieve that. I wish you luck and hope there are others that may be able to better answer this.  Documentation: https://developers.cloudflare.com/cloudflare-one/tutorials/warp-to-tunnel/#route-private-ip-ranges-through-warp I also used to use wireguard to connect into Unraid, but with the double CGNAT, and not IP6 I can't use that any more... But thanks for the help Quote Link to comment
Omri Posted October 24, 2022 Share Posted October 24, 2022 3 hours ago, WizP said: I have a question... As I'm behind a double NAT CGNAT config, I was want to set up a tunnel so that I can access by home LAN remotely on the road. Â Has anyone been successful in getting this to work? I can access the tunnel OK using my android mobile and the WARP 1.1.1.1 app, but can't seem to access any of my LAN servers/resources using the 192.168.0.1 IP address range. Â Any pointer would be appreciate. (I have already the 192.168.0.0 arrange range routed in the Cloudlfare dashboard.) have you enabled "Host access to custom networks:" in docker settings? Â Quote Link to comment
WizP Posted October 25, 2022 Share Posted October 25, 2022 2 hours ago, Omri said: have you enabled "Host access to custom networks:" in docker settings?  Had a look at this and doesn't look like that's the problem. Quote Link to comment
migueldias Posted October 25, 2022 Share Posted October 25, 2022 (edited) Hi @Figro, thank you for making this. I had this setup and it was working perfectly until a few hours ago. Now it's not loading the webpages at all.  I can still access the dockers locally, I didn't change anything on Cloudflare. The tunnel shows up as 'Active' and tunnel docker is up.  I restarted the docker and the logs now show what I've attached. But it still doesn't connect. They show some errors but I've really only noticed I couldn't connect a couple of hours ago. Any ideas?   edit: Update. I can access the public hostnames fine outside of my home network. Still trying to figure it out.  edit2: So it seems I can't access the Cloudflare IPs of my tunnel endpoint from my home network. If I use my mobile connection, I am able to. I can't even ping. edit3: the IPs of the tunnel rotated and my DNS (Google) had stale entries. Updated to CF's DNS. Edited October 25, 2022 by migueldias Quote Link to comment
Figro Posted October 25, 2022 Author Share Posted October 25, 2022 1 hour ago, migueldias said: Hi @Figro, thank you for making this. I had this setup and it was working perfectly until a few hours ago. Now it's not loading the webpages at all.  I can still access the dockers locally, I didn't change anything on Cloudflare. The tunnel shows up as 'Active' and tunnel docker is up.  I restarted the docker and the logs now show what I've attached. But it still doesn't connect. They show some errors but I've really only noticed I couldn't connect a couple of hours ago. Any ideas?   edit: Update. I can access the public hostnames fine outside of my home network. Still trying to figure it out.  edit2: So it seems I can't access the Cloudflare IPs of my tunnel endpoint from my home network. If I use my mobile connection, I am able to. I can't even ping. edit3: the IPs of the tunnel rotated and my DNS (Google) had stale entries. Updated to CF's DNS. Hello, Thanks for updating your post and sharing. Did the third edit fix your issue? Quote Link to comment
WizP Posted October 26, 2022 Share Posted October 26, 2022 On 10/24/2022 at 6:28 PM, WizP said: I also used to use wireguard to connect into Unraid, but with the double CGNAT, and not IP6 I can't use that any more... But thanks for the help OK guys, I got this working... I can now access my home SERVERS/lan which is being the CGNAT. Everything is accessible, just like it was with wireguard...  I just needed to remove my home IP subnet range from the exclude list in the cloudflare zerotrust dashboard.  Hooe this helps other people... It would be great to have something like this built directly into Unraid, but am happy with the docker for now. Quote Link to comment
Slippin' Jimmy Posted October 26, 2022 Share Posted October 26, 2022 I've just had an issue of all my websites going down, with an error of; You've requested a page on a website *** that is on the Cloudflare network. The host *** is configured as an Argo Tunnel, and Cloudflare is currently unable to resolve it.  When I checked the logs I got the following; cloudflared has been updated to version 2022.10.3 ** Press ANY KEY to close this window **  I had to restart the docker, and they all popped back online. Is there an issue wiith cloudflared updating within the docker, and bringing it down? And requiring a docker restart to resolve it. 1 Quote Link to comment
birdsofprey02 Posted October 26, 2022 Share Posted October 26, 2022 I walked through this a few times and maybe the simplicity of the container has obscured something important to me. If I want this to point to one specific container ie. Nginx proxy manager and I made the service https://npm:443 then and my subdomain like: blah.mydomain.net then that would make it so everytime I was on the internet, I could hit my nginx proxy manager by going to blah.mydomain.net? All of my NPM services are set to service1.mydomain.net or service2.mydomain.net, etc. (using internal DNS);  How do I lock this down so that I can only access some of the services in the nginx proxy? Do I need to create ACLs in Nginx? I want granularity on what the tunnel can access inside the network/host.  Also, with my example above, what URL do I use to access a service... If I go to blah.mydomain.net how will Nginx know where I really want to go? Would I instead need to be attempting to hit service1.blah.mydomain.net? I'm fuzzy on the DNS internally here. Quote Link to comment
Figro Posted October 26, 2022 Author Share Posted October 26, 2022 6 hours ago, jmmrly said: I've just had an issue of all my websites going down, with an error of; You've requested a page on a website *** that is on the Cloudflare network. The host *** is configured as an Argo Tunnel, and Cloudflare is currently unable to resolve it.  When I checked the logs I got the following; cloudflared has been updated to version 2022.10.3 ** Press ANY KEY to close this window **  I had to restart the docker, and they all popped back online. Is there an issue wiith cloudflared updating within the docker, and bringing it down? And requiring a docker restart to resolve it. This shouldn't happen unless cloudflared itself updates itself when theres a new version available while running. The container only checks for a new version at startup. If you are able to find anything regarding the cloudflared software updates itself while running I'll take a look into that and release an update. I have not run into this myself but if there is a pattern of this please feel free to update here Quote Link to comment
Slippin' Jimmy Posted October 26, 2022 Share Posted October 26, 2022 3 minutes ago, Figro said: This shouldn't happen unless cloudflared itself updates itself when theres a new version available while running. The container only checks for a new version at startup. If you are able to find anything regarding the cloudflared software updates itself while running I'll take a look into that and release an update. I have not run into this myself but if there is a pattern of this please feel free to update here I do think it auto updated whilst it was running from what the logs showed. You can add a switch to stop the auto updating, not sure if this can be used in this docker? `cloudflared tunnel --no-autoupdate` I'll let you know if it happens again. Quote Link to comment
Figro Posted October 26, 2022 Author Share Posted October 26, 2022 6 hours ago, birdsofprey02 said: I walked through this a few times and maybe the simplicity of the container has obscured something important to me. If I want this to point to one specific container ie. Nginx proxy manager and I made the service https://npm:443 then and my subdomain like: blah.mydomain.net then that would make it so everytime I was on the internet, I could hit my nginx proxy manager by going to blah.mydomain.net? All of my NPM services are set to service1.mydomain.net or service2.mydomain.net, etc. (using internal DNS);  How do I lock this down so that I can only access some of the services in the nginx proxy? Do I need to create ACLs in Nginx? I want granularity on what the tunnel can access inside the network/host.  Also, with my example above, what URL do I use to access a service... If I go to blah.mydomain.net how will Nginx know where I really want to go? Would I instead need to be attempting to hit service1.blah.mydomain.net? I'm fuzzy on the DNS internally here. I believe you would want to look into the cloudflare dashboard for what you are looking for. Under the tunnel you should be able to configure public hostnames and point them to an IP. I've never tried with another domain but I think that will work as well. There is alot of options under the cloudflare dashboard. Check above at @ryry's post for a little explination on that Quote Link to comment
Figro Posted October 26, 2022 Author Share Posted October 26, 2022 Just now, jmmrly said: I do think it auto updated whilst it was running from what the logs showed. You can add a switch to stop the auto updating, not sure if this can be used in this docker? `cloudflared tunnel --no-autoupdate` I'll let you know if it happens again. Yea I can add this to the container. Look for an update in an hour or so 2 Quote Link to comment
Figro Posted October 26, 2022 Author Share Posted October 26, 2022 6 hours ago, birdsofprey02 said: I walked through this a few times and maybe the simplicity of the container has obscured something important to me. If I want this to point to one specific container ie. Nginx proxy manager and I made the service https://npm:443 then and my subdomain like: blah.mydomain.net then that would make it so everytime I was on the internet, I could hit my nginx proxy manager by going to blah.mydomain.net? All of my NPM services are set to service1.mydomain.net or service2.mydomain.net, etc. (using internal DNS);  How do I lock this down so that I can only access some of the services in the nginx proxy? Do I need to create ACLs in Nginx? I want granularity on what the tunnel can access inside the network/host.  Also, with my example above, what URL do I use to access a service... If I go to blah.mydomain.net how will Nginx know where I really want to go? Would I instead need to be attempting to hit service1.blah.mydomain.net? I'm fuzzy on the DNS internally here. If the dashboard doesnt have what you are looking for I would recommend using the offical cloudflared docker container where you would be able to attach to the container and run the configuration commands you are looking to run.  https://hub.docker.com/r/cloudflare/cloudflared Quote Link to comment
migueldias Posted October 26, 2022 Share Posted October 26, 2022 (edited) 22 hours ago, Figro said: Hello, Thanks for updating your post and sharing. Did the third edit fix your issue? It did! Thank you!  1 hour ago, Figro said: Yea I can add this to the container. Look for an update in an hour or so Thank you. Will update once you push it. I had the exact same thing happen to me as @jmmrly where the tunnel auto-updated :). Edited October 26, 2022 by migueldias 1 Quote Link to comment
Slippin' Jimmy Posted October 27, 2022 Share Posted October 27, 2022 (edited) On 10/26/2022 at 3:00 AM, WizP said: OK guys, I got this working... I can now access my home SERVERS/lan which is being the CGNAT. Everything is accessible, just like it was with wireguard...  I just needed to remove my home IP subnet range from the exclude list in the cloudflare zerotrust dashboard.  Hooe this helps other people... It would be great to have something like this built directly into Unraid, but am happy with the docker for now.  I've tried removing my home IP subnet range, and also enabling 'Host access to custom networks' under docker settings but I still can't access my local devices through the WARP app. Edited October 27, 2022 by jmmrly Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.