Alternatives to CloudFlare?

What is your objective for ‘hide server IP’?

Privacy to disconnect your identity from the service? There is no solution to this. Full stop. Even with Tor, the state backed acronym entities will figure it out if you get on their radar.

If your objective is to keep your service online, you’re going to be hard pressed to find cost effective alternatives… Commercial solutions are expensive, like, “if you have to ask about the price, you can’t afford it” expensive.

Alternatively, you can try to roll your own by having many many proxy servers yourself… but if you’ve got a target on your back, you’ll never have enough instances; DDOS-as-a-Service is much cheaper than the amount of reverse proxies required to keep your service online.

There’s probably other use cases, but chances are, you’d still be hard pressed to find a solution that’s cost effective.

Sucuri?

Akamai?

Kinda depends on what's going on, price point, etc. is this for DDOS purposes?

You do not need a CDN, but you have users. So, is this for like, a Plex server, serving friends in a similar geographic region?

What's the use case? That will greatly help us answer.

@[email protected] ,

Step 1: get a cheap VPS, or even a free one (https://www.oracle.com/cloud/free/)

Step 2: If you've a static IP at home great, if you don't get a dynamic DNS from https://freedns.afraid.org/ or https://www.duckdns.org/

Step 3: Install nginx on the VPS and configure it as reverse proxy to your home address. Something like this:

server {
    listen 80;
    server_name example.org; # your real domain name you want people to use to access your website
    location / {
        proxy_pass http://home-dynamic-dns.freeprovider... # replace with your home server IP or Dynamic DNS.
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_redirect off;
    }
}

Step 4: Point your A record of example.org to your VPS.

Step 5: there's a potential security issue with this option: https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from and to get around this you can do the following on the home server nginx config:

http {
(...)
        real_ip_header    X-Real-IP;
        set_real_ip_from  x.x.x.x; # Replace with the VPS IP address.
}

This will make sure only the VPS is allowed to override the real IP of the client.

Step 6: Once your setup works you may increase your security by using SSL / disabling plain HTTP setup letsencrypt in both servers to get valid SSL certificates for real domain and the dynamic DNS one.

Proceed to disable plain text / HTTP traffic. To do this simply remove the entire server { listen 80 section on both servers. You should replace them with server { listen 443 ssl; so it listens only for HTTPs traffic.

Step 7: set your home router to allow incoming traffic in port 443 and forward it into the home server;

Step 8: set the home server's firewall to only accept traffic coming from outside the LAN subnet on port 443 and if it comes from the VPS IP. Drop everything else.

---

Another alternative to this it to setup a Wireguard tunnel between your home server and the VPS and have the reverse proxy send the traffic through that tunnel (change proxy_pass to the IP of the home server inside the tunnel like proxy_pass http://10.0.0.2). This has two advantages: 1) you don't need to setup SSL at your home server as all the traffic will flow encrypted over the tunnel and 2) will not require to open a local port for incoming traffic on the home network... however it also has two drawbacks: you'll need a better VPS because WG requires extra processing power and 2) your home server will have to keep the tunnel connected and working however it will fail. Frankly I wouldn't bother to setup the tunnel as your home server will only accept traffic from the VPS IP so you won't gain much there in terms of security.

You could try Tailscale? It creates a secure tunnel to your server so you don't have to connect it to the internet. Not sure if that checks all your boxes though.

Set up a VPS. Create a VPN tunnel from you local network to the VPS. Use the VPS as the edge router by opening ports on the VPS firewall and routing incoming traffic on those ports through the VPN tunnel to servers on your local network.

I used to do this to get around CGNAT. I ran RouterOS in a Digital Ocean droplet and setting up a wire guard tunnel between it and my local Mikrotik router.

It will obscure your local WAN IP and give you a static IP but that's about the only benefit. And you have to be pretty network savvy to configure it correctly.

It does not make you immune to DDoS attacks and is honestly more headache to maintain (albeit just a small headache).

Depends on why you want to hide your server ip, what's your use case? Is it to protect against DDOS?

Cloudflare is evil, but is there any other party you would trust to share everything with?

Do you want something that also has CDN like Cloudflare? Bunny.net is good, but way more expensive than a cheap VPS if you use a lot of traffic.

VPS with Wireguard

If for personal access only, ZeroTier might solve your use case.

Tor.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters	More Letters
CF	CloudFlare
CGNAT	Carrier-Grade NAT
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
IP	Internet Protocol
NAS	Network-Attached Storage
NAT	Network Address Translation
Plex	Brand of media server package
SSH	Secure Shell for remote terminal access
SSL	Secure Sockets Layer, for transparent encryption
VPN	Virtual Private Network
VPS	Virtual Private Server (opposed to shared hosting)
nginx	Popular HTTP server

---

12 acronyms in this thread; the most compressed thread commented on today has 15 acronyms.

[Thread #803 for this sub, first seen 15th Jun 2024, 10:35] [FAQ] [Full list] [Contact] [Source code]

Very confused by the answers here. Anyway, check this list: https://github.com/anderspitman/awesome-tunneling

I personally used frp many years ago and it worked great.

Perhaps NetBird, ZeroTier or Tailscale? If you want to make a service available publicly, check out Tailscale Funnel.

I used boringproxy for years and I recomend you