search

cloudflare / cloudflared

Cloudflare Tunnel client (formerly Argo Tunnel)
https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide
Apache License 2.0
9.07k stars 799 forks source link

cloudflared support on cloudflare access DoH address #189

Open irawanhd opened 4 years ago

irawanhd commented 4 years ago

Hi, Since cloudflare releases cloudflare access and this is a good thing.

I have problem with local ISP who filter any dns request and forward it to government filtered dns. therefore configuration to use 172.64.36.1 and 172.64.36.2 will be not useful so by then I set it up to use DoH agent cloudflared to calling out cloudflare-gateway

I have current setup with pihole and use cloudflared as DoH agent, with configuration upstream to https://1.1.1.1/dns-query this work great.

but when its changed to https://y6z5ii2u5v.cloudflare-gateway.com/dns-query it cannot perform dns lookup. and when its changed to its ip address instead of domain name which https://162.159.36.5/dns-query\ resulted in tls handshake failure

hopefully, cloudflared will natively support this address.

Apr 17 05:13:23 DietPi cloudflared[3414]: time="2020-04-17T05:13:23+01:00" level=error msg="fai
led to connect to an HTTPS backend \"https://162.159.36.5/dns-query\"" error="failed to perform
 an HTTPS request: Post https://162.159.36.5/dns-query: remote error: tls: handshake failure"

Apr 17 05:13:28 DietPi cloudflared[3414]: time="2020-04-17T05:13:28+01:00" level=error msg="fai
led to connect to an HTTPS backend \"https://y6z5ii2u5v.cloudflare-gateway.com/dns-query\"" err
or="failed to perform an HTTPS request: Post https://y6z5ii2u5v.cloudflare-gateway.com/dns-quer
y: net/http: request canceled while waiting for connection (Client.Timeout exceeded while await
ing headers)"
acmacalister commented 4 years ago

Howdy. What version of cloudflared version are you running? In the latest release of cloudflared, we addressed some usability issues with the DoH client which should help with this issue.

JustinFreid commented 4 years ago

I was running the March release and then the first April release.

On Tue, May 5, 2020 at 3:03 PM Austin Cherry notifications@github.com wrote:

Howdy. What version of cloudflared version are you running? In the latest release of cloudflared, we addressed some usability issues with the DoH client which should help with this issue.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/cloudflare/cloudflared/issues/189#issuecomment-624246665, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADJPKLNCKEAEDCQJ7VG7EDRQBPJZANCNFSM4MKN6FIQ .

chris-erickson commented 4 years ago

Hope it's relevant, but seems the new 1.1.1.2/1.0.0.2, 1.1.1.3/1.0.0.3 also don't work, with the same error. They do with a URL like https://family.cloudflare-dns.com/dns-query but then I can't provide a primary and backup? I'm running 2020.4.0 on rpi/armhf.

irawanhd commented 4 years ago

Howdy. What version of cloudflared version are you running? In the latest release of cloudflared, we addressed some usability issues with the DoH client which should help with this issue.

Hello, I'm using 2019.6.0 from https://hobin.ca/cloudflared/

`root@DietPi:~# cloudflared -v 
cloudflared version 2019.6.0 (built 2019-06-05-0625 UTC)`

my current Raspberry Pi 1 does not support newer version of cloudflared because I have error mentioned #38 


root@DietPi:~# uname -a
Linux DietPi 4.19.97+ #1294 Thu Jan 30 13:10:54 GMT 2020 armv6l GNU/Linux
irawanhd commented 4 years ago

an update for this matter is I do some workaround by changing cloudflared config file to point to both cloudflare-gateway and 1.1.1.1 so cloudflare-gateway can be address resolved

# Commandline args for cloudflared CLOUDFLARED_OPTS=--port 5053 --upstream https://y6z5ii2u5v.cloudflare-gateway.com/dns-query --upstream https://1.1.1.1/dns-query

chris-erickson commented 4 years ago

Wouldn't that cause ~50% of your queries to go to the normal public resolver?

irawanhd commented 4 years ago

Yes, I am aware of that. That is why it is a temporary workaround. so that I can use cloudflare gateway

On Wed, 6 May 2020 at 19.54 Chris Erickson notifications@github.com wrote:

Wouldn't that cause ~50% of your queries to go to the normal public resolver?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/cloudflare/cloudflared/issues/189#issuecomment-624631140, or unsubscribe https://github.com/notifications/unsubscribe-auth/AJDYMLV7FEWZEJKQKE5ZKL3RQFMWXANCNFSM4MKN6FIQ .