Taasz/Woof

I guess? They advertise it as blocking bots and bad actors and such but it doesn’t really do that.

They do talk a lot about security and their WAF on their home page, it might be secondary but they mention it a lot.

I don’t believe there are any logs being transferred, just the abusive IPs are shared with the central DB.

So if an IP starts hitting a ton of rules (like .env access, repeated 403s, 404s, 429s, etc… Or specific AppSec rules) then that IP is blocked and sent to their central DB where it’s pushed out to everyone running crowdsec.

On my setup crowdsec has been more effective than cloudflare at stopping scanners and bots from overloading things, cloudflare just lets basically everything through so I stopped using it.

That said I’m curious if you remember the source of the real world tests, because I’d love to see what’s actually better.

Pangolin would work, it’s still wireguard underneath but with a webUI to set up things and simplify it. It’s fairly easy to install on your server with their docker compose examples.

What does these “tunnels” actually add?

Ease of deployment / time savings generally. You can certainly do it yourself with wireguard and a reverse proxy.

Self hosted alternative is buying a static IP from your ISP I suppose. Mine is an extra $5/mo which is eh, but I’m not paying for a VPS.

It’s not self-hosted, but Tailscale funnels are also an option.