Pangolin vs Cloudflare Tunnel

Both use an outbound-only tunnel, which is why neither needs a port forward and both work behind CGNAT. With Cloudflare Tunnel you install cloudflared on a box in your lab, it dials out to Cloudflare, and you map public hostnames to internal services in the Zero Trust dashboard. With Pangolin you stand up the Pangolin server on a VPS that has a public IP, then run its lightweight client, Newt, on a machine at home; Newt dials out to the VPS over WireGuard and your services become reachable through hostnames on your domain. From the outside they look identical: a public HTTPS URL that reaches a service sitting on your private LAN.

The divergence is the edge. Cloudflare's edge is Cloudflare, thousands of points of presence you get for free but do not control. Pangolin's edge is a VPS you rent, which you do control and also have to run. That single difference drives almost every tradeoff below: cost, privacy, DDoS protection, and how much of your weekend goes to patching. If you have read Tailscale vs Cloudflare Tunnel, this is the other half of the story. Pangolin is what you reach for when you like Cloudflare Tunnel's model but want to own the far end.

Pangolin bills itself as an identity-aware VPN and tunneled reverse proxy. Under the hood the server node runs Traefik as the actual reverse proxy, which handles routing and pulls free Let's Encrypt certificates, plus a component called Gerbil that manages the WireGuard interface where your tunnels land. Newt is the userspace WireGuard client that runs on each of your sites and connects back. On top sits a web dashboard where you define sites, add resources (the individual apps you want to expose), and attach access rules to each one.

The access control is the part that makes it more than a proxy. Every resource can sit behind SSO, email one-time codes, PIN codes, passcodes, geoblocking, or IP allow-lists, all managed from the dashboard, which is effectively a self-hosted version of what Cloudflare Access does. It also serves raw TCP and UDP resources and has a client mode for private peer-to-peer access, so it stretches into VPN territory, not just web publishing. If you want to understand the proxy layer it is built on, that is the same Traefik covered in Nginx Proxy Manager vs Traefik.

Installation is a Docker Compose stack, and there is a one-click DigitalOcean marketplace image if you would rather not hand-roll it. The community edition is free and open source under AGPL-3.0. A paid Enterprise image (the ee tag) adds extras like external identity provider integration, multi-organization support, and custom branding, and Fossorial's commercial license keeps all of it free for personal use and for businesses under $100K in annual revenue.

Cloudflare Tunnel's pitch is that you run nothing but cloudflared. There is no VPS to rent, no edge to patch, and no reverse proxy to configure, because Cloudflare is all of that. You get their global anycast network in front of every hostname, which means free DDoS absorption, a WAF, and CDN caching that a single VPS cannot match. Cloudflare Access gates any app with email codes or SSO, free for up to 50 users, which is far more than a homelab will ever use.

The cost is real, it is just not money. TLS terminates at Cloudflare's edge, so they see the plaintext of everything flowing through your tunnel; that is how Access and the WAF work at all. You also need a domain with its DNS hosted on Cloudflare, and Cloudflare's service-specific terms restrict serving video and other large media through the CDN without paid products, which trips up Jellyfin and Plex setups. And there is no self-hosted control plane: cloudflared is open source, but the edge is Cloudflare only, so if that dependency ever bothers you, your exit is to rebuild on something else entirely.

On paper both are free software, but the totals are not equal. Pangolin needs a VPS with a public IP to be the edge, which runs about $5 a month at any budget provider, plus a domain. More importantly it needs you: the VPS is a public-facing Linux box you have to keep patched, hardened, and monitored, and Traefik and Pangolin updates are yours to apply. That is a fair trade if you enjoy running infrastructure, and a chore if you don't.

Cloudflare Tunnel's total really is close to zero. The software is free, the edge is free, and the only hard cost is a domain, roughly $10 a year at Cloudflare's at-cost registrar. There is no server to maintain because the internet-facing half lives on Cloudflare's infrastructure. For someone who wants to expose two apps and never think about it again, that gap in ongoing effort is the whole decision. If your goal is private access rather than public publishing, weigh both against a mesh VPN in WireGuard vs Tailscale before you commit to either.

Privacy is where Pangolin has a clean, structural win. Because the tunnel terminates on your own VPS, no third party is positioned to read your traffic; you hold the TLS keys and the logs. With Cloudflare Tunnel, Cloudflare is in the path by design and handles your requests in plaintext. For a public blog or a status page that is a non-issue. For Vaultwarden, a family photo library, or anything carrying credentials, it is a trust decision you should make on purpose, not by default.

Protocols split the same way. Cloudflare Tunnel is browser-native for HTTP and HTTPS, but SSH, RDP, and arbitrary TCP require your visitors to run cloudflared or the WARP client, which undercuts the whole no-client-software appeal. Pangolin exposes raw TCP and UDP directly and adds a WireGuard client mode for private access, so game servers, databases, and remote desktops fit without asking guests to install anything unusual. The flip side is blast radius: Pangolin has no global edge, so a DDoS lands squarely on your one VPS, while Cloudflare shrugs off attacks that would flatten a $5 droplet.