Tailscale vs Cloudflare Tunnel

Tailscale builds a private overlay network. Every device you install it on gets a stable 100.x.y.z address and a MagicDNS name like nas.your-tailnet.ts.net, and they all talk directly to each other over WireGuard, with Tailscale's DERP relays as an encrypted fallback when NAT traversal fails. Add a subnet router (tailscale up --advertise-routes=192.168.1.0/24 on one Linux box) and devices that can't run Tailscale, like your printer or IPMI interfaces, become reachable too. Nothing is exposed to the public internet at any point.

Cloudflare Tunnel does the opposite job. The cloudflared daemon makes an outbound connection from your lab to Cloudflare's edge, and you map public hostnames on your domain (jellyfin.example.com, wiki.example.com) to internal services in the Zero Trust dashboard. Anyone on earth with a browser can hit those hostnames, gated only by whatever Access policies you put in front. Your home IP stays hidden, no ports open, and CGNAT doesn't matter because the connection is outbound-only.

The common mistake is treating these as competitors. One is access-to-everything for people you trust with client software installed. The other is publish-a-few-things for people who will never install anything. A typical mature homelab uses Tailscale for admin and family access and a Cloudflare Tunnel for the two or three apps that genuinely need public URLs.

Tailscale setup is about three minutes per device: curl -fsSL https://tailscale.com/install.sh | sh, then tailscale up, then log in with Google, GitHub, Microsoft, or Apple. No domain, no DNS records, no config files. The free Personal plan got noticeably better with the pricing v4 update: 6 users (up from 3) and the old 100-device cap is gone entirely. Subnet routers, exit nodes, MagicDNS, and basic ACLs are all included free. Paid tiers (Standard at $8/user/month) exist but a homelab will almost never need them.

Cloudflare Tunnel costs $0 in software but requires a domain with its DNS hosted on Cloudflare, so budget roughly $10/year at Cloudflare Registrar if you don't own one. Install cloudflared, run cloudflared tunnel create homelab, map hostnames in the Zero Trust dashboard, done. The free Zero Trust plan covers 50 users and 50 Access applications, which is comically more than any homelab needs, and Cloudflare states the tunnel itself has no throughput limit. Past 50 users you'd pay $7/user/month for everyone, which will never apply to you.

Both tools work behind CGNAT, Starlink, and T-Mobile Home Internet because both only make outbound connections. If your ISP situation is the reason you're reading this, that specific problem is solved either way, and the decision comes down to who needs in and what they need to reach.

Cloudflare Tunnel public hostnames are only browser-usable for HTTP and HTTPS. It can technically carry SSH, RDP, SMB, and arbitrary TCP, but then every visitor has to run cloudflared access tcp or the WARP client on their own machine, which erases the 'no client software' advantage and lands you back at Tailscale territory with extra steps. Tailscale carries any TCP or UDP natively, so Minecraft servers, SMB shares, RDP, and random UDP-based tools just work with zero per-service config.

Streaming is where Cloudflare's fine print bites. Their service-specific terms say that serving video or a disproportionate share of images, audio, or other large files through the CDN requires their paid products (Stream, Images, or the Developer Platform) unless you're on Enterprise. Cloudflare has historically been lenient with small personal Jellyfin setups, but enforcement is entirely their call, and the 100 MB per-request body limit on free plans breaks large uploads to Nextcloud or Immich unless the app chunks them. Route media over Tailscale instead and none of this applies because it's your own bandwidth end to end.

Tailscale's public-exposure story has the opposite shape. Funnel (available since v1.38.3) will publish a local service to the open internet, but only on ports 443, 8443, or 10000, only on your ts.net name rather than your own domain, and with non-configurable bandwidth limits. It's great for showing a client a demo or receiving the occasional webhook, and wrong for hosting a real public site. That job belongs to Cloudflare Tunnel.

Tailscale traffic is encrypted end to end with WireGuard. Private keys never leave your devices, the coordination server only shuffles public keys and metadata, and even the DERP relays can't decrypt what passes through them. The clients are open source, and if the closed-source control plane bothers you, Headscale is a solid open source replacement you can self-host (its lead maintainer is a Tailscale employee who's allowed to work on it, though the project is independent). Your exit ramp exists.

Cloudflare Tunnel terminates TLS at Cloudflare's edge, full stop. They can see the plaintext of everything flowing through your tunnel, which is how features like Access policies and their WAF work at all. For a wiki or a status page that's a fair trade. For Vaultwarden or anything with credentials and personal data, you're extending trust to a third party that Tailscale simply never asks for, and there is no self-hosted control plane option if that trust ever sours.