One of the things I’ve enjoyed most about Tailscale is that after setting it up, I never have to think about it again. But its convenience masked the fact that to reach a single dashboard, each time I connected, I was doing so from an entire private network. The whole time, I was overbuilding my setup. Cloudflared fixed that problem while requiring only a fraction of the resources Tailscale needed for a connection. It’s become the more efficient tool I turn to for my small setup.
I didn’t need a VPN after all
My workflow came down to one web app, not a whole private network
Remote access has actually been simple with Tailscale. Once I fire it up and connect to my home network, I can go wherever I choose. However, for a long time, I never stopped to think about whether I truly needed that level of access.
Almost every time I connected, the goal was to open one of the self-hosted apps running on my server. That’s very different from connecting to machines over SSH, and it wasn’t quite how I would browse my home network if I were sitting at my desk. However, just to reach one door, Tailscale was building an entire private network, which was overkill for my use.
It felt like I was using Tailscale for a problem it wasn’t built to fix. While Tailscale’s main purpose is connecting devices to each other, my primary need was to securely publish a single service to the outside world. I wasn’t planning on dragging the whole network along in the process. That’s where Cloudflared fit much better.
Cloudflared solves a different problem
Your server reaches out instead of waiting for incoming connections
Cloudflared is the command-line client for Cloudflare Tunnel, and it works quite differently from the other models I know. Instead of requiring an open port on your router, Cloudflared lets the server initiate an outbound connection to Cloudflare’s network. The traffic first comes in through Cloudflare, then it’s routed to your origin server via the existing tunnel.
This design choice takes away port forwarding and doesn’t require poking holes in your firewall or making your IP available to anyone requesting your site. Visitors are not directly contacting your server, since they are talking to Cloudflare’s edge.
I was concerned about how secure this setup would be if I didn’t have a VPN client running on all devices. But the trick is that the tunnel between Cloudflared and Cloudflare is encrypted and authenticated as soon as it’s established. So removing the VPN layer doesn’t mean giving up encryption or authenticated connections.
This design doesn’t require additional installation to make a home dashboard accessible via a subdomain on any device or in any browser. With a routed hostname, Cloudflare also automatically handles HTTPS. This is a nice bonus, but not the major reason for the switch. I was even able to spin up a temporary public URL through TryCloudflare. TryCloudflare is useful if you don’t have a domain, since it lets you verify the tunnel before committing.
- OS
-
Windows, MacOS, Linux
- Price
-
Free
Cloudflared is a daemon running on a host machine in your private network, serving as a traffic proxie from Cloudflare to local services.
Choosing between them is easier than it looks
So when should you actually use each one?
I saw a lot of comparisons between Cloudflared and Tailscale before making the switch. Most of these were based on their remote-access features that avoid router configuration. However, after using both, the overlap felt far smaller than I imagined.
Feature | Tailscale | Cloudflare |
|---|---|---|
Primary job | Connects devices into one private network | Publishes a service through a secure tunnel |
Best for | SSH, RDP, NAS access, full remote control | Self-hosted web apps, dashboards, dev servers |
Client required on remote device | Usually, yes | No, for public web access |
Port forwarding needed | No | No |
Built for a public hostname | Not really its focus | Yes, that’s the core use case |
Tailscale is what you need to SSH into a machine, mount a NAS share, or reach multiple devices like you were sitting right in front of them. A reverse tunnel doesn’t replace a private network; Tailscale provides that private-network functionality.
But if the goal is to make a single web app reachable, and you don’t want to install a client on every device, you should go with Cloudflared. You must be clear on what you want because these tools are made for different jobs.
I haven’t missed Tailscale for this workflow
My switch to Cloudflared is driven more by reducing maintenance and friction than by speed. I’m not double-checking a router configuration after updates, and I don’t have to figure out what’s wrong with NAT when connections don’t get established. I also don’t handle client installations before checking something on a device that isn’t mine.
I can’t claim Cloudflared is faster or more reliable than Tailscale, since that depends on many variables. However, it takes away a lot of the friction I accepted as normal in my workflow.
It hasn’t replaced Tailscale, which I still use to get onto my home network. But it’s far more convenient for the one app I need to access every day.
