Cloudflare Tunnel vs a Dedicated IP
Cloudflare Tunnel is free, well-built, and for a large share of home servers it is simply the better choice. This page is mostly about why. It is also about the specific point where a tunnel stops being able to do the job, and what a routed address does instead.
How Cloudflare Tunnel works
You run cloudflared on the machine you want to expose. It opens an outbound connection to Cloudflare's network and holds it open. In your DNS, a hostname on a domain you control is pointed at that tunnel rather than at an address. When a visitor requests the hostname, they connect to Cloudflare, Cloudflare matches the request to your tunnel, and sends it down the connection your machine already established.
Two consequences follow, and between them they explain both the appeal and the limits.
First, your machine never accepts an unsolicited inbound connection. It dials out, the way a browser does. That is why this works from behind carrier-grade NAT, behind a router you cannot configure, on a laptop that moves between networks — and why you can close every inbound port on the host and have the service still work. There is genuinely nothing to port-scan.
Second, the connection terminates at Cloudflare. TLS is decrypted on their edge and a fresh connection is made to you. Everything they offer downstream of that — caching, the WAF, DDoS absorption, Access policies — is possible precisely because they are in the middle holding plaintext.
What it does better than a dedicated address
This list is long and it is not padding. For a web service, Cloudflare Tunnel beats buying an address on most axes that matter.
It is free, for the tunnel itself and for the DNS in front of it. The hostname is on your own domain, with a certificate issued for your name, and you did not have to run certbot or think about renewals. You get DDoS absorption from a network with far more capacity than we have, which matters more than people expect the first time a home connection is pointed at by something unfriendly. You get caching and a WAF if you want them.
And you get Cloudflare Access, which is the underrated part: you can put an identity check in front of a service that has no authentication of its own, and unauthenticated requests never reach your machine at all. If you are exposing something you would rather not have exposed — an admin panel, a home automation dashboard, something that was never written to face the internet — that is a genuinely better security posture than a public address with a firewall rule, because the filtering happens before the packet is anywhere near you.
If your service is HTTP and a hostname is what people will use, stop here and use Cloudflare Tunnel. It is free and it is better than what we sell. We would rather say that than take ten dollars a month from someone it does not suit.
Where it stops fitting
Four specific places, and they are all consequences of the mechanism rather than complaints about the product.
It is shaped around HTTP
Non-web protocols can be carried, but the far end changes: rather than any client connecting normally, whoever connects has to run cloudflared locally to open the other end of the tunnel. That is fine when the users are you and your colleagues. It is impossible when the users are the general public, a vendor's server, or a game client that only knows how to open a socket. The moment a stranger has to install software to reach you, the tunnel has stopped being transparent.
You cannot be reached by address
Traffic arrives at Cloudflare's addresses, shared with a very large number of other properties. There is no address that is yours. If a partner needs to allowlist you by IP, if a corporate firewall only opens to addresses, if you need reverse DNS, or if an SPF record has to name where your mail comes from, none of that is expressible. This is the single most common reason people arrive at our site from a working Cloudflare Tunnel setup.
Somebody else is in the middle
Termination at the edge means Cloudflare decrypts your traffic. For most self-hosting this is an acceptable and well-understood trade, and it is the same trade you make with any CDN. It is worth being conscious of rather than discovering later, particularly for anything with a regulatory shape to it.
Volume and content type
The free plan is built for web content. Pushing large sustained volumes of non-web data through it is outside what it is intended for, and their terms are the authority on where that line sits for your case rather than anything we could summarise here. If you are planning to serve a lot of large files continuously, read them first.
Deciding, concretely
Ask what the other side of the connection is.
If it is a browser, and the thing it types is a hostname, Cloudflare Tunnel wins on nearly every axis, and the fact that it is free is close to the least interesting reason. Use it.
If it is your own devices, a public tunnel is more exposure than you need at all, and a private mesh is the better shape. That comparison is here.
If it is a machine that was told an IP address — a vendor's webhook sender behind a firewall allowlist, a monitoring system, a partner's integration — a tunnel cannot satisfy it, because there is no address to give them that belongs only to you.
If it is a client speaking something that is not HTTP, and that client is not going to install anything, the same applies.
What a routed address does differently
A dedicated address inverts where the public endpoint lives. Rather than a hostname resolving to a provider who relays to you, a network with its own address space assigns you an address, announces it to the global routing table by BGP, and carries traffic for it down a tunnel to your hardware. Your machine still dials outbound, so CGNAT is bypassed exactly as it is with cloudflared — the difference is what exists on the internet at the end of it.
What exists is an address, and an address can do things a hostname cannot. It can be allowlisted. It can carry any protocol, because nothing is inspecting or reshaping the traffic. It can hold reverse DNS. It is attributable to exactly one customer, so its reputation is yours alone, for better and for worse.
What you give up is everything Cloudflare was doing for you by being in the middle. There is no caching, no WAF, no identity layer, and no DDoS absorption beyond what our network can carry — which is much less than theirs. If a public address makes you responsible for filtering that Cloudflare was doing on your behalf, that is a real cost and it belongs in the decision.
Where TunnelNet fits
We lease one public IPv4 address from our own 23.187.152.0/24, announced by BGP from AS396500, routed to a machine you already own — Linux, WSL, macOS, Windows, or a phone. $10 per month for one address, with an IPv6 /56 included. Setup is an enrolment token from your dashboard and one install command. We announce from two US cities, Chicago and Newark, on anycast, so the internet reaches you through whichever is closer. SSH is open by default and everything else is closed until you open it, filtered at our edge before it reaches your machine.
The limits, plainly. The base plan is inbound only — outbound still leaves via your ISP unless you take the $20 plan. Outbound port 25 is blocked. Failover between our hubs is automatic but takes minutes rather than seconds, because the WireGuard rekey dominates recovery; Cloudflare's edge will fail over faster than we do and it is not close. We publish no availability number, because we have not been running long enough to have measured one honestly. And we are not a VPN and do not sell anonymity — the address is deliberately, permanently attributable to you.
The honest summary is that these are not really competitors. Cloudflare Tunnel is the right answer for web services and we would recommend it over ourselves for that. We are the right answer when something needs an address rather than a name. If that is you, the plans are here; if it is not, their free tier is genuinely excellent and you should use it.