When to Use Cloudflare Tunnel vs Tailscale Funnel vs a Public VPS

Cloudflare Tunnel is free. Tailscale Funnel is free. A small VPS is $4 a month. So price isn't the question. The question is where your app runs when your laptop is closed, and who you want standing between it and the internet.

This is the follow-up to our ngrok alternatives post, which answered "what replaces ngrok". This one answers the next question, which is when a tunnel stops being the right tool at all. Prices were checked on September 23, 2026.

Which One Should You Use?

When Is Cloudflare Tunnel Enough?

When you own a domain and the machine doing the work is yours. The cloudflared connector makes an outbound connection to Cloudflare, so nothing on your router is open and your home IP never shows up in DNS. The tunnel runs on the Zero Trust free plan, which covers up to 50 users.

That makes it the right call for a self-hosted dashboard, a staging copy of your app, an internal tool, or a small public site on a machine under your desk. Cloudflare Access can put a login in front of anything that's only for you.

But read the terms before you put a media site behind it. Cloudflare's service-specific terms let it limit free, Pro and Business accounts that serve "video or a disproportionate percentage of pictures, audio files, or other large files" without a paid service. A podcast host on a free tunnel is asking for trouble.

When Does Tailscale Funnel Make More Sense?

When you're already on Tailscale and want one thing public for a while. Funnel works on every plan, including the free Personal plan for up to 6 users, and handles the HTTPS certificate for you.

The limits are tight, though. It only serves names on your your-tailnet.ts.net domain, it only listens on ports 443, 8443 and 10000, it only accepts TLS, and Tailscale applies bandwidth limits it doesn't publish or let you configure. That's fine for a webhook endpoint, a demo for a client, or a Home Assistant instance. It's wrong for your product's front door. If the mesh itself is what you're rethinking, see the Tailscale alternatives post.

When Should You Just Rent a VPS?

As soon as someone pays you and expects the app to be up. A tunnel moves the network problem to Cloudflare or Tailscale. It doesn't move the machine. Your uptime is still your home internet, your power and the one disk in that Mac mini.

A VPS fixes that for very little money. DigitalOcean's smallest Basic Droplet is $4 a month for 1 vCPU, 512 MiB of RAM and 500 GiB of transfer, and $6 gets you 1 GiB of RAM, which is the realistic floor for a Laravel or Node app. Hetzner's CX23 lists at €5.49 a month before VAT after its June 2026 price rise, with IPv4 billed on top, though its site showed that cost-optimized line as unavailable on September 23.

Who shouldn't bother yet: anyone before their first user. A tunnel to a machine you already own is free, and moving later is an afternoon's work. If you're deciding between a VPS and a managed platform, the Vercel vs Railway vs Hetzner guide covers that split.

Can You Combine a VPS and a Tunnel?

Yes, and it's often the best setup. Run cloudflared on the VPS, close ports 80 and 443 in the firewall, and let Cloudflare terminate TLS. Scanners hitting the server's IP find no web server answering. Panels like Coolify support this, and the Forge vs Ploi vs Coolify comparison covers which panel fits.

So Which Should You Run Your App On?

Tunnels are for machines you own that nobody's paying you to keep up. A VPS is for the thing people pay for. And the tunnel still earns its place on the VPS, as the way to close every inbound port.

Found a better setup? Let me know on Twitter @devtoolpicks.