Remote Access for Your Homelab: Tailscale vs WireGuard vs Cloudflare Tunnel
Affiliate links. Disclosure
Date / checked: 2026-10-25. Versions pinned: Tailscale v1.104.2 (GitHub release, published 2026-10-21 11:55 JST). cloudflared 2026.10.3 (GitHub release, published 2026-10-21 22:17 JST). wireguard-tools v1.0.20260223 (tag list). Prices in USD, checked 2026-10-25.
For family-only access from phones and laptops, Tailscale's free Personal plan needs the least setup. Plain WireGuard avoids any third-party account but needs one UDP port open on your router. Cloudflare Tunnel gives you a public HTTPS URL without opening inbound ports, but your traffic passes through Cloudflare.
The short answer
- Only you and your family need access (phones and laptops): Tailscale's free Personal plan is the least setup.
- You want no third-party account at all, and you can open one UDP port on your router: plain WireGuard.
- You want a public HTTPS URL without opening any inbound port: Cloudflare Tunnel. Your traffic passes through Cloudflare.
How each one works (official docs)
- WireGuard is the VPN protocol and tools. You generate keys with
wg genkey | tee privatekey | wg pubkey > publickey, then configure peers withwg/wg-quick. If a peer is behind NAT and needs to receive connections, the docs suggestPersistentKeepalive(25 seconds is "a sensible interval"). (Quick Start) - Tailscale "enables encrypted point-to-point connections using the open source WireGuard protocol" and builds a peer-to-peer mesh called a tailnet. Connections work "across firewalls and Network Address Translation (NAT) without requiring port forwarding." You can also route all traffic through an exit node. (What is Tailscale?)
- Cloudflare Tunnel: "a lightweight daemon in your infrastructure (
cloudflared) creates outbound-only connections to Cloudflare's global network". Your resources connect "without a publicly routable IP address," and you can block all inbound traffic. (Cloudflare Tunnel docs)
Comparison
| WireGuard | Tailscale | Cloudflare Tunnel | |
|---|---|---|---|
| Inbound port on your router | Yes (one UDP port on the server side) | Not required (per docs) | None; outbound only |
| Third-party account | None | Tailscale account | Cloudflare account |
| Traffic path | Direct between your peers | Peer-to-peer mesh where possible | Through Cloudflare's network |
| Price (checked 2026-10-25) | Free, open source | Personal $0: up to 6 users, unlimited user devices, non-commercial use | Zero Trust Free plan $0, 50-user limit |
Tailscale's paid tiers are Standard ($8/user/month) and Premium ($18/user/month) (pricing). Cloudflare's Zero Trust pay-as-you-go plan is $7/user/month (plans).
A Cloudflare Tunnel public hostname puts your app on the internet. Put your app's own login (and ideally Cloudflare Access) in front of it. Don't publish admin panels this way.
Where a VPS fits
Some ISPs use carrier-grade NAT (CGNAT): your router gets an address from the shared 100.64.0.0/10 block that RFC 6598 set aside for CGN, and a second layer of NAT in the ISP's network maps many homes onto fewer public IPs (Tailscale: How NAT traversal works). In that case, forwarding a port on your own router doesn't make your server reachable from the internet. Tailscale and Cloudflare Tunnel don't need an inbound port (see above). If you want plain WireGuard, a small VPS with a public IP can act as the endpoint that your home server connects out to. See our VPS table. For whether a commercial VPN helps here, see Do you need a commercial VPN for self-hosting?.
Related: Vaultwarden behind HTTPS
Sources
- https://www.wireguard.com/quickstart/
- https://git.zx2c4.com/wireguard-tools/refs/tags
- https://tailscale.com/kb/1151/what-is-tailscale
- https://tailscale.com/pricing
- https://github.com/tailscale/tailscale/releases/tag/v1.104.2
- https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
- https://www.cloudflare.com/plans/zero-trust-services/
- https://github.com/cloudflare/cloudflared/releases/tag/2026.10.3
- https://www.rfc-editor.org/rfc/rfc6598 (Shared Address Space for CGN)
- https://tailscale.com/blog/how-nat-traversal-works (CGNAT section, checked 2026-10-25)