The Canyon ReviewGetting traffic into your self-hosted box, ranked
Cloudflare Tunnel, Tailscale, ngrok and plain WireGuard ranked for exposing homelab and small-team services without opening port 443 to the world.
You want Cloudflare Tunnel for anything the public should reach, and Tailscale for everything only you should. That pair covers ninety percent of self-hosted setups, costs approximately nothing at personal scale, and never requires explaining a port forward to your router again.
Criteria: setup burden 35%, cost at personal-to-small-team scale 30%, security posture 25%, escape hatch quality 10%. Scores illustrative, July 2026.
The table
| Rank | Option | Cost, small scale | The catch |
|---|---|---|---|
| 1 | Cloudflare Tunnel | free tier carries most homelabs | your traffic, their edge |
| 2 | Tailscale | free tier, generous | public sharing is the weak spot |
| 3 | WireGuard, plain | a VPS you already have | you are the control plane |
| 4 | ngrok | fine until it isn't | metered where you'll feel it |
Cloudflare Tunnel wins on the combination nobody else offers: outbound-only connection from your box, TLS and DDoS handled at their edge, and a free tier that carries a personal cluster without complaint. The documented pattern shows up in most serious homelab write-ups we collect (this k3s build runs the canonical version: cluster in the closet, tunnel to the world, nothing inbound). The price is philosophical, not financial: a third party terminates your TLS. Decide once, write it down.
Tailscale is the right answer to a different question: services for people you know. The mesh just works, the free tier covers a household plus friends, and the security story (WireGuard underneath, identity on top) is the strongest on this list. Public exposure via Funnel works but is the afterthought.
Plain WireGuard on a cheap VPS is the sovereignty pick: no third party, no account, no policy changes under you. You pay in being your own NOC. When the handshake fails at midnight, the vendor you contact is you.
ngrok remains the best five-minute demo tool ever shipped, and the metered pricing means production use eventually sends you a bill shaped like a lesson.
The skip: opening 443 on your home router and hoping. It worked in 2009. The internet scanning your IP has professionalized since; your patching cadence has not.