VPNSmith
self-host-vpnCOMP

Pangolin vs Cloudflare Tunnel (2026): Who Owns the Exit Point

Both let you expose a self-hosted service without opening a port on your router. The difference that decides it is who owns the machine your traffic exits from - Cloudflare's edge, or a VPS you rent and run yourself.

By Eric Gerard · Founder · VPNSmith - Self-host VPN & GDPR VPS specialist4 min readPhoto via Pexels

Both tools solve the same annoying problem: you run something at home, and you want to reach it from outside without opening a port on your router - which may not even be possible behind CGNAT.

They solve it the same way, too: a daemon on your machine opens an outbound connection to a public endpoint, and traffic comes back down that pipe. Nothing is listening on your home IP.

The difference is one word: whose public endpoint.

Short answer

Cloudflare Tunnel hands the public endpoint to Cloudflare. Nothing to rent, nothing to patch, and it works within minutes.

Pangolin puts that endpoint on a machine you rent and run - usually a small VPS. You keep the path to yourself, and you inherit a server to look after.

That is the whole trade. Everything below is a consequence of it.

Who is in the path?

With Cloudflare Tunnel, visitors connect to Cloudflare, and Cloudflare connects to you. If Cloudflare terminates TLS for your hostname - the standard arrangement - your traffic is decrypted at their edge before being re-encrypted down the tunnel. This is not a hidden behaviour; it is how caching and filtering can function at all.

Whether that matters depends on what you expose. A public blog and a document server are not the same decision, and it is worth making that distinction deliberately rather than by default.

With Pangolin, the endpoint is your VPS. Your provider still hosts the machine, so "nobody is in the path" would be too strong - but the software terminating your traffic is yours, and its configuration is yours.

A woman in black stands in front of a glass wall with blue-lit server racks behind it, holding an open silver laptop and looking down at it; the glass carries manufacturer logos including HP, Intel, NetApp and Schneider Electric.
A woman in black stands in front of a glass wall with blue-lit server racks behind it, holding an open silver laptop and looking down at it; the glass carries manufacturer logos including HP, Intel, NetApp and Schneider Electric.

The public endpoint always lives on someone's machine. The question a tunnel answers is not whether there is a server in the path, but whose it is.

What each one actually costs

Cloudflare Tunnel is available on the free plan, and plenty of people run it for years without paying. The honest framing: free describes the price, not the arrangement. Your traffic transits infrastructure you do not control, on terms that can change.

Pangolin has no licence cost, but it is not free either. You pay for the VPS, and - more expensively - you carry the maintenance: updates, certificates, monitoring, and a backup of the configuration.

People compare the monthly figures and stop there. The recurring cost that surprises them is the second one.

Which for a home server?

  • You want it working tonight, with nothing to maintain → Cloudflare Tunnel. Hard to argue against.
  • You are exposing something you would not hand to a third party → self-hosted tunnel to your own VPS.
  • You are behind CGNAT and have no public address → both work; that is exactly what they are for.
  • You want to learn how this works → Pangolin teaches you more, because you assemble the parts.

A note on the VPS, since it is where the plan usually meets reality: the endpoint needs a stable public address, which a home connection behind CGNAT cannot give you. The smallest tier at any serious provider is enough for a tunnel - this is not a workload that needs cores. What it needs is to still be running, and still be patched, in eight months.

The mistake both tools invite

A tunnel is not authentication.

It removes the open port. It does not decide who may pass. Whatever you expose is reachable by anyone who learns the hostname, and hostnames leak - through certificate transparency logs, among other routes.

Both projects ship access controls for exactly this reason. Use them. The tunnel was never the security boundary; it was only the plumbing that let the traffic arrive.

So which one?

Ask who you want holding the exit point.

If the answer is "I do not want to run a server for this", Cloudflare Tunnel is the right tool and there is no shame in it - the alternative is a machine you must keep alive for years.

If the answer is "the path has to be mine", that is Pangolin, and the price is a VPS you now own the upkeep of.

What neither answers is the question that comes after: whatever you have just exposed still needs its own authentication, its own updates, and its own backup. The tunnel only made it reachable.

★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed

Self-host your VPN on your own VPS → ContaboFull root access · public IPv4 · pick your region→

Frequently asked questions

What is the difference between Pangolin and Cloudflare Tunnel?
Where your traffic comes out. Cloudflare Tunnel connects your service to Cloudflare's network: visitors reach Cloudflare, and Cloudflare reaches you through an outbound connection your daemon opened. Pangolin does the same trick, but the public endpoint is a machine you rent and administer - typically a small VPS - so the exit point belongs to you. Neither requires opening a port on your router, which is the reason people reach for either of them.
Is Cloudflare Tunnel really free?
The tunnel itself is available on Cloudflare's free plan, and a great many people run it without paying. Treat 'free' as a description of the price, not of the arrangement: your traffic transits infrastructure you do not control, under terms the provider sets and can change. Pangolin has no licence cost either, but it is not free in the same sense - you pay for the VPS, and you carry the maintenance.
Does Cloudflare see my traffic?
If Cloudflare terminates TLS for your hostname - the usual setup - then yes, your traffic is decrypted at their edge before being re-encrypted to you. That is how their filtering and caching work at all, so it is not a hidden behaviour. Whether it matters depends entirely on what you are exposing: a personal media library and an internal admin panel do not carry the same consequence.
Which one should I use for a home server?
If the priority is 'working today, with no server to maintain and no bill', Cloudflare Tunnel is hard to argue against. If the priority is that no third party sits in the path - for a service handling documents, backups or anything you would not hand to a provider - then a self-hosted tunnel to your own VPS answers that, at the cost of a machine to keep alive and patched.
Do I still need a VPS with Pangolin?
Yes, and that is the point rather than a drawback. Pangolin's public endpoint has to live somewhere with a stable address, which a home connection behind CGNAT cannot provide. A small VPS is the usual answer. It is also the part people underestimate: it is a machine that needs updates, monitoring and a backup of its configuration, indefinitely.
Can I use both?
They are not exclusive, and splitting by sensitivity is a reasonable pattern: Cloudflare Tunnel in front of the public, cache-friendly things, a self-hosted tunnel for whatever you would rather not route through a third party. The cost is two systems to understand instead of one, which is a real cost when something breaks at an inconvenient hour.
Is exposing a service through a tunnel safe by itself?
No, and this is the most common misreading of both tools. A tunnel removes the open port; it does not authenticate anyone. Whatever you expose is still reachable by whoever finds the hostname, so it needs its own authentication in front of it. Both projects offer access controls precisely because the tunnel alone was never the security boundary.
Related articles

Read next