Pangolin vs Cloudflare Tunnel (2026): Who Owns the Exit Point

Both tools solve the same annoying problem: you run something at home, and you want to reach it from outside without opening a port on your router - which may not even be possible behind CGNAT.

They solve it the same way, too: a daemon on your machine opens an outbound connection to a public endpoint, and traffic comes back down that pipe. Nothing is listening on your home IP.

The difference is one word: whose public endpoint.

Short answer

Cloudflare Tunnel hands the public endpoint to Cloudflare. Nothing to rent, nothing to patch, and it works within minutes.

Pangolin puts that endpoint on a machine you rent and run - usually a small VPS. You keep the path to yourself, and you inherit a server to look after.

That is the whole trade. Everything below is a consequence of it.

Who is in the path?

With Cloudflare Tunnel, visitors connect to Cloudflare, and Cloudflare connects to you. If Cloudflare terminates TLS for your hostname - the standard arrangement - your traffic is decrypted at their edge before being re-encrypted down the tunnel. This is not a hidden behaviour; it is how caching and filtering can function at all.

Whether that matters depends on what you expose. A public blog and a document server are not the same decision, and it is worth making that distinction deliberately rather than by default.

With Pangolin, the endpoint is your VPS. Your provider still hosts the machine, so "nobody is in the path" would be too strong - but the software terminating your traffic is yours, and its configuration is yours.

Being in the path also means setting the rules of the path, and Cloudflare publishes those as fixed numbers. Between Cloudflare and your origin, the documented limits include a 90-second TCP ACK timeout, a 30-second TCP keep-alive interval and a 900-second proxy idle timeout, each with the HTTP error it produces when exceeded (522 and 520). Between the visitor and Cloudflare, an idle HTTP/1.1 or HTTP/2 connection is closed at 400 seconds. Cloudflare's own table marks every one of these as not configurable, and points tunnel users to the separate origin configuration to change what little can be changed. On your own endpoint they are yours to set outright, which matters the day you expose something long-lived, a websocket or a large upload, that does not fit inside someone else's defaults.

The public endpoint always lives on someone's machine. The question a tunnel answers is not whether there is a server in the path, but whose it is.

What each one actually costs

Cloudflare Tunnel is available on the free plan, and plenty of people run it for years without paying. The honest framing: free describes the price, not the arrangement. Your traffic transits infrastructure you do not control, on terms that can change.

Pangolin has no licence cost, but it is not free either. You pay for the VPS, and - more expensively - you carry the maintenance: updates, certificates, monitoring, and a backup of the configuration.

People compare the monthly figures and stop there. The recurring cost that surprises them is the second one.

Which for a home server?

• You want it working tonight, with nothing to maintain → Cloudflare Tunnel. Hard to argue against.
• You are exposing something you would not hand to a third party → self-hosted tunnel to your own VPS.
• You are behind CGNAT and have no public address → both work; that is exactly what they are for.
• You want to learn how this works → Pangolin teaches you more, because you assemble the parts.

A note on the VPS, since it is where the plan usually meets reality: the endpoint needs a stable public address, which a home connection behind CGNAT cannot give you. The smallest tier at any serious provider is enough for a tunnel - this is not a workload that needs cores. What it needs is to still be running, and still be patched, in eight months.

The mistake both tools invite

A tunnel is not authentication.

It removes the open port. It does not decide who may pass. Whatever you expose is reachable by anyone who learns the hostname, and hostnames leak - through certificate transparency logs, among other routes. That last one is not a hypothetical. Certificate Transparency, specified in RFC 6962 in June 2013, publishes issued TLS certificates to append-only logs that anyone can query, and the major browsers now require certificates to appear in them to be trusted. So the moment your tunnel obtains a certificate from a public CA, its hostname is published, searchable and permanent. Naming a service something unguessable buys you nothing here.

Both projects ship access controls for exactly this reason. Use them. The tunnel was never the security boundary; it was only the plumbing that let the traffic arrive.

So which one?

Ask who you want holding the exit point.

If the answer is "I do not want to run a server for this", Cloudflare Tunnel is the right tool and there is no shame in it - the alternative is a machine you must keep alive for years.

If the answer is "the path has to be mine", that is Pangolin, and the price is a VPS you now own the upkeep of.

What neither answers is the question that comes after: whatever you have just exposed still needs its own authentication, its own updates, and its own backup. The tunnel only made it reachable.