{"id":32117,"date":"2026-07-13T13:32:25","date_gmt":"2026-07-13T11:32:25","guid":{"rendered":"https:\/\/contabo.com\/blog\/?p=32117"},"modified":"2026-07-13T13:37:52","modified_gmt":"2026-07-13T11:37:52","slug":"pangolin-vs-cloudflare-tunnels-vs-tailscale","status":"publish","type":"post","link":"https:\/\/contabo.com\/blog\/pangolin-vs-cloudflare-tunnels-vs-tailscale\/","title":{"rendered":"Pangolin vs Cloudflare Tunnels vs Tailscale: Which Should You Self-Host?"},"content":{"rendered":"\n<p>Cloudflare Tunnel is the easiest option \u2014 zero infrastructure, free tier, global edge network \u2014 but it routes your traffic through Cloudflare&#8217;s servers where they terminate TLS. Tailscale is the strongest tool for device-to-device mesh access without a public IP. Pangolin is the self-hosted option for teams who want full control of both reverse proxy and VPN in one stack and are comfortable running a VPS hub. Pick based on your data-sovereignty requirements and tolerance for infrastructure management.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-quick-comparison\">Quick Comparison<\/h2>\n\n\n\n<style>\n.table-responsive{overflow-x:auto;margin:1.5em 0;}\n.pangolin-quick-compare-table{width:100%;border-collapse:collapse;font-size:0.95em;font-family:inherit;}\n.pangolin-quick-compare-table th,.pangolin-quick-compare-table td{border:1px solid #ddd;padding:10px 14px;text-align:left;vertical-align:top;}\n.pangolin-quick-compare-table thead th{background-color:#003366;color:#fff;font-weight:600;}\n.pangolin-quick-compare-table tbody tr:nth-child(even){background-color:#f7f9fb;}\n.pangolin-quick-compare-table tbody td:first-child{white-space:nowrap;font-weight:600;color:#0066CC;}\n<\/style>\n<div class=\"table-responsive\">\n<table class=\"pangolin-quick-compare-table\">\n  <thead>\n    <tr>\n      <th>Dimension<\/th>\n      <th>Pangolin<\/th>\n      <th>Cloudflare Tunnels<\/th>\n      <th>Tailscale<\/th>\n    <\/tr>\n  <\/thead>\n  <tbody>\n    <tr>\n      <td><strong>Hosting model<\/strong><\/td>\n      <td>Self-hosted VPS hub<\/td>\n      <td>Fully managed (Cloudflare edge)<\/td>\n      <td>Managed control plane; optional Headscale self-host<\/td>\n    <\/tr>\n    <tr>\n      <td><strong>Data privacy<\/strong><\/td>\n      <td>Traffic stays on your infrastructure<\/td>\n      <td>Cloudflare terminates TLS \u2014 sees plaintext traffic<\/td>\n      <td>Encrypted peer-to-peer; DERP relays for NAT traversal<\/td>\n    <\/tr>\n    <tr>\n      <td><strong>Upload limits<\/strong><\/td>\n      <td>None (VPS bandwidth)<\/td>\n      <td>100 MB\/request on free tier<\/td>\n      <td>None<\/td>\n    <\/tr>\n    <tr>\n      <td><strong>Cost<\/strong><\/td>\n      <td>VPS cost (~\u20ac8.75\/mo+)<\/td>\n      <td>Free tier; paid for advanced features<\/td>\n      <td>Free tier; $6\/user\/mo for teams<\/td>\n    <\/tr>\n    <tr>\n      <td><strong>VPS required<\/strong><\/td>\n      <td>Yes \u2014 public IP hub required<\/td>\n      <td>No<\/td>\n      <td>No (with managed control plane)<\/td>\n    <\/tr>\n    <tr>\n      <td><strong>Open source<\/strong><\/td>\n      <td>Yes \u2014 AGPL-3.0 Community Edition<\/td>\n      <td>cloudflared client only<\/td>\n      <td>Client open source; control plane closed (Headscale = OSS alt.)<\/td>\n    <\/tr>\n    <tr>\n      <td><strong>Best for<\/strong><\/td>\n      <td>Full data sovereignty, HTTPS web apps, self-hosted ZTNA<\/td>\n      <td>Easiest setup, no VPS, public web apps<\/td>\n      <td>Device-to-device mesh access, no public URL needed<\/td>\n    <\/tr>\n  <\/tbody>\n<\/table>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Pangolin: Full Self-Hosted Control<\/h2>\n\n\n\n<p>Pangolin is an open-source, identity-aware remote access platform built on WireGuard, developed by Fossorial (a YC 2025 company). It ships as four containers on a public VPS \u2014 Pangolin (control plane), Gerbil (WireGuard manager), Traefik (reverse proxy), and Newt (the lightweight client deployed on each private network). The official installer configures all four in a single interactive run.<\/p>\n\n\n\n<p>What makes Pangolin distinct is the combination: tunneled reverse proxy (expose web apps via HTTPS without opening ports) and zero-trust network access (access databases, SSH servers, RDP hosts through authenticated WireGuard tunnels) \u2014 unified under one dashboard with shared identity, RBAC, and audit logging.<\/p>\n\n\n\n<p>Key strengths: AGPL-3.0 Community Edition is free, all traffic stays on your infrastructure, no TLS termination by a third party, no upload limits, and Traefik&#8217;s full configuration is available for advanced routing. Key trade-off: you manage the VPS hub. If it goes down, tunnel access goes down. High availability requires additional architecture.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cloudflare Tunnels: Easiest Setup, Managed Trade-offs<\/h2>\n\n\n\n<p>Cloudflare Tunnel (cloudflared) lets you expose a locally running service to the internet in minutes: install the cloudflared client, authenticate with your Cloudflare account, and point it at a local port. No VPS, no DNS management, no certificate setup \u2014 Cloudflare&#8217;s edge handles all of it.<\/p>\n\n\n\n<p>The trade-offs follow from the managed model. Cloudflare terminates TLS at their edge, which means Cloudflare can see your application traffic in plaintext before it reaches the origin. For teams under GDPR, HIPAA, or any regulation requiring data to stay on specific infrastructure, this is a hard blocker. The free tier also imposes a 100 MB per-request upload limit, which rules out large file transfers and video streaming. Cloudflare&#8217;s ToS restricts using Tunnel on the free plan to serve video content.<\/p>\n\n\n\n<p>Cloudflare Tunnel is the right call when you have no data-residency requirements, want zero infrastructure overhead, and need a tunnel live in under five minutes. It&#8217;s not the right call when traffic privacy, upload limits, or vendor lock-in are concerns.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tailscale: Mesh VPN, Different Use Case<\/h2>\n\n\n\n<p>Tailscale builds a private WireGuard mesh between your devices using its own managed control plane. Every device enrolled gets a stable IP address (100.x.x.x range) that other enrolled devices can reach directly \u2014 through NAT, through firewalls, without any public IP on either end. Tailscale handles NAT traversal via its DERP relay servers when direct connection isn&#8217;t possible.<\/p>\n\n\n\n<p>Tailscale&#8217;s sweet spot is access control between devices your team already owns: laptop-to-home-server, developer machine-to-staging database, office network-to-cloud VPC. The free tier covers most small-team use cases and requires no infrastructure management beyond installing the client on each device. ACLs are powerful and well-documented.<\/p>\n\n\n\n<p>Where Tailscale doesn&#8217;t fit: exposing a web app via a public HTTPS URL for browser-based access. Tailscale Funnel exists for this use case but is limited (HTTPS only, no custom domains on free tier). For teams that want a proper public HTTPS endpoint with custom domain, SSO, and per-resource access rules, Pangolin fills the gap Tailscale leaves.<\/p>\n\n\n\n<p>Headscale is the open-source, self-hosted Tailscale control plane. It is compatible with standard Tailscale clients and lets you run the entire mesh without any Tailscale Inc. dependency. For teams with strict vendor-lock-in policies who want the mesh-VPN model, Headscale is the self-hosted path.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When to Pick Each<\/h2>\n\n\n\n<style>\n.table-responsive{overflow-x:auto;margin:1.5em 0;}\n.pangolin-pick-table{width:100%;border-collapse:collapse;font-size:0.95em;font-family:inherit;}\n.pangolin-pick-table th,.pangolin-pick-table td{border:1px solid #ddd;padding:10px 14px;text-align:left;vertical-align:top;}\n.pangolin-pick-table thead th{background-color:#003366;color:#fff;font-weight:600;}\n.pangolin-pick-table tbody tr:nth-child(even){background-color:#f7f9fb;}\n.pangolin-pick-table tbody td:last-child{white-space:nowrap;color:#0066CC;}\n<\/style>\n<div class=\"table-responsive\">\n<table class=\"pangolin-pick-table\">\n  <thead>\n    <tr>\n      <th>Your situation<\/th>\n      <th>Best pick<\/th>\n    <\/tr>\n  <\/thead>\n  <tbody>\n    <tr>\n      <td>Expose a web app, GDPR\/data residency required<\/td>\n      <td><strong>Pangolin<\/strong><\/td>\n    <\/tr>\n    <tr>\n      <td>Need full control over TLS termination and routing<\/td>\n      <td><strong>Pangolin<\/strong><\/td>\n    <\/tr>\n    <tr>\n      <td>Quick tunnel for a personal project, no VPS, no infrastructure<\/td>\n      <td><strong>Cloudflare Tunnel (free tier)<\/strong><\/td>\n    <\/tr>\n    <tr>\n      <td>Share a dev preview publicly with zero setup<\/td>\n      <td><strong>Cloudflare Tunnel<\/strong><\/td>\n    <\/tr>\n    <tr>\n      <td>Connect team devices to each other, no public HTTPS URL needed<\/td>\n      <td><strong>Tailscale or Headscale<\/strong><\/td>\n    <\/tr>\n    <tr>\n      <td>Self-host Tailscale&#8217;s control plane (no vendor dependency)<\/td>\n      <td><strong>Headscale<\/strong><\/td>\n    <\/tr>\n    <tr>\n      <td>Expose web apps AND give device VPN access, want one stack<\/td>\n      <td><strong>Pangolin (+ native clients)<\/strong><\/td>\n    <\/tr>\n    <tr>\n      <td>No DevOps capacity, managed service preferred<\/td>\n      <td><strong>Cloudflare Tunnel or Tailscale<\/strong><\/td>\n    <\/tr>\n  <\/tbody>\n<\/table>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Running Pangolin on Contabo: The Self-Hosted Path<\/h2>\n\n\n\n<p>Pangolin&#8217;s hub needs a public IP, Docker, and enough headroom to run four containers alongside any other services you co-host. The Contabo Cloud VPS Plus 4 \u2014 4 cores, 8 GB RAM, 150 GB NVMe, \u20ac8.75\/month \u2014 is the natural starting point. NVMe matters here: Traefik writes certificate state to disk and Pangolin&#8217;s SQLite database is I\/O-sensitive under concurrent tunnel loads. Spinning disk would introduce latency; NVMe keeps it negligible.<\/p>\n\n\n\n<p>For teams running more than a handful of concurrent tunnel sessions or co-hosting additional services (Gitea, Nextcloud, a monitoring stack) on the same VPS, the Cloud VPS Plus 6 (12 GB RAM, \u20ac13.50\/month) adds the headroom. Either way, the RAM-per-Euro positioning of Contabo&#8217;s Plus line \u2014 NVMe at prices well below comparable Hetzner or DigitalOcean specs \u2014 makes it the practical default for Pangolin hubs where cost efficiency matters.<\/p>\n\n\n\n<p>EU data centre locations satisfy GDPR data-residency requirements for teams routing traffic through Pangolin rather than Cloudflare.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ: Pangolin vs Cloudflare Tunnels vs Tailscale<\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1783942157663\"><strong class=\"schema-faq-question\">Can Pangolin replace Tailscale?<\/strong> <p class=\"schema-faq-answer\">For browser-based HTTPS access to web applications, Pangolin is the stronger option. For pure device-to-device mesh access without a public IP, Tailscale (or Headscale for the self-hosted control plane) remains the better architectural fit. As Pangolin&#8217;s native clients (Android, Windows, CLI) mature through 2026, the gap for private resource access narrows \u2014 but Tailscale&#8217;s mesh model still has an edge for latency-sensitive, peer-to-peer device connectivity.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1783942171869\"><strong class=\"schema-faq-question\">Does Pangolin work without a VPS?<\/strong> <p class=\"schema-faq-answer\">No. Pangolin&#8217;s architecture requires a VPS with a public IP to serve as the hub. The hub runs the control plane (Pangolin), WireGuard interface manager (Gerbil), and reverse proxy (Traefik). Without a public IP, there is no entry point for browser traffic or WireGuard tunnel connections. This is the fundamental architectural difference from Cloudflare Tunnel and Tailscale, both of which work without any public-IP infrastructure on the user&#8217;s side.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1783942185122\"><strong class=\"schema-faq-question\">What is Headscale and how does it compare to Pangolin?<\/strong> <p class=\"schema-faq-answer\">Headscale is an open-source, self-hosted implementation of Tailscale&#8217;s control plane. It is compatible with the standard Tailscale client apps and creates the same WireGuard mesh network between enrolled devices \u2014 but you run the control server on your own infrastructure instead of Tailscale Inc.&#8217;s. Headscale is the right choice for teams who want Tailscale&#8217;s mesh-VPN model (no public IP required, device-to-device access) with full self-hosted control. Pangolin is the right choice when you need browser-accessible HTTPS resources with a full reverse proxy and identity layer. The two tools are complementary, not competitors.<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>Cloudflare Tunnel is the easiest option \u2014 zero infrastructure, free tier, global edge network \u2014 but it routes your traffic through Cloudflare&#8217;s servers where they terminate TLS. Tailscale is the strongest tool for device-to-device mesh access without a public IP. Pangolin is the self-hosted option for teams who want full control of both reverse proxy [&hellip;]<\/p>\n","protected":false},"author":78,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":"","_members_access_role":[],"_members_access_error":""},"categories":[1535],"tags":[],"ppma_author":[4285],"class_list":["post-32117","post","type-post","status-publish","format-standard","hentry","category-comparisons"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"Jie Guo","author_link":"https:\/\/contabo.com\/blog\/author\/jieguo\/"},"uagb_comment_info":0,"uagb_excerpt":"Cloudflare Tunnel is the easiest option \u2014 zero infrastructure, free tier, global edge network \u2014 but it routes your traffic through Cloudflare&#8217;s servers where they terminate TLS. Tailscale is the strongest tool for device-to-device mesh access without a public IP. Pangolin is the self-hosted option for teams who want full control of both reverse proxy&hellip;","authors":[{"term_id":4285,"user_id":78,"is_guest":0,"slug":"jieguo","display_name":"Jie Guo","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/4e0d981b06988d6d456834e9d55bc9e713e918fa8444325543d14f448154106b?s=96&d=mm&r=g","author_category":"","user_url":"","last_name":"Guo","first_name":"Jie","job_title":"","description":""}],"_links":{"self":[{"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/posts\/32117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/users\/78"}],"replies":[{"embeddable":true,"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/comments?post=32117"}],"version-history":[{"count":1,"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/posts\/32117\/revisions"}],"predecessor-version":[{"id":32118,"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/posts\/32117\/revisions\/32118"}],"wp:attachment":[{"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/media?parent=32117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/categories?post=32117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/tags?post=32117"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/contabo.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=32117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}