Tailscale and Cloudflare Tunnels have a reputation for solving similar network problems, but they approach them from very different angles. I had been using Cloudflare Tunnels for years because it handled my restrictive network environment without asking anything of my Wi-Fi provider. When I decided to see whether Tailscale could replace it, I expected a cleaner setup and stronger private connectivity. I knew Tailscale excelled at establishing secure connections between devices, so the idea of simplifying my home lab was appealing.
That single requirement ended up defining the entire experiment.
Once I started moving things over, my excitement faded. The first service I tried to migrate was Nextcloud because it is one of the few things I genuinely need to reach from anywhere. Tailscale handled private access well, but that was not my primary goal. What I wanted was a way to make a public service available behind managed Wi-Fi and carrier-grade NAT. That single requirement ended up defining the entire experiment.
Why my managed Wi Fi environment changed everything
How my current network restrictions block public access
Archer BE800 ready to configure
Archer BE800 ready to configure
My apartment uses a managed Wi-Fi system that hides every resident behind carrier-grade NAT (CGNAT). This setup gives me no direct access to the modem, no control over the router, and no ability to forward ports. Cloudflare Tunnels solves this perfectly by relying on an outbound connection from my server to Cloudflare’s network. Tailscale attempts something similar for peer connectivity, but public access requires a different toolset. That difference became the source of every problem I encountered.
CGNAT hides me behind a shared IP, blocking all inbound traffic and making port forwarding impossible. It is great for ISPs but terrible for self-hosted services. Without an outbound tunnel like Cloudflare Tunnels, nothing public can reach my server, which immediately puts Tailscale at a disadvantage.
Tailscale Funnel is the feature that attempts to expose services publicly, but it is not widely available on all platforms. Even in ideal conditions, Funnel works differently from Cloudflare’s approach and is not as flexible for users who need general public access. Cloudflare Tunnels simply accepts inbound traffic at Cloudflare’s edge and pushes it through a secure connection initiated by my server. Tailscale Funnel asks more from the environment than I can provide. As a result, my Nextcloud instance worked only within the tailnet rather than on the open internet.
Troubleshooting made the limitations clearer. I was not dealing with a misconfigured proxy or an incorrect DNS change. I was dealing with the fundamental design of Tailscale and how it handles service exposure. Tailscale excels at private communication between trusted devices authenticated to a tailnet. It struggles when a service needs to be reachable from any browser without requiring the visitor to install a client or authenticate through Tailscale. My network conditions placed Tailscale in a position where it could not succeed.
How Cloudflare Tunnels handled my needs better
Why public access was painless with Cloudflare
Cloudflare Tunnels was the opposite experience because it never required control over my network. The cloudflared daemon opened an outbound connection to Cloudflare on port 443, which works almost everywhere. Cloudflare accepted the incoming requests from the internet and routed them to my server over that connection. My Nextcloud instance loaded instantly from outside my network. There were no special settings to adjust and nothing for the building management to approve.
This approach makes Cloudflare a central point in my hosting chain, but the trade is worth it. Without the ability to forward ports, a traditional self-hosted setup is impossible. Cloudflare gives me the one thing I cannot create myself: a stable public entry point. Tailscale cannot replace that because its public-access model relies on features that are not suitable for my situation. Cloudflare fills a role that Tailscale is not designed to match under strict network conditions.
It also helps that Cloudflare’s system aligns with how I use my home lab. I regularly expose dashboards, self-hosted tools, and various experiments that friends or collaborators may need to access. These people are not part of my tailnet, and I do not want them to be. Cloudflare Tunnels gives them a normal web link that works from any device. Tailscale is fantastic for private networking, but that is not the problem I need to solve most of the time.
Why Tailscale still impressed me in other areas
How Tailscale delivered strong private connectivity
Despite the problems, Tailscale proved that it is excellent at what it was built to do. Its private device-to-device connections felt fast and secure, and the WireGuard foundation gave everything a lightweight and responsive feel. Whether I connected from my laptop or my phone, the experience felt like being on the same local network. That is precisely the kind of performance I want for sensitive internal tools or quick remote access. In those moments, Tailscale delivered without hesitation.
If my needs revolved entirely around private access, the experiment might have ended with a very different conclusion. Tailscale handles NAT traversal remarkably reliably, even under restrictive conditions. It also provides a seamless onboarding experience for new devices joining the tailnet. It is easy to understand why many users treat Tailscale as their primary remote access tool. It does private networking extremely well.
The trouble is that my most important service is public-facing. Tailscale is not built for that use case, and Funnel is not a complete substitute for a full reverse-tunneling system. Cloudflare is designed for that purpose and handles it without effort. The issue was not a bug or user error. It was a mismatch between the tools’ strengths and the environment in which I am forced to work.
What Tailscale would need to improve before I could rely on it
How Tailscale could become more competitive for public services
Tailscale would need several changes before it could replace Cloudflare Tunnels in my setup. The most important would be broader availability of Tailscale Funnel across all supported platforms. Funnel is the closest feature to Cloudflare Tunnels, but it is not available in enough environments to depend on it. If every platform that supports Tailscale also supported Funnel, the feature would be far more practical. Right now, it feels like an incomplete solution.
Tailscale would also need a more flexible model for handling public access. Requiring a tailnet identity for every request makes sense for private services, but it limits the usefulness of public ones. If Tailscale offered a public access layer that did not require users to join a tailnet, it would better serve people who need general internet reachability. This change would directly affect users working under restrictive networks.
Finally, Tailscale would need clearer and more robust handling of CGNAT in public scenarios. The current fallback systems are designed for device connectivity rather than open access. A dedicated public-access mode that can withstand harsh network conditions would give Tailscale a chance to compete directly with Cloudflare. Without this, the tool cannot provide what I need to host a service that must be reachable from anywhere.
How switching internet providers would change the entire situation
Why my network environment determines which tool wins
There is also a much simpler solution that would change everything. If my apartment complex abandoned its managed Wi Fi system and allowed residents to install their own internet service, I could regain complete control of my network. A regular ISP connection with a dedicated modem would eliminate carrier-grade NAT and restore the ability to forward ports. That single change would remove the most significant barrier preventing Tailscale from becoming a complete solution. I would no longer depend on a tool designed to compensate for a locked-down network.
With that control, I could choose how each service is exposed. Tailscale could handle private connectivity while a traditional reverse proxy or firewall managed public access. Funnel would become a convenience rather than a necessity. This kind of flexibility is not possible under my current network restrictions. The moment I regain control of my network edge, the entire conversation changes.
Having the ability to select my own routing hardware would also let me redesign my home lab with fewer compromises. I could pick the equipment and topology that best support my workflows. Cloudflare Tunnels might remain part of that design, but it would no longer be the only workable option. Under those conditions, Tailscale and Cloudflare would compete on features rather than fight infrastructure limitations. That is a far more interesting comparison.
Cloudflare remains the only tool that can meet my real needs
Cloudflare remains the only realistic choice for exposing services behind strict carrier-grade NAT.
Switching from Cloudflare Tunnels to Tailscale did not work for me because my network makes public access impossible without an outbound tunneling service. Tailscale excels at private connectivity, but Cloudflare remains the only realistic choice for exposing services behind strict carrier-grade NAT. Until my environment changes or Tailscale expands its public access capabilities, Cloudflare is the tool that solves the problem I actually have rather than the problem I wish I had.
