We've been running Cloudflare Tunnel for about 8 months now instead of a traditional VPN for exposing self-hosted services externally. Curious what others' long-term experience looks like.

What we like:

• No open inbound ports on the firewall – outbound only connection
• Zero config on the client side for HTTP(S) services
• Cloudflare Access for auth layer on top of services that don't have their own
• Works from behind CG-NAT without issues

What we've hit:

• Non-HTTP protocols are more complex (TCP tunneling works but with caveats)
• You're trusting Cloudflare to terminate TLS – not ideal for everything
• Cloudflare injects content into robots.txt for zones using their managed bot protection

Anyone running this long-term for production? What broke?

This is the main reason we keep a WireGuard VPN running in parallel for anything that shouldn't transit Cloudflare's infrastructure. Tunnel for public-facing web services, WireGuard for internal tooling and admin interfaces.

It's not elegant but it keeps the trust boundary clean.

Had exactly this. The managed block prepends to your custom robots.txt and there's no clean way to disable it on the free plan without going through their bot management settings. Worth documenting for anyone doing OSINT work on their own infrastructure – what you see in robots.txt may not reflect only what you configured.

One thing that caught us off guard: Cloudflare Tunnel creates a CNAME record visible in DNS for the tunnel hostname. If you're trying to keep a subdomain low-profile, that CNAME still shows up in passive DNS datasets and certificate transparency logs. Not a dealbreaker but worth being aware of.

Good points all around. Summary from my side after this discussion: Tunnel stays for HTTP services, WireGuard for everything else. The robots.txt injection is annoying but manageable once you know about it.

Thanks – this ended up more useful than I expected.