zorven
EN
TürkçeEnglish
Sign in Start free
Comparison

Cloudflare Tunnel alternative: keep your DNS, add UDP

Cloudflare Tunnel has free options and a huge network, but a stable hostname requires adding your domain to Cloudflare, public hostnames do not carry UDP, and Quick Tunnels are for testing only. If one of those is a blocker, Zorven (AGPLv3, hosted or self-hosted) keeps your domain on your own DNS and adds UDP, visitor login and a WAF; for a fully self-hosted setup, Pangolin and NetBird's reverse proxy are also worth a look.

Start free Compare plans

What are the documented limits of Cloudflare Tunnel?

Cloudflare Tunnel works by having cloudflared on your server open outbound-only connections to Cloudflare's network, so you never open an inbound port. The model is solid, but Cloudflare's own docs list some limits:

  • Quick Tunnels are for testing. They need no account or domain, but each Quick Tunnel supports up to 200 in-flight requests, with 429 beyond that, and does not support Server-Sent Events (SSE). Cloudflare says to create a named tunnel for stable hostnames and production traffic.
  • A stable hostname means your domain lives on Cloudflare. The docs say that before you publish an application through a tunnel "you must add a website to Cloudflare"; the public hostname's DNS record is created in the Cloudflare dashboard.
  • No UDP on public hostnames. Supported service types are HTTP, HTTPS, UNIX, TCP, SSH, RDP, SMB and a few special ones; UDP is not on the list. For TCP or UDP applications, Cloudflare points to Spectrum, a separate product.
  • Non-HTTP services need a client on the visitor side. Per the docs, end users must run cloudflared on their own machine to reach non-HTTP services.

None of this matters for most web apps. But if you want to expose a game server over UDP, keep your domain at your current DNS provider, or quickly share a dev environment that relies on SSE, it is worth looking at alternatives.

Is Cloudflare lock-in a real problem?

Not on its own, but it adds up. A named tunnel puts your domain on Cloudflare, your access rules in Cloudflare Access and your traffic on Cloudflare's network. If you ever switch providers, you move DNS, access policies and tunnels together. With Zorven, attaching your own domain takes a CNAME or TXT record at your existing DNS provider (Hobby and up); you keep your nameservers. Because the core is AGPLv3, you can also move from the hosted service to your own server, or back.

How do latency and location compare from Türkiye?

To be honest about it: Cloudflare's network page lists Istanbul among its 348 cities, so Cloudflare has a local presence for visitors in Türkiye too. Zorven's hosted service runs on servers in Istanbul, but in a single location with no global edge network. If your audience is worldwide, Cloudflare's network wins clearly. Zorven's difference is the model, not the location: if you want traffic to stay on your own server instead of a third-party cloud, you can self-host Zorven. On the hosted service, visitor connections terminate at the Zorven server and requests are forwarded to your service over the encrypted connection your client opened.

How do the Cloudflare Tunnel alternatives compare?

Summary: Cloudflare Tunnel leads on scale and free usage; Zorven combines UDP, custom domains on your own DNS and a built-in WAF and visitor login in one tool; Pangolin and NetBird are strong for identity-aware access on your own server.

FeatureZorvenCloudflare TunnelPangolinNetBird Reverse Proxy
Self-hostYes (AGPLv3 open core)No (service runs on Cloudflare)Yes (AGPL-3 community edition; enterprise edition under a commercial license)Yes (separate netbird-proxy + Traefik required)
Where your DNS livesYour provider; verify with CNAME or TXT (Hobby and up)Domain must be added to CloudflareDomain pointing at your server; 5 domains on Cloud BasicReady-made domains on Cloud; custom domains on Cloud and self-hosted
HTTP, WebSocket, SSEYes (including SSE)Yes (no SSE on Quick Tunnels)HTTPS resourcesYes (WebSocket and SSE)
TCPAll plans; visitors connect to zorven.app:PORT without a clientYes; visitors need cloudflaredRaw resources self-hosted only (remote node on Cloud)Yes (L4)
UDPPro and upNot on public hostnames (Spectrum is separate)Raw resources self-hosted onlyYes (L4)
Visitor loginBasic Auth, Google/GitHub on all plans; enterprise OIDC/SAML on EnterpriseCloudflare Access (Zero Trust)SSO (Team and up), PIN, email OTPSSO (OIDC), password, PIN, header auth (HTTP)
WAF, bots, CAPTCHAWAF log mode, bot protection and CAPTCHA on all plans; WAF blocking and Geo on ProSeparate Cloudflare security products (not compared here)Geoblocking and allow-lists; no WAF on the official pagesIP, country and CrowdSec reputation restrictions
Free tier2 clients, 2 tunnels, 5 GB/monthQuick Tunnel without an account; Zero Trust has a free planBasic: 5 users, 5 sites, 5 domainsFree: 5 users, 100 machines
Entry priceHobby $5/month (per plan)Zero Trust paid prices not published on the plans pageTeam $4/user/monthTeam EUR 6/user/month
NetworkOne location (Istanbul) or your own server348 cities, including IstanbulYour server or Pangolin CloudYour server or NetBird Cloud
MaturityYoung project, small communityVery mature, very large user baseMature; more than 23,000 GitHub starsNetBird is mature; Reverse Proxy is in beta

Pangolin and NetBird: self-hosted Cloudflare Tunnel alternatives

Pangolin is the WireGuard-based, identity-aware platform widely known as the open-source alternative to Cloudflare Tunnel. Self-hosting needs a Linux server with a public IP and open ports 80 and 443 (TCP) plus 51820 and 21820 (UDP); the installer pulls Pangolin, Gerbil and Traefik. Raw TCP/UDP resources are enabled with a config flag, Traefik entry points are added by hand, and no authentication applies to those resources. Details: Pangolin vs Zorven.

NetBird added a Reverse Proxy, currently in beta, to its WireGuard private network: it publishes HTTP services behind SSO, password or PIN, forwards TCP, UDP and TLS (routed by SNI) in L4 mode, and restricts by IP, country or CrowdSec reputation. Self-hosting requires a separate netbird-proxy and Traefik as the external reverse proxy.

When should you choose Cloudflare Tunnel?

  • Your domain is already on Cloudflare and your service speaks HTTP: setup is short and scales well.
  • Your visitors are worldwide: a single-location service cannot match the latency of a 348-city network.
  • You want CDN caching, DDoS protection and other Cloudflare products in the same place.
  • Your organization already uses Cloudflare One (Zero Trust).

When should you choose Zorven?

  • You need to expose a game server or another UDP service (Pro and up) and want visitors to connect without installing anything.
  • You want to keep your domain at your current DNS provider instead of moving nameservers.
  • You want per-tunnel visitor login, a WAF, bot protection and CAPTCHA from one dashboard without wiring up separate products.
  • You want the option to run the same tool on your own server under AGPLv3. See personal for home and game servers, developers for webhooks and demos, and business for team access.

How do I move from Cloudflare Tunnel to Zorven?

  1. Download the client and save the token from your dashboard: zorven authtoken zrv_live_...
  2. Expose the service: zorven http 8080. To keep it running, use sudo zorven service install --token zrv_live_...
  3. In the dashboard, add your domain under Domains, verify it with a CNAME or TXT record at your current DNS provider and attach it to the tunnel; the certificate is issued automatically.
  4. Turn on visitor login and the WAF from the tunnel's Access and Security tabs if you need them. Details in the docs.

For a broader roundup see ngrok alternative; for plan limits see pricing.

Frequently asked questions

UDP is not among the supported service types for public hostnames; for TCP and UDP applications Cloudflare points to Spectrum, a separate product. Zorven supports UDP tunnels on Pro and up, and visitors connect to zorven.app:PORT without installing a client.
For a stable public hostname, yes: Cloudflare's docs require you to add your site to Cloudflare before publishing an application. Quick Tunnels need no domain but are meant for testing. With Zorven you verify your domain with a CNAME or TXT record at your existing DNS provider (Hobby and up).
Each Quick Tunnel supports up to 200 in-flight requests, and requests beyond that get a 429 error; Server-Sent Events are not supported. Cloudflare recommends a named tunnel for stable hostnames and production traffic.
Yes. Zorven (AGPLv3 open core), Pangolin (AGPL-3 community edition) and NetBird's Reverse Proxy, currently in beta, all run on your own server. If you only need a transport layer, frp is another option.
Cloudflare's network page lists Istanbul. Zorven's hosted service also runs in Istanbul, but in a single location with no global edge network; for a worldwide audience Cloudflare's network has the advantage.

Sources