// Compare
ingressd and the alternatives.
Cloudflare Tunnel, ngrok, Tailscale Funnel, Pangolin and frp all publish services without opening ports at home. They differ in whose servers carry your traffic, what they carry and what sits in front of your apps.
| Feature | ingressd | Cloudflare Tunnel | ngrok | Tailscale Funnel | Pangolin | frp |
|---|---|---|---|---|---|---|
| Public edge runs on | Your own VPS nodes | Cloudflare’s network | ngrok’s network | Tailscale’s relays | Your VPS, or Pangolin Cloud | Your server |
| TLS for web apps ends at | Your node | Cloudflare | ngrok, by default | Your device | Your VPS | Your server or your app |
| Open source | Node, edge and connector: Apache-2.0. The hosted panel is optional and proprietary. | cloudflared client: Apache-2.0. The service is proprietary. | No | Client: BSD-3-Clause. Relays and control plane are proprietary. | Community Edition: AGPL-3.0. Enterprise Edition is commercial. | Apache-2.0 |
| No inbound ports at the origin | Yes | Yes | Yes | Yes | Yes | Yes |
| HTTP and HTTPS apps | Yes | Yes | Yes | Yes, on ports 443, 8443 and 10000 | Yes | Yes |
| Public TCP | Yes | Through Spectrum, on paid plans | Yes; a random address on the free plan | TLS connections only | Yes | Yes |
| Public UDP (game servers, VoIP) | Yes | Through Spectrum; all UDP needs Enterprise | No | No | Yes | Yes |
| Your own domain | Yes | Yes, with the zone on Cloudflare | Paid plans | No, *.ts.net names only | Yes | Yes |
| Failover across several edges | Yes: failover DNS across your nodes | Yes: Cloudflare’s anycast network | Yes: ngrok’s global network | Not documented | Enterprise Edition and Pangolin Cloud | No; load balancing across clients only |
| Sign-in in front of apps | Email code, Google, Microsoft, Discord, Steam or passkey | Cloudflare Access, free for up to 50 users | OAuth and OIDC in Traffic Policy | No; Funnel is public | Built-in users, roles and SSO | HTTP basic auth |
| Web application firewall | Coraza with the OWASP Core Rule Set, per app | Cloudflare WAF; more rules on paid plans | OWASP Core Rule Set actions in Traffic Policy | No | Not built in | No |
| Managed from | A free hosted panel, or one config file and the CLI | Cloudflare dashboard or a config file | ngrok dashboard, API or agent config | Tailscale CLI and admin console | Its own self-hosted dashboard | Config files, with a status dashboard |
| Cost | Free and open source; you pay for your VPS | Tunnel is free; Spectrum and larger Access teams are paid | Free tier with monthly limits; paid plans | Included in Tailscale plans; bandwidth limits are not configurable | Community Edition is free; you pay for your VPS | Free; you pay for your server |
Checked against each product’s own docs in November 2026. Plans and features change; if something here is out of date, tell us on GitHub. Sources: Cloudflare Tunnel docs, Cloudflare Spectrum docs, Cloudflare Zero Trust plans, ngrok pricing and limits, ngrok free plan limits, ngrok OWASP CRS actions, Tailscale Funnel docs, Pangolin docs, Pangolin clustering, Pangolin on GitHub, frp on GitHub.
// One by one
When each one fits.
Every tool here is a good choice for someone. Each page says when to pick it over ingressd, and when not to.