// Compare
ingressd vs Cloudflare Tunnel.
Cloudflare Tunnel connects an origin to Cloudflare’s network with the cloudflared daemon. Visitors reach Cloudflare, which terminates TLS and forwards requests down the tunnel. ingressd does the same job with edge nodes on servers you rent, so TLS ends on your node and no third party sits in the traffic path.
// Which to choose
Both are good at different things.
Pick the one that matches where you want your traffic to run.
Choose Cloudflare Tunnel if
- You want Cloudflare’s global anycast network and DDoS capacity in front of your apps.
- You only publish HTTP and HTTPS apps, and already keep your DNS on Cloudflare.
- You would rather not run or pay for any server yourself.
Choose ingressd if
- You want TLS to end on a server you control, not at a third party.
- You publish game servers or other raw TCP and UDP services without a Spectrum or Enterprise plan.
- You want the edge to be open source, and to keep working without any account through the standalone node.
// Side by side
The differences that matter.
Taken from the full comparison of ingressd with the alternatives.
| Feature | ingressd | Cloudflare Tunnel |
|---|---|---|
| Public edge runs on | Your own VPS nodes | Cloudflare’s network |
| TLS for web apps ends at | Your node | Cloudflare |
| Open source | Node, edge and connector: Apache-2.0. The hosted panel is optional and proprietary. | cloudflared client: Apache-2.0. The service is proprietary. |
| No inbound ports at the origin | Yes | Yes |
| HTTP and HTTPS apps | Yes | Yes |
| Public TCP | Yes | Through Spectrum, on paid plans |
| Public UDP (game servers, VoIP) | Yes | Through Spectrum; all UDP needs Enterprise |
| Your own domain | Yes | Yes, with the zone on Cloudflare |
| Failover across several edges | Yes: failover DNS across your nodes | Yes: Cloudflare’s anycast network |
| Sign-in in front of apps | Email code, Google, Microsoft, Discord, Steam or passkey | Cloudflare Access, free for up to 50 users |
| Web application firewall | Coraza with the OWASP Core Rule Set, per app | Cloudflare WAF; more rules on paid plans |
| Managed from | A free hosted panel, or one config file and the CLI | Cloudflare dashboard or a config file |
| Cost | Free and open source; you pay for your VPS | Tunnel is free; Spectrum and larger Access teams are paid |
Checked against each product’s own docs in November 2026. Plans and features change; if something here is out of date, tell us on GitHub. Sources: Cloudflare Tunnel docs, Cloudflare Spectrum docs, Cloudflare Zero Trust plans.