Remote access that never opens a port.
Guides, calculators and honest comparisons for Cloudflare Tunnel, WireGuard and the rest of the tunnelling family, written by a network engineer who runs them.
What one tunnel costs every packet
A tunnel wraps each packet in more headers, and the wrapping comes out of the same 1500 bytes your link allows. Pick a tunnel and see how much room is left for your data.
- Added per packet
- 60 bytes
- Inner MTU
- 1440
- TCP MSS for IPv4 traffic
- 1400
- TCP MSS for IPv6 traffic
- 1380
UDP plus a 32 byte WireGuard data header and tag. wg-quick usually lands on 1420 for a 1500 byte link because it plans for an IPv6 outer header.
Cloudflare Tunnel is different: it proxies HTTP, SSH and TCP at the application layer, so published apps have no inner MTU to tune. It only matters for private network routing. Stack tunnels in the full calculator.
Start with these
- Cloudflare Tunnel Cloudflare Tunnel from scratch: publish a service without opening a port Install cloudflared, create a locally-managed tunnel, write the ingress rules, route DNS and run it as a service. Includes what each step is for. 5 min read
- Networking MTU, MSS and tunnels: why some sites load and others hang Why tunnelled links break on big packets, how Path MTU Discovery fails, how to measure the real MTU with a ping, and the three ways to fix it. 6 min read
- Comparisons Choosing a remote access method: Cloudflare Tunnel, WireGuard, Tailscale and the rest A decision guide built on four questions: what you are reaching, who connects, what can be open and whose infrastructure you will tolerate in the middle. 5 min read
Tools that run in your browser
Nothing you type is sent anywhere. Each tool is a page of plain JavaScript that works offline once it has loaded.
- cloudflared config generator Build a tunnel config.yml with ingress rules, a hardened systemd unit and the commands to bring it up.
- MTU and MSS calculator Stack tunnels over a real link and get the inner MTU, TCP MSS, a ping test and the clamp rules.
- Remote access picker Answer six questions about what you need to reach and who needs to reach it, and see which methods fit.
- Subnet planner Carve a private range into right-sized subnets, and steer clear of the ranges that clash when you tunnel in.
How this site works
Examples you can run
Commands use real syntax and realistic values on reserved example domains, so nothing points at anyone's actual network. Swap in your own hostnames and it works.
The trade-offs, stated
Every method here gives something up. A tunnel that needs no open port depends on a vendor. A self-hosted one needs a reachable endpoint. The guides say which is which.
No numbers we did not measure
Where a figure comes from a specification, we say so. Benchmarks will be published with their method and raw results, or not at all.