Compare the methods
Seven ways to reach something that is not on the network you are on. The differences that matter are who can connect first, what has to be open, and who runs the middle.
| Method | How it connects | Needs an inbound port | Client needed | Identity | Who runs the middle | Best for |
|---|---|---|---|---|---|---|
| Cloudflare Tunnel with Access | Outbound from your server to Cloudflare | No | None for web apps. cloudflared or WARP for SSH and private networks. | Built in: identity providers and emailed one-time codes | Cloudflare. Hosted only. | Publishing apps and shells to yourself or a small team without opening a port. |
| WireGuard | Peer to peer over UDP | At least one end needs a reachable address | WireGuard client | None: a key pair per device | You | Fast, simple private access and site-to-site links that you fully own. |
| Tailscale (and Headscale) | WireGuard mesh with NAT traversal and relays | No | Tailscale client | Sign in with an identity provider | Tailscale, or Headscale if you self-host | Private access for people and devices behind NAT, with little setup. |
| ZeroTier | Peer to peer virtual Ethernet | No | ZeroTier client | Members approved into a network | ZeroTier root servers. Controllers can be self-hosted. | Making remote devices appear on one Layer 2 network. |
| OpenVPN | Client to server over TLS, on UDP or TCP | Yes, at the server | OpenVPN client | Certificates, or usernames with a backend | You | Getting out of restrictive networks (TCP 443) and legacy compatibility. |
| IPsec (IKEv2) | Gateway to gateway, or client to gateway | Yes, UDP 500 and 4500 | Built into most operating systems and firewalls | Certificates, pre-shared keys or EAP | You | Joining networks across vendors, such as a firewall to a cloud gateway. |
| Port forwarding and a reverse proxy | Inbound from the internet to your network | Yes | None | Whatever the proxy provides | You | Little. Use it only when nothing above fits, and put authentication in front. |
Reading the table
The inbound column is the one that surprises people. Cloudflare Tunnel, Tailscale and ZeroTier all work from behind carrier-grade NAT, because every device dials out. WireGuard, OpenVPN and IPsec each need an address that something can reach, which is the reason people rent a small public relay when their home connection will not give them one.
The last column is the trade. The methods that need nothing open depend on someone else's infrastructure to introduce the two ends. The ones you fully own need a door you control. Neither is a mistake, so decide which cost you would rather carry.
Not sure which fits? The remote access picker asks six questions and shows its working, and the guide explains the reasoning.
Benchmarks are not here yet
Plenty of comparison pages quote throughput and latency figures with no method behind them. This one will not. Numbers will go up only when they can be reproduced, with the method published alongside.
The plan for the benchmark lab:
- Throughput with iperf3 over TCP and UDP, several runs each, reporting the spread as well as the average.
- Latency under idle and loaded conditions, because a tunnel that behaves when idle can still queue badly under load.
- CPU use on a Raspberry Pi class device and on a small x86 virtual machine, since that is where most homelab tunnels run.
- Connection set-up time and recovery time after the link drops.
- The effect of MTU and MSS settings, using the figures from the calculator.
Raw results and scripts will be published with each run. Until then, treat any figure you see elsewhere as a claim, not a measurement.