Choosing a remote access method: Cloudflare Tunnel, WireGuard, Tailscale and the rest

“What is the best VPN?” has no answer, because the question mixes several different problems. Publishing a dashboard to your family, getting a shell on a lab server, reaching a whole home network from a hotel and joining two offices are different jobs, and the tool that is best for one is clumsy at another.

This guide gives a way to choose. It is the long-form version of the remote access picker, and it works through the same questions.

Four questions that decide it

1. What are you reaching?

• One web app. You want a hostname and a login. This is what Cloudflare Tunnel with Access is built for. No client software, nothing to open.
• One or two services such as SSH or RDP. A tunnel with Access still works. So does a mesh network such as Tailscale, which gives each device a stable address.
• A whole network of devices. You want routing. WireGuard, Tailscale with a subnet router, OpenVPN and Cloudflare’s WARP private networks all do this. A published hostname per device does not scale.
• Two networks, permanently. You want a site-to-site link. IPsec is the common language of firewalls and clouds, and WireGuard is simpler when both ends can run it.

2. Who connects?

Just you, and the answer is “whatever is least work”. A household or small team, and you want each person to have their own sign-in, with a way to remove one person without disturbing the rest. The public, and you cannot ask anyone to install a VPN client, which leaves published web apps as the only realistic choice.

The more people involved, the more identity matters. A WireGuard key is a credential per device, and when someone leaves you must find and remove their keys. A tool that signs people in through an identity provider lets you remove one account and be done.

3. What can be open?

This question divides the field in two.

Outbound-only methods need nothing open on your side. Cloudflare Tunnel, Tailscale and ZeroTier all work by having each device dial out to a coordinator. They work behind carrier-grade NAT, on a flat with a landlord’s router, and on a network where you cannot touch the firewall.

Methods that need a reachable endpoint, WireGuard, OpenVPN and IPsec, need one side to accept connections. If you can forward a port, that is fine. If you cannot, you need a small public server to act as a relay, and that server is now something you run and patch.

4. Whose infrastructure will you tolerate?

Methods that need no open port generally depend on a vendor to introduce the two ends or carry the traffic. That is a real dependency. If the vendor has an outage, your access has an outage. If your threat model rules out a third party in the path, the self-hosted options are the ones left: WireGuard, OpenVPN and IPsec, plus Headscale if you want Tailscale’s model with your own coordination server.

Neither answer is wrong. It is a trade between convenience and control, and being honest about which you value stops you buying the wrong thing.

Scenarios

A dashboard for the family, behind carrier-grade NAT. Cloudflare Tunnel with Access and emailed one-time codes. There is no inbound path, no client to install and a login in front. See Cloudflare Tunnel from scratch and Access.

A shell on a lab server from anywhere. Either a tunnel with Access (SSH through a tunnel) or a mesh such as Tailscale. The tunnel is better if you connect from machines you do not control and cannot install software on. The mesh is better if you reach many hosts.

Everything on the home network, from a laptop. WireGuard to a gateway at home if you can forward one UDP port. Tailscale with a subnet router if you cannot. Both route a subnet through a single point. Pick unusual addresses for the home network, because the usual ones clash when you connect from elsewhere. The subnet planner helps.

Joining a branch office to a head office. IPsec if the devices at each end are firewalls from different vendors, since it is the common language. WireGuard if both ends are Linux or both support it. Watch the MTU either way, using this guide.

Customers reaching an application. A published application behind normal web security, whether through a tunnel or a conventional hosting setup. Never a VPN client.

What to avoid

Port forwarding a service straight to the internet is the option that looks easiest and costs the most. It puts your address and the service in front of every scanner, and your protection becomes the service’s own login page. If you must, put a reverse proxy with authentication in front and keep the service patched. Most people who think they must, do not need to.

Stacking VPNs without a reason. Each layer shrinks the MTU and doubles the places a fault can hide. If two layers are needed, plan for it deliberately.

Sharing one credential. A single WireGuard key or one shared password used by five people means you cannot remove one person and you cannot tell who did what.

Leaving the default range on your network. 192.168.1.0/24 is on a vast number of routers. The day you tunnel into one, your laptop cannot tell its own network from the remote one.

A short decision path

1. Only web apps for people who cannot install anything: Cloudflare Tunnel with Access.
2. Few hosts or services, private use, no open port possible: Tailscale, or a tunnel with Access.
3. Whole network, port available, you want full control: WireGuard.
4. Whole network, no port available: Tailscale with a subnet router, or a WireGuard relay on a small public server.
5. Joining sites across vendors: IPsec.
6. Getting out through a restrictive network: OpenVPN over TCP 443.

The comparison table shows these side by side, and the picker will rank them for your answers.