Both Tailscale Funnel and Cloudflare Tunnels solve the same problem — getting public traffic to a service behind NAT without forwarding a port — but they make opposite architectural bets. A deep dive on the data planes, who terminates your TLS, the identity models, the real limits, and which one to actually reach for.
Nat-Traversal
-
Tailscale Funnel vs Cloudflare Tunnels: Two Ways to Expose a Service Through NAT -
WireGuard vs OpenVPN vs Tailscale Three things people call "a VPN" that operate at different layers. The cryptographic protocol differences between WireGuard and OpenVPN, why Tailscale is a control plane rather than a competing protocol, the NAT-traversal story for each, and an honest decision framework for which to actually run.