Cloudflare Tunnel vs ngrok vs Tailscale Funnel in 2026: Limits, Prices

Every few months someone asks me how to get a webhook from Stripe or GitHub to a laptop, or how to reach a homelab box sitting behind carrier-grade NAT, and the answer has quietly changed again. In 2026 the realistic options for exposing a local service to the internet are Cloudflare Tunnel, ngrok, Tailscale Funnel, a self-hosted frp server, and the long-unmaintained localtunnel. They all solve the same problem with an outbound connection, so no inbound port is opened, but they differ in where your TLS ends, who can read your traffic, what the free tier actually allows, and whether you can put real authentication in front. This post compares them with current limits and prices, checked against vendor docs in November 2026, and ends with what I would pick for each job.

How do tunnels expose a local service without port forwarding?

The mechanism is the same everywhere. A small agent on your machine dials out to a relay over a connection your firewall already allows, and the relay accepts public traffic on your behalf and sends it back down that connection. Nothing listens on your public IP, which is why this works behind CGNAT, hotel Wi-Fi and corporate NAT.

Cloudflare describes its version plainly: cloudflared makes outbound-only connections, and each tunnel holds four long-lived connections to two Cloudflare data centres for redundancy. The firewall page lists exactly what it needs: outbound port 7844 to region1.v2.argotunnel.com and region2.v2.argotunnel.com, UDP for QUIC or TCP for HTTP/2. ngrok's agent does the same to ngrok's cloud. Tailscale Funnel rides on your tailnet's existing WireGuard connectivity. frp does it to a server you run yourself.

The differences that matter come after the packet arrives at the relay:

1. Where TLS terminates. If the relay terminates TLS, the relay operator can see plaintext requests. That is the price of having a WAF, caching or OAuth at the edge.
2. Who decides who gets in. A tunnel with no authentication is a public website. Some tools let you attach identity at the edge; others leave it to your app.
3. What the free tier caps. Bandwidth, requests, concurrent connections and stable hostnames are where the free plans differ.

Cloudflare Tunnel, ngrok, Tailscale Funnel, frp and localtunnel compared

Tool	Current version (Nov 2026)	TLS ends at	Free tier	Paid entry	Custom domain	Source
Cloudflare Tunnel	cloudflared 2026.10.7 (30 Oct)	Cloudflare edge	Available on all plans; 1,000 tunnels per account	$4.50 per tunnel per month beyond 1,000	Yes, domain must be on Cloudflare	docs, releases
Cloudflare Quick Tunnel	same binary	Cloudflare edge	No account; 200 in-flight requests, no SSE	n/a	No, random trycloudflare.com	docs
ngrok	agent 3.39.13 (22 Oct)	ngrok cloud by default	1 GB out, 20,000 HTTP requests a month, 3 endpoints, interstitial page	Hobbyist $10/month, Pay-as-you-go $20/month	Paid plans only	pricing, changelog
Tailscale Funnel	tailscale 1.104.5 (3 Nov)	Your device	All plans; Personal is free for up to 6 users	Standard $8 per user per month	No, tailnet ts.net name only	Funnel docs, pricing
frp	v0.72.0 (4 Nov)	Wherever you configure it	Free, Apache-2.0, you pay for the VPS	n/a	Yes	GitHub
localtunnel	2.0.2 (Sep 2021)	Public loca.lt server	Free, best effort	n/a	No	npm

Versions come from each project's GitHub releases or changelog on 10 November 2026. Cloudflare alone has shipped 29 cloudflared releases this year, and it supports only versions within one year of the latest, so a pinned image from last winter is already close to the edge of support.

Is Cloudflare Tunnel really free, and what is the catch?

Cloudflare's own docs say Tunnel is available on all plans, and a 16 October 2026 changelog entry set the account allowance at 1,000 tunnels, with "Tunnels for Platforms" charging $4.50 per extra tunnel per month for people who want one tunnel per device or customer. For a person or a small team, it costs nothing.

The catches are real, though, and none of them are about money:

• You need a domain on Cloudflare for a stable hostname. The hostname becomes a proxied CNAME pointing at <UUID>.cfargotunnel.com.
• Cloudflare terminates TLS. That is how it applies WAF, caching and DDoS protection, and it means Cloudflare sees your plaintext HTTP. For most homelab dashboards that is a fine trade; for a medical records system it may not be.
• Large media is restricted. The routing docs note that on Free, Pro and Business plans the service-specific terms require a paid product to serve video and other large files through public hostnames. Running Jellyfin or Plex over a free tunnel is the classic way people find this out.
• Quick Tunnels are a toy, deliberately. cloudflared tunnel --url http://localhost:8080 gives you a random trycloudflare.com URL with no account, but the limits are 200 in-flight requests (then HTTP 429), no Server-Sent Events, no uptime guarantee and a new hostname every run.

One genuinely new thing this autumn: on 2 October 2026 Cloudflare added an --allowed-mail flag so a Quick Tunnel can require an emailed one-time PIN before a visitor reaches your service. It needs a recent cloudflared; older builds such as 2026.6.x do not have the flag, which is a small, concrete reminder to update the binary before trusting a blog post (including this one).

ngrok in 2026: still the best webhook debugger, now metered

ngrok's free plan, per its free plan limits page, gives you 1 GB of data transfer out and 20,000 HTTP requests a month, a rate limit of 4,000 requests a minute, up to three online endpoints and one automatically assigned dev domain that stays the same across restarts. Browser traffic on the free tier gets an interstitial warning page, which API clients skip by sending an ngrok-skip-browser-warning header with any value. TCP endpoints need card verification on the free plan, according to the pricing page. Paid plans start at $10 a month for Hobbyist and $20 a month for Pay-as-you-go.

What ngrok does better than anyone else is the development loop. The agent's web inspection interface on localhost:4040 shows every request and lets you replay one with a click, which is exactly what you want when a payment provider's webhook signature check keeps failing and you do not want to trigger another test charge. Its Traffic Policy engine can also put an OAuth action in front of an endpoint and deny anyone whose email does not end in your company domain.

TLS for HTTPS endpoints is terminated at ngrok's cloud by default, with agent-side or upstream termination available if you configure it. Same trade as Cloudflare: the edge sees plaintext unless you opt out, and opting out means losing the edge features that need it. If you are wiring webhooks properly, my notes on webhook best practices cover signatures and retries, which matter more than which tunnel delivered the request.

Tailscale Funnel: TLS on your machine, few knobs

Funnel is the odd one out. Tailscale's relay forwards the encrypted TCP stream and the Tailscale client on your device terminates TLS before handing the request to your local service. Tailscale never holds a certificate for your hostname, which is the strongest privacy story of the hosted options.

The constraints come with that design. Funnel can only listen on ports 443, 8443 and 10000, only on DNS names inside your tailnet's domain (so machine.tailnet-name.ts.net, never app.example.com), and traffic is subject to "non-configurable bandwidth limits" that Tailscale does not publish. It needs Tailscale 1.38.3 or later, MagicDNS, HTTPS certificates enabled and a funnel node attribute in the tailnet policy file. There is no identity layer at the edge: anyone with the URL reaches your app, so authentication is your application's problem. Funnel is available on all plans, and the Personal plan is free for up to six users.

I reach for Funnel when the machine is already on a tailnet and I want to show someone a demo for an afternoon. For anything that should be private to a known group, plain Tailscale without Funnel is the better tool, and the comparison of WireGuard, Tailscale and zero-trust networking goes deeper on that side.

frp and localtunnel: self-hosted or abandoned

frp is the serious self-hosted option: Apache-2.0, about 110,000 GitHub stars, v0.72.0 released on 4 November 2026. You run frps on a VPS with a public IP and frpc next to your service; both share an auth.token. The README is candid that a v2 is in development and "will not be compatible with version 1", and that INI configuration is deprecated in favour of TOML. With frp nobody else is in the path, which also means nobody else is patching the relay, terminating TLS, absorbing a DDoS or handling abuse reports when someone finds your open endpoint. You are the edge provider now.

localtunnel's npm package was last published as 2.0.2 in September 2021. It still works on a good day, and the public loca.lt server is best effort. I would not put anything I care about through it, and I would not give a client a URL from it.

# The same local app on port 8080, exposed four ways. Versions checked 10 Nov 2026.

# Cloudflare Quick Tunnel (cloudflared 2026.10.7): random URL, no account.
# --allowed-mail (added 2 Oct 2026) puts an email one-time PIN in front.
cloudflared tunnel --url http://localhost:8080 --allowed-mail 'me@example.com'

# ngrok agent 3.39.x: stable free dev domain, inspector on localhost:4040.
ngrok http 8080

# Tailscale 1.104.x Funnel: public https://<machine>.<tailnet>.ts.net, runs in background.
tailscale funnel --bg localhost:8080
tailscale funnel status

# frp v0.72.0: frpc.toml on your machine points at frps on your own VPS.
cat > frpc.toml <<'EOF'
serverAddr = "203.0.113.10"   # your VPS
serverPort = 7000
auth.method = "token"
auth.token = "use-a-long-random-value"

[[proxies]]
name = "web"
type = "http"
localPort = 8080
customDomains = ["app.example.com"]
EOF
frpc -c frpc.toml

Should you put Cloudflare Access or OAuth in front of a tunnel?

Yes, for anything that is not meant to be public. The single most common mistake I see with tunnels is treating "no open port" as "secure". The tunnel removes your exposure to port scans on your IP; it does nothing about the URL itself, which ends up in browser history, chat logs, screenshots and, for a hostname with its own certificate, public certificate transparency logs.

Cloudflare's answer is Access. Its own self-hosted application guide warns that without an Access application, a published app "is available to anyone on the Internet", and recommends creating the Access application before adding the tunnel route. The Zero Trust free plan covers up to 50 users, and pay-as-you-go is $7 per user per month after that. Belt and braces is the tunnel's access origin setting ("Protect with Access" in the dashboard), which makes cloudflared itself validate the Access JWT before proxying, so a misconfigured DNS record or Access policy fails closed. Cloudflare also shipped URL normalization for those rules in cloudflared 2026.10.0 and says new releases will turn it on by default starting 25 January 2027, so test path-based routes before then.

ngrok's equivalent is the OAuth or OIDC action in Traffic Policy. Tailscale Funnel and frp have nothing at the edge, so you either add an authenticating proxy in front of the app or keep the service on the private tailnet. This is the same discipline platform teams apply to any ingress: identity first, then the route. The tooling changed; the order did not. I walk through the Cloudflare version end to end in how to expose a local service with Cloudflare Tunnel.

Which tunnel should you use for webhooks, demos and a homelab?

• Webhook development on a laptop: ngrok free. The stable dev domain means you register the webhook URL once, and request replay saves real time. If you blow through 20,000 requests a month, you are probably running load, not debugging.
• A permanent homelab or internal tool: a named Cloudflare Tunnel on your own domain, with an Access policy. It is free, survives reboots as a service, and puts an identity check in front. If you are building a homelab to learn, the homelab DevOps learning post covers what to run on it.
• A one-afternoon demo for one person: a Quick Tunnel with --allowed-mail, or Tailscale Funnel if you are already on a tailnet.
• Traffic no third party may read: Tailscale Funnel (TLS on your device) if ts.net names are acceptable, otherwise frp on a VPS you patch.
• Production customer traffic: none of these on a laptop. A Cloudflare Tunnel with two or more cloudflared replicas on servers is a legitimate production ingress, and Cloudflare's own Kubernetes guide runs it as a two-replica Deployment. A tunnel to a developer machine is not.

FAQ

Is Cloudflare Tunnel free?

Yes. Cloudflare lists Tunnel as available on all plans and includes 1,000 tunnels per account at no cost, charging $4.50 per tunnel per month only beyond that. You need a domain on Cloudflare for a stable hostname, and the free CDN terms restrict serving video and other large files.

What are ngrok's free tier limits in 2026?

1 GB of data out and 20,000 HTTP requests a month, 4,000 requests a minute, up to three online endpoints and one assigned dev domain. Browser visitors see an interstitial page unless the client sends the ngrok-skip-browser-warning header, and custom domains require a paid plan.

Which ports does Tailscale Funnel support?

Only 443, 8443 and 10000, and only on your tailnet's ts.net DNS names. It also needs MagicDNS, HTTPS certificates and the funnel node attribute in your policy file.

Is a tunnel safer than port forwarding?

It removes inbound exposure on your IP and hides your origin address, which is a real improvement. It does not authenticate anyone: without Cloudflare Access, ngrok OAuth or a login in your app, the tunnel URL is a public website.

This quarter I would standardise on two things: ngrok for webhook work on laptops, and named Cloudflare Tunnels with an Access policy and access validation turned on for anything long-lived, with cloudflared pinned to a recent release and updated monthly, since a one-year support window goes quickly at 29 releases a year. The rest, frp and Funnel, I keep for the specific cases where a third party in the TLS path is the problem.

Related: WireGuard, Tailscale and Zero Trust Networking, Nginx vs Caddy vs Traefik in 2026 and Self-Hosting vs SaaS in 2026.