Pangolin vs Cloudflare Tunnels: Self-Hosted Reverse Tunneling for Homelabs in 2026

Cloudflare Tunnels are the default answer for exposing a homelab without opening ports. Free, five-minute setup, works behind CGNAT. But you're renting Cloudflare's edge, agreeing to their TOS (no video streaming over the free tier, no large file hosting), and every request to your services routes through their network. Pangolin is the self-hosted alternative that's been quietly eating Cloudflare Tunnel's lunch throughout 2025 — same expose-without-port-forwarding trick, but on a VPS you own.

I've run both in production on the same homelab for six months. This is the honest breakdown.

What is a pangolin tunnel and how does it work?

Pangolin: a self-hosted reverse-tunnel platform that runs on a VPS and connects to your homelab via WireGuard, then routes public traffic through Traefik with automatic HTTPS. It's the Cloudflare Tunnels alternative for people who don't want a third party sitting between the internet and their services.

The architecture is refreshingly boring. A small VPS (€4/month is plenty) runs the Pangolin control panel, Traefik, and a WireGuard server. Your homelab runs a lightweight client — Newt — that dials out to the VPS and holds a persistent WireGuard tunnel open. Public DNS points at the VPS. Traefik terminates TLS with Let's Encrypt and forwards requests down the tunnel to whichever internal service you've wired up. No inbound ports on your home router. No CGNAT problems. No Cloudflare in the path.

If you've already read our Traefik 3 + Docker Compose guide, Pangolin will feel familiar — it's essentially a managed Traefik with a WireGuard overlay and a nice web UI for adding sites.

How does Cloudflare Tunnels compare?

Cloudflare Tunnels: a free managed tunnel service where a local cloudflared daemon dials out to Cloudflare's edge, and public traffic reaches your services through their global network. Setup is faster than Pangolin. The tradeoffs are TOS and edge lock-in.

The three things people don't mention enough:

• TOS restrictions on the free tier — no serving video, audio streaming, or large binary downloads. Read Section 2.8 of the Cloudflare TOS. This has bitten people running Jellyfin and Immich publicly. Enforcement is inconsistent, but accounts do get suspended.
• 100MB request body limit on the free plan — uploads to Nextcloud, Immich, or anything file-heavy will fail. Paid plans raise the limit but you're now paying Cloudflare monthly.
• All traffic through Cloudflare's edge — for most people this is fine. For anyone doing threat modelling that includes "a US company MITMs my TLS," it's a hard no.

Which one has the faster setup?

Cloudflare Tunnels wins on time-to-first-request. Pangolin wins on time-to-understanding-what-you-just-built.

Cloudflare Tunnels: install cloudflared, run cloudflared tunnel login, create a tunnel, add a public hostname in the dashboard, done. Ten minutes if your DNS is already on Cloudflare.

Pangolin needs a VPS first. Here's the actual flow:

1. Spin up a €4/month VPS on Hetzner or DigitalOcean with Ubuntu 24.04 — 1 vCPU and 2GB RAM handles a dozen sites comfortably.
2. Point your domain's A record at the VPS IP.
3. Install Pangolin via the official Docker Compose stack — one curl | bash installer sets up the server, Traefik, and Gerbil (the WireGuard component).
4. Log into the Pangolin web UI, create a site, and it hands you a Newt client config for the homelab.
5. Run Newt on your homelab as a Docker container — it dials out to the VPS and the tunnel comes up.
6. Add resources (services) in the UI with the internal hostname and port, and Pangolin generates the Traefik routes and Let's Encrypt cert automatically.

Realistically: 30-45 minutes end to end if you've never done it before. The Fossorial docs are decent but assume you know what Traefik middleware is.

How does latency actually compare?

Cloudflare Tunnels is faster to Cloudflare's nearest PoP, then adds a hop to your origin. Pangolin is one direct WireGuard hop to your VPS, then to your homelab. Real-world difference on my UK homelab with a Hetzner VPS in Falkenstein: Pangolin averaged 18ms TTFB, Cloudflare Tunnels averaged 42ms.

Sounds like a win for Pangolin. It is — but only if your VPS is geographically close to your users. Cloudflare's edge has 300+ PoPs; a random user in Sydney hitting your Pangolin instance in Germany will feel it. For homelabs where the users are you and your family, in one country, Pangolin wins on latency. For anything with a global audience, Cloudflare's edge network is the correct answer.

Which one should you actually use?

Verdict: use Pangolin if you self-host media, cloud storage, or anything Cloudflare's TOS excludes. Use Cloudflare Tunnels for everything else.

Concretely:

• Use Pangolin for Jellyfin, Immich, Nextcloud, PhotoPrism, personal Git hosting, anything with large file uploads, or when you want zero third-party middleware in the request path. Also the right call if you're running Coolify or a self-hosted PaaS and want tunnelled deploy previews.
• Use Cloudflare Tunnels for personal blogs, documentation sites, small web apps, dashboards, homelab services with tiny payloads (Uptime Kuma, Home Assistant, Grafana), and anything where TOS restrictions don't apply. Free, dead simple, and DDoS protection is a real perk.
• Use both — this is what I do. Public blog and dashboards on Cloudflare, media stack and file sync on Pangolin. You're not obligated to pick one.

What about the alternatives — Tailscale Funnel, ngrok, frp?

Tailscale Funnel is elegant but limited to three ports and restricted subdomains under ts.net. Fine for personal use, awkward for a proper public domain. ngrok is developer-tunnel-first — priced for temporary dev tunnels, not always-on services. frp is the closest OSS analogue to Pangolin but you're building the Traefik + Let's Encrypt + admin UI layer yourself.

Pangolin bundles that stack. That's the whole pitch.

FAQs

Is Pangolin free?

Yes, Pangolin is open-source (AGPL-3.0) and free to self-host. You pay only for the VPS it runs on — a €4/month Hetzner CX22 or a $6/month DigitalOcean droplet is enough for most homelabs.

Does Pangolin work behind CGNAT?

Yes. The Newt client dials outbound to your VPS over WireGuard, so no inbound ports are needed at home. This is the same escape-hatch Cloudflare Tunnels provides, which is why both are popular with anyone on Starlink, 4G/5G home broadband, or CGNAT-locked ISPs.

Can I use Cloudflare Tunnels for Jellyfin or Plex?

Technically it works, but Cloudflare's TOS Section 2.8 prohibits video streaming over the free tier and accounts have been suspended for it. If you want to expose a media server publicly, use Pangolin or another self-hosted tunnel instead. Keep Cloudflare Tunnels for services that don't stream media.

Do I need a domain name for Pangolin?

Yes — you need a domain pointed at your VPS so Traefik can issue Let's Encrypt certificates. Cheap options like Namecheap or Cloudflare Registrar (at cost) work fine. A wildcard cert covers all your subdomains, which Pangolin handles automatically via DNS-01.

Is there a WireGuard performance hit?

Minimal. WireGuard adds roughly 1-2ms of encryption overhead per hop on modern hardware. The dominant latency factor is VPS location, not the tunnel itself. Pick a VPS region close to where you actually are.

Can I run Pangolin on my existing VPS alongside other services?

Yes, but be careful about port 80/443 conflicts. Pangolin's Traefik will want to own those ports. If you're already running Traefik for other services, either consolidate under Pangolin's Traefik or run Pangolin's stack on a dedicated VPS. Mixing two Traefik instances on one host is more pain than it's worth.