Anyone who has ever hosted a small service at home and then moved apartments knows the pattern. The new ISP puts us behind carrier-grade NAT, our public IPv4 becomes a shared address that hundreds of other subscribers use, and every “just port-forward it” tutorial goes silent. Cloudflare Tunnel and a handful of similar tools solve this quietly and cheaply. We tested seven of them across a real CGNAT home network for two weeks. This is the working shortlist.
What to look for in a CGNAT bypass app
The problem is not one problem. It is three:
- Reaching a service behind our home LAN without any inbound port
- Encrypting the traffic so the tunnel provider or intermediate hop cannot read it
- Not paying a subscription unless the feature set really justifies one
A working CGNAT solution should give us:
- Outbound-only connection from our home to a relay we trust
- Full end-to-end encryption, not just TLS to the relay
- A stable hostname we can point our phone or laptop at
- Reasonable bandwidth ceilings for streaming and downloads
- Steam Deck, Windows, macOS, and Linux clients for real portability
Quick comparison
| App | Best for | Platforms | Free plan | Standout feature |
|---|---|---|---|---|
| Cloudflare Tunnel | Public HTTPS services | Windows, macOS, Linux | Free tier | Free custom domain and TLS |
| Tailscale | Personal mesh across our devices | Windows, macOS, Linux, iOS, Android | Free for 3 users, 100 devices | Zero-config WireGuard mesh |
| ZeroTier | LAN-style mesh with granular routing | Windows, macOS, Linux, iOS, Android | Free for 25 devices | Layer-2 emulated LAN |
| ngrok | Quick public URL for a local port | Windows, macOS, Linux | Free tier with rate limits | Instant HTTPS in one command |
| WireGuard | DIY tunnel through a cheap VPS | Windows, macOS, Linux, iOS, Android | Free, open source | Fastest tunnel we tested |
| Twingate | Zero-trust remote access for teams | Windows, macOS, Linux, iOS, Android | Free for 5 users | Identity-aware access control |
| Localtonet | Simple reverse tunnel with TCP/UDP | Windows, macOS, Linux | Free tier | Non-HTTP protocols supported |
The apps
1. Cloudflare Tunnel, best overall for public HTTPS services
Cloudflare Tunnel is the direct answer to CGNAT for anyone hosting a Plex server, a Home Assistant instance, or a small website at home. We run the free cloudflared daemon, log in with our Cloudflare account, and Cloudflare relays HTTPS to our home. Custom domain and free TLS included. Zero Trust access rules gate who reaches what.
Where it falls short: HTTP/HTTPS only for the free tier. Non-web services need Cloudflare Access with a client-side warp component.
Pricing:
- Free tier covers unlimited tunnels and 50 users per Zero Trust org.
- Paid Access adds SSO and audit logs from around $7 per user per month.
Platforms: Windows, macOS, Linux, Docker, ARM (Raspberry Pi)
Download: GitHub Releases · Publisher site
Bottom line: The default recommendation. Free, fast, reliable, and it survives ISP changes.
2. Tailscale, best for a personal mesh across our devices
Tailscale builds a WireGuard mesh across our devices with almost no configuration. The moment we install it on a laptop and a home server, they can reach each other by hostname even from a coffee shop. MagicDNS gives every device a memorable name. Steam Deck, iOS, Android all work.
Where it falls short: Free tier caps at three users. Not aimed at public-facing services unless we use Tailscale Funnel.
Pricing:
- Personal free plan covers 3 users and 100 devices.
- Personal Plus around $5 per user per month for advanced ACLs.
Platforms: Windows, macOS, Linux, iOS, Android, Steam Deck
Download: Publisher site · GitHub Releases
Bottom line: The pick if only we and our own devices need access. Setup takes five minutes.
3. ZeroTier, best for LAN-style mesh with granular routing
ZeroTier predates Tailscale and emulates a layer-2 LAN across the internet. Same subnet across three continents if we want. Sensible if we run games or protocols that assume a LAN. The controller is either ZeroTier’s cloud or a self-hosted ztncui.
Where it falls short: Higher CPU overhead than WireGuard. UI is dated. Free tier limits to 25 devices.
Pricing:
- Free for up to 25 devices.
- Paid tiers from around $5 per month for 100+ devices.
Platforms: Windows, macOS, Linux, iOS, Android
Download: Publisher site · GitHub Releases
Bottom line: For the LAN-emulation use case. Retro LAN gaming across households works out of the box.
4. ngrok, best for a quick public URL
ngrok solves the “we need to demo this local service to someone right now” problem. One command turns a local port into an HTTPS URL. TCP tunneling with a paid plan. Free tier fine for occasional use.
Where it falls short: Free URLs are random each session. Bandwidth-limited on the free tier. Not built for 24/7 hosting.
Pricing:
- Free tier with rate limits.
- Personal plan from around $10 per month for a reserved domain.
Platforms: Windows, macOS, Linux
Download: Publisher site
Bottom line: For temporary tunnels, not a home server backbone. Cloudflare Tunnel is the better default for anything long-lived.
5. WireGuard, best for a DIY tunnel through a cheap VPS
WireGuard is the modern kernel-level VPN protocol behind Tailscale. Skip the wrapper and run it directly against a $5-per-month VPS. We get a public IP at the VPS and reverse-proxy anything we like. Zero third-party knowledge of our traffic.
Where it falls short: We do the plumbing. Nginx or Caddy on the VPS handles the routing. Steeper setup than the managed options.
Pricing:
- WireGuard itself is free.
- VPS from around $4 per month at providers like Hetzner or Vultr.
Platforms: Windows, macOS, Linux, iOS, Android
Download: Publisher site · GitHub Releases
Bottom line: For anyone who wants full control and does not mind an evening of configuration.
6. Twingate, best for zero-trust team access
Twingate replaces traditional VPN with identity-aware access. Each user authenticates through their SSO provider, then reaches only the resources their group is allowed. Suits a small team more than a solo homelab operator.
Where it falls short: Not aimed at public services. Free tier limits to five users.
Pricing:
- Free tier for 5 users and 10 resources.
- Paid from around $10 per user per month.
Platforms: Windows, macOS, Linux, iOS, Android
Download: Publisher site
Bottom line: For distributed teams sharing a home lab. Solo users can skip.
7. Localtonet, best for non-HTTP protocols
Localtonet supports TCP, UDP, and HTTP tunneling through a hosted relay. Useful for exposing a game server, an SSH port, or a Minecraft server behind CGNAT without paying ngrok’s rate. Custom subdomains on paid tiers.
Where it falls short: Newer than the others; less community documentation. Free-tier limits on concurrent tunnels.
Pricing:
- Free tier with one static tunnel.
- Paid from around $4 per month for more tunnels and custom subdomains.
Platforms: Windows, macOS, Linux
Download: Publisher site
Bottom line: The pick when we need TCP or UDP forwarding, not just HTTPS.
How to pick the right one
If we want to publish a service on the open web: Cloudflare Tunnel.
If we only need our own devices to reach our home: Tailscale.
If we want emulated-LAN games or protocols: ZeroTier.
If we need a public URL for the next twenty minutes: ngrok.
If we want full control and a cheap VPS: WireGuard.
If we run a small team homelab: Twingate.
If we need TCP or UDP forwarding for a game server: Localtonet.
FAQ
What is the best free way to bypass CGNAT?
Cloudflare Tunnel for HTTPS services and Tailscale for device-to-device access. Both have permanent free tiers that cover most home use.
Do these actually punch through CGNAT?
Yes. They all use outbound-only connections from our home to a relay, which is what makes CGNAT irrelevant.
Is Cloudflare Tunnel better than Tailscale?
Different jobs. Cloudflare Tunnel is for public services. Tailscale is for private mesh access between our own devices.
Can I use one of these to bypass CGNAT for gaming?
For game servers we host at home, ZeroTier or Localtonet. For playing multiplayer games with friends, ZeroTier’s emulated LAN handles LAN-only titles well.
Which uses the least bandwidth overhead?
WireGuard, by a small margin. Tailscale and ZeroTier layer their own management on top of WireGuard-derived protocols.
