XDA published a piece about replacing every Cloudflare service in a homelab, and the comments turned into a long thread of people quietly building exit strategies. Cloudflare’s outages this year, the slow tightening of free-plan limits, and the trust friction around the orange cloud have all pushed homelab and small-team operators to look at the alternatives more seriously. We tested seven Cloudflare alternatives across the four services people lean on most: CDN, public DNS, secure tunneling, and the WAF in front of self-hosted services.
The tests ran on Windows 11, macOS Sequoia, and Ubuntu 24.04, behind a CGNAT connection so we could properly stress NAT traversal and tunnel reliability. Each pick below earned its spot by being practical to run, not just possible to install.
Quick comparison
| App | Best for | Free plan | Starting price/mo | Standout feature |
|---|---|---|---|---|
| Bunny.net | Pay-as-you-go CDN | No, $1 minimum | $0.005/GB | Per-region pricing |
| Fastly | Edge compute heavy sites | $50 trial credit | Custom | VCL-level control |
| Pangolin | Self-hosted tunnel replacement | Yes, fully | Free | WireGuard + auth in one binary |
| Tailscale Funnel | Public exposure of one service | Yes | Free | Built into existing Tailnet |
| NextDNS | Public DNS with filtering | 300k queries/mo | $1.99 | Per-device profiles |
| BunkerWeb | WAF in front of self-hosted | Yes | Free | Nginx-based, modular |
| Akamai | Enterprise CDN + edge | No | Custom | Largest edge footprint |
Why people leave Cloudflare
Three reasons keep showing up in the threads:
- Outage exposure. When Cloudflare goes down, your DNS, CDN, tunnels, and WAF all go with it. Operators who spread these across vendors recover faster.
- Free-tier scope creep. Features that were free have moved behind paid plans, and Workers free quotas have shrunk. The line between “fine for hobby” and “you need Pro” keeps moving.
- Privacy and traffic decoration. Some homelabs prefer not to terminate TLS at a third party. Self-hosted tunnels and direct CDN-to-origin paths sidestep that.
The picks below cover those reasons. None of them replace the full Cloudflare stack on their own, which is the point: spreading services across vendors is the protection.
The Cloudflare alternatives
Bunny.net, the pay-as-you-go CDN
Bunny.net is the CDN people swap to first because the pricing is per-GB by region and the dashboard is built for one engineer rather than a team. Storage Zones cover origin storage, Pull Zones handle CDN delivery, and Magic Containers run edge compute. For a static-site or small SaaS workload, the monthly bill rounds to coffee money.
Where it falls short: the security stack is thinner than Cloudflare’s. Bot mitigation is basic, and there is no equivalent to Cloudflare’s Bot Management beyond simple rules.
Pricing:
- Per-GB by region, starting at $0.005/GB in North America and Europe.
- $1 minimum monthly spend.
Migrating from Cloudflare: point DNS records at Bunny Pull Zones and update your origin hostname. No special tooling. Allow a couple of hours for global propagation and cache warming.
Download: Bunny.net dashboard
Bottom line: the right first swap for anyone running static sites, image delivery, or a small public API behind Cloudflare today.
Fastly, the edge for teams that want control
Fastly is the CDN large publishers use when they need to push logic to the edge. VCL gives you scripting at every layer of the request, Compute@Edge runs Rust or JavaScript workers, and the cache is built for instant purge at scale. The free trial ($50 credit) is generous enough to run a real workload through it.
Where it falls short: the platform expects you to know what you’re doing. The dashboard is not opinionated, and the bill can climb quickly if you misconfigure cache TTLs.
Pricing:
- $50 trial credit.
- Custom pricing for sustained traffic.
Migrating from Cloudflare: Page Rules and Workers do not translate directly to VCL or Compute@Edge. Expect a real migration project, not a DNS swap.
Download: Fastly console
Bottom line: the pick when you outgrow opinionated CDN platforms and need to write your own caching logic.
Pangolin, the self-hosted tunnel replacement
Pangolin is the open-source alternative to Cloudflare Tunnel that the homelab forums keep recommending. It bundles WireGuard, identity-based auth, and a small management UI into one container. You run it on a VPS with a public IP, register your downstream services, and Pangolin handles the rest. Setup is roughly a docker compose file and a DNS record.
Where it falls short: you still need the VPS. If your goal was to avoid running infrastructure, Pangolin moves the work rather than removing it. The auth providers are smaller than Cloudflare Access.
Pricing:
- Free, open source, self-hosted.
Migrating from Cloudflare: Cloudflare Tunnel maps cleanly to a Pangolin newt client. Replace the cloudflared install with the Pangolin agent, update DNS, and your tunnels run on your VPS.
Download: Pangolin on GitHub
Bottom line: the open-source pick for replacing Cloudflare Tunnel without giving up the public hostname pattern.
Tailscale Funnel, the path of least resistance
Tailscale Funnel exposes a single Tailscale node’s port to the public internet over HTTPS, with auth optional via Tailscale Serve. If you already run Tailscale for remote access, Funnel is a checkbox away from publishing a self-hosted service. No additional VPS, no extra DNS records, no separate auth provider.
Where it falls short: only one service per node by default, and you cannot easily front it with a custom domain at the apex. Throughput is capped by your home upload.
Pricing:
- Free on the Tailscale free plan.
Migrating from Cloudflare: swap your Cloudflare Tunnel for tailscale funnel on the target node. Update DNS to the assigned ts.net subdomain or front it behind your own reverse proxy.
Download: Tailscale download
Bottom line: the laziest swap if you already run a Tailnet. Hard to beat for a single self-hosted service.
NextDNS, the consumer-grade Cloudflare DNS swap
NextDNS replaces 1.1.1.1 with per-device profiles, blocklists, allowlists, and analytics. Configuration is per-device or per-network, the apps cover every platform people care about, and the free tier handles a household.
Where it falls short: the free tier caps at 300,000 queries per month, which a heavy household can blow through. Some enterprise features (logging retention, multi-tenant control) sit behind paid plans.
Pricing:
- Free up to 300,000 queries per month.
- Pro plans start around $1.99 per month for unlimited queries.
Migrating from Cloudflare: change your router’s resolver from 1.1.1.1 to your NextDNS endpoint. Apps install per-device for DoH or DoT support.
Download: NextDNS configuration
Bottom line: the pick for replacing Cloudflare’s public DNS at the household or small-office level with a real config surface.
BunkerWeb, the WAF that runs on your box
BunkerWeb is the open-source Nginx-based WAF that goes in front of your self-hosted services. It bundles ModSecurity, bad-bot lists, rate limiting, and JWT auth in one container. The web UI lets you manage rules without editing config files, which is the difference between using it and not.
Where it falls short: you are running Nginx, with all the operational weight that brings. SSL certificate renewal, log rotation, and resource limits are your problem.
Pricing:
- Free, open source.
- Paid Pro plan with extra plugins.
Migrating from Cloudflare: Page Rules do not map. Reproduce your protections (rate limits, country blocks, bot rules) as BunkerWeb rules, then point DNS at your edge node.
Download: BunkerWeb on GitHub
Bottom line: the pick when you want a real WAF in front of self-hosted services without sending traffic through a third party.
Akamai, the enterprise pick
Akamai is the CDN at the other end of the size scale. The edge footprint is the largest in the industry, the security suite (Kona Site Defender, Bot Manager) is heavy, and the prices match. For a homelab, this is overkill. For a regulated enterprise that wants somewhere other than Cloudflare for its public edge, Akamai is the obvious choice.
Where it falls short: sales-led pricing. Onboarding is measured in weeks, not afternoons.
Pricing:
- Custom, sales-led.
Migrating from Cloudflare: an Akamai SE will write you a migration plan. Expect a structured project.
Download: Akamai control center
Bottom line: the right answer when the org has a procurement department and a regulator to satisfy.
How to choose
For a homelab, pair Bunny.net or no CDN at all with Pangolin or Tailscale Funnel and NextDNS. That spreads your eggs across small vendors and keeps every piece replaceable.
For a small SaaS, swap CDN to Bunny.net, leave DNS where it is (or move to NextDNS for the team profile), and pick BunkerWeb if you want a real WAF.
For an enterprise replacing Cloudflare at scale, Fastly or Akamai are the realistic peers. Pick Fastly if you want to write code at the edge. Pick Akamai if you want a vendor relationship that satisfies a procurement review.
Stay on Cloudflare if your stack already leans on Workers, R2, and Zero Trust together, and you would otherwise rebuild three vendors’ worth of integrations. The single-vendor risk is a real cost, but so is fragmenting the stack.
FAQ
Is there a free Cloudflare alternative for tunnels? Yes. Pangolin and Tailscale Funnel both run for free. Pangolin needs a VPS, Funnel runs on top of any Tailnet.
What is the cheapest Cloudflare CDN alternative? Bunny.net, by a wide margin. Per-GB pricing starts at half a cent in North America and Europe, and there is no required commitment beyond the $1 monthly minimum.
Can I replace Cloudflare’s WAF without paying? BunkerWeb covers the open-source case. It runs Nginx with ModSecurity rules and bad-bot lists, and the free tier covers everything most self-hosters need.
Should I move DNS off Cloudflare too? Only if you care about diversifying outage exposure or want per-device filtering. NextDNS is the obvious pick for households. For business DNS, dnsimple and Route 53 are common neighbors.
What about Cloudflare Workers alternatives? Fastly Compute@Edge and Bunny Magic Containers are the closest peers. Fastly is more mature, Bunny is friendlier for small workloads.
Is it worth replacing Cloudflare entirely? For most homelabs, no, because the time cost dwarfs the savings. For teams that depend on uptime independence, the answer is yes, and the right pattern is replacing one service at a time.
