Pangolin or Cloudflare Tunnel for exposing a home server?

Use Cloudflare Tunnel if you publish ordinary web apps, want no VPS bill and want someone else to absorb a flood. Use Pangolin if you stream media, upload large files, need raw ports for people who will never install a client, or want TLS to terminate on a machine you rent rather than at a company you do not. Neither is a VPN in the Headscale vs wg-easy sense: both put a service on a public hostname that strangers can reach.

The architecture is the same shape in both. A small daemon at home dials out, so nothing is forwarded on your router and CGNAT stops mattering. What differs is the far end of that connection. With Cloudflare it is Cloudflare's network. With Pangolin it is a VPS you rent, running three containers you administer.

Who holds the edge, side by side#

Assembled from Pangolin's install docs, VPS guide and compose file, and Cloudflare's tunnel, firewall and limits pages, as of October 2026:

The first row produces most of the others. Whoever terminates TLS sees plaintext, sets the upload limit, and writes the terms of service.

The video clause is real, and Cloudflare says it covers tunnels#

Two answers circulate. One says Cloudflare Tunnel is a Zero Trust product rather than the CDN, so the CDN's video rule does not apply. The other says Cloudflare bans media over tunnels outright. Both are wrong, and Cloudflare's own documentation settles it.

The service-specific terms for application services, last updated 28 September 2026, say that unless you are an Enterprise customer, you must use specific paid services (the Developer Platform, Images, Stream) "in order to serve video and other large files via the CDN", and that Cloudflare may disable or limit your use of the CDN if you serve "video or a disproportionate percentage of pictures, audio files, or other large files" without them. The separate Zero Trust terms say nothing about Tunnel or video, which is where the first answer comes from.

It does not survive Cloudflare's tunnel docs. The routing page states that public hostname routes proxy traffic through Cloudflare and that on Free, Pro and Business plans the service-specific terms apply. The video policy page says the same, then adds the exception the second answer misses: the restriction does not apply to private network routes, meaning devices enrolled in your Zero Trust organization, usually through the Cloudflare One client, rather than a public hostname. The private networks page goes further and names media servers as a workload those routes can carry.

So a Jellyfin library on media.example.com through a free tunnel is inside the clause. The same library reached by family members running the Cloudflare One client on a private route is not. If the people watching will never install a client, Pangolin, or a plain public IP, is the answer. Jellyfin vs Plex covers the server side.

The 100 MB request limit is the quieter version of the same problem. Cloudflare returns 413 above it on Free and Pro, so a phone uploading a long video to Immich through the tunnel fails in a way that looks like an Immich bug.

What Pangolin's Community Edition actually gates#

Pangolin's install docs offer a choice of Community or Enterprise Edition without saying what differs. The answers are in three other places.

The LICENSE file says files carrying a "Fossorial Commercial License" header are commercial, and every file without a header defaults to AGPL-3. The README calls Community Edition free, open source and AGPL-3, and Enterprise Edition open core under the Fossorial Commercial License. The Enterprise docs say both editions provide the same core functionality, Enterprise unlocks additional features on the ee image with a licence key, and it is free for personal use and organizations under $100,000 USD gross annual revenue. You still apply for that key with an account at app.pangolin.net, and the docs warn that inaccurate representation gets it revoked.

The docs then point to the self-hosted pricing table as the source of truth. In October 2026 it shows Community Edition with:

• 2FA, OAuth2/OIDC and server-level identity providers, with user auto provisioning
• geoblocking, API keys, blueprints, labels and multi-site routing
• browser-based SSH, RDP and VNC resources, and client-based SSH and HTTP private resources

And locked to Enterprise:

• multiple roles per user, Google and Azure identity providers, role-based SSH
• 2FA enforcement, session and password policies, device posture, device approvals
• HTTP request, authentication, network and admin action logs, CSV export, SIEM streaming
• wildcard resources, standalone health checks, alert rules and automatic site updates
• clustering and geographic distribution, which need Scale ($1,249 a year) rather than Starter ($449)

The logs line is the one a homelab notices. Community Edition does not record HTTP requests or logins in the dashboard; the Traefik access log on the VPS is still yours to read. And the free Enterprise key counts users and sites, so going over the quantity on it turns features off and shows a red "Unlicensed" banner.

Switching editions is an image swap between fosrl/pangolin:latest and fosrl/pangolin:ee-latest on the same database schema, so you can start on Community and move later.

What running Pangolin costs you#

The install is one script and about three minutes. The ongoing cost is that you now operate an internet-facing server:

curl -fsSL https://static.pangolin.net/get-installer.sh | bash
sudo ./installer   # edition, base domain, dashboard domain, Let's Encrypt email

The shipped compose file runs Traefik with network_mode: service:gerbil, so all four ports appear on the Gerbil container, and Gerbil needs NET_ADMIN and SYS_MODULE. The VPS guide warns that 1 GB of RAM may need swap during installs and updates. Every byte a visitor downloads crosses that VPS, so a provider's bandwidth allowance is part of the sizing. Keep the OS patched and read A security baseline for a home server before pointing DNS at it.

Raw TCP and UDP take more than a toggle. You set allow_raw_resources: true, open the port in the VPS firewall, add it to the Gerbil ports: list and add a Traefik entry point, then restart. Pangolin's docs state that these resources get no Pangolin authentication: they are pipes. That is right for a game server and wrong for an admin panel.

The DDoS argument, and where it runs out#

Cloudflare's tunnel docs say traffic through a published hostname gets CDN caching, WAF and DDoS protection applied automatically. With Pangolin, DNS points at your VPS's public IP and what stands between it and a flood is your VPS provider.

How much that matters depends on what you publish. A family photo album and a Vaultwarden instance are not targets. A public game server or anything that attracts attention is. If you want both, Pangolin documents running behind Cloudflare's orange cloud: Full (Strict) TLS only, wildcard certificates via DNS-01, and gerbil.base_endpoint set to the real VPS address. Its own warning is that this binds you to Cloudflare's terms. You get the DDoS layer back, and you also get TLS termination at Cloudflare and the video clause back. There is no configuration that keeps all three.

Pangolin's own comparison, a vendor page dated 23 February 2026, says Cloudflare "could, in principle, man-in-the-middle" traffic it decrypts. That is the vendor's framing. What is not framing is that Cloudflare's own routing table describes the HTTP service type as proxying incoming HTTPS to your origin over HTTP: the edge holds the certificate and the plaintext.

Which one for your situation#

Where this answer stops applying#

Cloudflare Enterprise customers are outside the video clause. Private network routes through the Cloudflare One client are outside it on every plan. Pangolin Cloud, the vendor's managed service, is not what this page compares. The Enterprise feature list and prices above are Pangolin's pricing page in October 2026, which its docs call the source of truth and which can change.

What to do next#

Decide what must be public and what only needs to be reachable by you; Remote access without port forwarding walks through that split. If it is Pangolin, read Reverse proxy and TLS for the DNS-01 path that wildcard certificates need, and back up the config directory: the shipped compose file mounts it into all three containers, Let's Encrypt store included. If it is Cloudflare, keep media and big uploads off the tunnel. The rest of the category is at Networking.