Cloudflare Tunnel vs ngrok vs Tailscale: Which Secure Tunnel in 2026?

# Install cloudflared
wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64
chmod +x cloudflared-linux-amd64
sudo mv cloudflared-linux-amd64 /usr/local/bin/cloudflared
 
# Login and create a tunnel
cloudflared login
cloudflared tunnel create my-app-tunnel
cloudflared tunnel route dns my-app-tunnel app.yourdomain.com
 
# Config file
cat > ~/.cloudflared/config.yml << EOF
tunnel: <your-tunnel-id>
credentials-file: /root/.cloudflared/<your-tunnel-id>.json
 
ingress:
  - hostname: app.yourdomain.com
    service: http://localhost:3000
  - hostname: api.yourdomain.com
    service: http://localhost:8080
  - service: http_status:404
EOF
 
# Run the tunnel
cloudflared tunnel run my-app-tunnel

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudflared
  namespace: tunnel
spec:
  replicas: 2  # run 2 for HA
  template:
    spec:
      containers:
        - name: cloudflared
          image: cloudflare/cloudflared:latest
          args:
            - tunnel
            - --config
            - /etc/cloudflared/config/config.yaml
            - run
          volumeMounts:
            - name: config
              mountPath: /etc/cloudflared/config
              readOnly: true
            - name: creds
              mountPath: /etc/cloudflared/creds
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: cloudflared-config
        - name: creds
          secret:
            secretName: cloudflared-credentials

# Install
brew install ngrok
# Or: snap install ngrok
 
# Expose local port 3000
ngrok http 3000
# Output: https://abc123.ngrok-free.app → localhost:3000
 
# Custom subdomain (paid)
ngrok http --domain=myapp.ngrok.io 3000
 
# TCP tunnel
ngrok tcp 22  # exposes SSH
 
# Config for persistent auth
ngrok config add-authtoken YOUR_TOKEN

services:
  myapp:
    image: my-app:latest
    ports:
      - "3000:3000"
  
  ngrok:
    image: ngrok/ngrok:latest
    command: http myapp:3000
    environment:
      NGROK_AUTHTOKEN: ${NGROK_AUTHTOKEN}
    ports:
      - "4040:4040"  # ngrok dashboard

# Install on all nodes that need to be connected
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
 
# Get the IP of the node
tailscale ip -4  # e.g., 100.x.x.x (Tailscale IP range)
 
# Now you can reach any Tailscale device from any other
ssh user@100.x.x.x  # direct, no firewall rules needed
curl http://100.x.x.x:8080  # reach internal service

helm repo add tailscale https://pkgs.tailscale.com/helmcharts
helm repo update
helm install tailscale-operator tailscale/tailscale-operator \
  --namespace tailscale \
  --create-namespace \
  --set operatorConfig.hostname=tailscale-operator

apiVersion: v1
kind: Service
metadata:
  name: my-internal-api
  annotations:
    tailscale.com/expose: "true"
spec:
  selector:
    app: my-api
  ports:
    - port: 8080

# On an EC2 instance in your VPC:
sudo tailscale up --advertise-routes=10.0.0.0/8
# Approve routes in Tailscale admin console
# All Tailscale devices can now reach 10.x.x.x addresses