Every public request to one of my sites used to go through a Cloudflare tunnel. I had a cloudflared deployment in my cluster, some routing rules, and everything just worked. And it was free! But that bugged me. TANSTAAFL right? The whole point of selfhosting is to not rely on big cloud company, and there are few bigger than Cloudflare. And Cloudflare’s tunnels decrypt every single packet, so they see everything you do. I really don’t like that.
So I’ve replaced Cloudflare tunnels with Erwan Leboucher’s towonel, a selfhosted tunnel implementation. I still have my DNS on Cloudflare, but no data is moving through them any more.
…
That’s exactly the use case for “tunnels”: allowing public, incoming connections behind CGNAT.
Wireguard requires a public IP on at least one side of the connection and only allows private access. If you want to host a blog or website AND you’re behind CGNAT, then a “tunnel” service is a very easy solution.
Edit: my previous blog post on the topic: https://blog.k3can.us/posts/2025/feb/2025-02-21_cloudflarefort/
But going with a self-hosted approach like Towonel, you need a server with a public IP too. And I think what the commenter meant is, if you already have that, you can just setup a WireGuard connection to that public server, so that it can route the traffic to your local network.
Oh, maybe I misunderstood? It sounded like he didn’t understand what advantage a “tunnel” could provide.
If your server is behind CGNAT, you need a TURN-style “tunnel” to allow incoming connections. If you have your own remote server with a public IP, then you can absolutely use that and create the tunnel using wireguard (or openvpn, ssh, etc).
I just mentioned CF in my blog post because it’s probably the most popular solution.
The point is, if you have CGNAT, you need to create that “tunnel” somehow if you want to allow incoming connections.