Replacing Cloudflare Tunnel with a Selfhosted Towonel Tunnel

Every public request to one of my sites used to go through a Cloudflare tunnel. I had a cloudflared deployment in my cluster, some routing rules, and everything just worked. And it was free! But that bugged me. TANSTAAFL right? The whole point of selfhosting is to not rely on big cloud company, and there are few bigger than Cloudflare. And Cloudflare’s tunnels decrypt every single packet, so they see everything you do. I really don’t like that.

So I’ve replaced Cloudflare tunnels with Erwan Leboucher’s towonel, a selfhosted tunnel implementation. I still have my DNS on Cloudflare, but no data is moving through them any more.

…

blog.jameswynn.com/posts/2026/08/cloudflare-to-towonel/

I don’t get the need for those tunnels.

Wouldn’t a simple wireguard setup be enough un less you are behind CG-NAT?

Wireguard it’s there, free, open source, doesn’t rely on any external server or company…

What does these “tunnels” actually add?

That’s exactly the use case for “tunnels”: allowing public, incoming connections behind CGNAT.

Wireguard requires a public IP on at least one side of the connection and only allows private access. If you want to host a blog or website AND you’re behind CGNAT, then a “tunnel” service is a very easy solution.

Edit: my previous blog post on the topic: blog.k3can.us/posts/…/2025-02-21_cloudflarefort/