Cloudflare Tunnel alternative
Both products connect private origins through outbound connections. Cloudflare Tunnel feeds a global web and Zero Trust platform. rstream combines public multi-protocol endpoints, private application dialing, remote operations, and customer-controlled deployments in one runtime.
Command line
The first HTTP tunnel is simple with either product. Production hostnames and private TCP access reveal more of the difference between their operating models.
Cloudflare Tunnel
rstream
Cloudflare Tunnel
›cloudflared tunnel --url http://localhost:8080rstream
›rstream forward 8080Cloudflare Tunnel
›cloudflared tunnel route dns api api.example.com
cloudflared tunnel --config config.yml run apirstream
›rstream forward 8080 --host api.example.comCloudflare Tunnel
›cloudflared access tcp --hostname db.example.com --url localhost:15432rstream
›rstream nc -L 127.0.0.1:15432 -R rstrm://private-dbCloudflare Quick Tunnels are documented for testing only. The production example assumes a previously created tunnel and a config.yml mapping api.example.com to localhost:8080. The private TCP examples assume that the origin route is already configured.
Comparison
Cloudflare often delivers a capability through a broader product such as Access, Cloudflare One, or Spectrum. rstream keeps more of the transport surface in one tunnel runtime.
Cloudflare
rstream
| Capability | Cloudflare | rstream |
|---|---|---|
| HTTPS and WebSocket | ||
| Custom domains and managed certificates | ||
| Kubernetes deployment | cloudflared Deployment | Kubernetes Operator |
| Global managed edge | ||
| Standard-client public TCP | Spectrum Enterprise | |
| Public QUIC and DTLS endpoints | Not documented | |
| Private TCP and UDP connectivity | Cloudflare One | |
| Browser terminal sessions | Cloudflare Access | WebTTY |
| Customer-operated core runtime | Not offered | Engine CE |
Named Cloudflare products identify capabilities outside Tunnel itself. Not documented means the capability was not found in the official public documentation reviewed for this comparison.
Connectivity
Cloudflare Tunnel is an off-ramp into Cloudflare's network. rstream exposes services publicly or lets authenticated applications dial named private tunnels.
An origin connector into Cloudflare's web and Zero Trust platform.
Public access
HTTP services enter Cloudflare's edge
HTTP and WebSocket applications can use Cloudflare's web platform. Other public protocols require client-side cloudflared or the separate Spectrum product.
Private access
Cloudflare One connects users and networks
Tunnel provides the off-ramp while the Cloudflare One Client and Mesh add bidirectional private TCP, UDP, and ICMP connectivity.
One runtime for public endpoints and private application dialing.
Public access
Standard clients reach multi-protocol endpoints
HTTP, TCP, TLS, QUIC, and DTLS applications connect without a matching rstream client on the public side.
Private access
CLI and SDKs dial streams or datagrams
Applications reach named private tunnels directly without publishing the service or creating a managed Layer 3 network.
Product differences
Cloudflare extends Tunnel into a broad security and network platform. rstream extends its runtime into multi-protocol operations, product-native MCP tools, and controlled deployment.
How traffic is protected and governed after it reaches the edge.
Cloudflare
CDN, WAF, DDoS protection, Access, and Gateway
Cloudflare combines Tunnel with a broad web security and Zero Trust platform. Product and plan boundaries determine the available controls.
rstream
Protocol-aware routing and access controls
Apply JWT authentication, token, IP, GeoIP, and mTLS policies to supported endpoints. rstream does not replace Cloudflare's complete CDN, WAF, or SASE stack.
How operators and software work with live connections.
Cloudflare
Browser terminal, API, Terraform, logs, and metrics
Cloudflare Access can render SSH in the browser, while Tunnel exposes remote logs, Prometheus metrics, APIs, and Terraform resources.
rstream
WebTTY, live runtime state, and two MCP surfaces
Operate terminals, tunnels, projects, clients, and live state through the CLI, SDKs, local MCP server, or hosted MCP endpoint.
Which parts of the connectivity system the customer can operate.
Cloudflare
cloudflared at the origin and a Cloudflare-operated platform
Customers deploy and scale the connector. Cloudflare operates the edge and control plane, with enterprise controls for regional requirements.
rstream
Hosted, dedicated, and customer-operated paths
Use the global managed service, dedicated Enterprise capacity, an optional on-premises control plane, or the free self-hosted Engine CE runtime.
Pricing
Cloudflare Tunnel can publish HTTP services on the Free plan. For private access, Cloudflare Zero Trust is free for up to 50 users and Pay-as-you-go is $7 per user per month. rstream Pro is $49 per project with up to 50 simultaneous tunnels and 200 GB.
Cloudflare costs less for public HTTP and for private-access teams that fit its free plan. Once Pay-as-you-go applies, rstream Pro has the lower fixed price in this simplified comparison.
Users on Cloudflare Zero Trust Pay-as-you-go
51 users
$357
Cloudflare
$49
rstream
75 users
$525
Cloudflare
$49
rstream
100 users
$700
Cloudflare
$49
rstream
This is a price comparison, not a feature-equivalent bundle. Cloudflare Zero Trust includes a broader SASE platform. rstream Pro is priced per project and is not a replacement for that complete stack.
Perspective
Cloudflare Tunnel starts from Cloudflare's edge. It is a strong choice when a private HTTP origin should inherit Cloudflare's CDN, WAF, DDoS protection, Access policies, and Zero Trust network controls. Cloudflare One and Mesh also provide a mature model for identity-aware Layer 3 connectivity between users, devices, and private networks.
rstream starts from the connection an application needs. The same runtime publishes HTTP, TCP, TLS, QUIC, and DTLS endpoints, and lets CLI or SDK clients dial private bytestream and datagram tunnels. Public TCP works with standard clients rather than a matching connector. WebTTY, live client and tunnel state, and separate local and hosted MCP surfaces connect those transports to real-time media, private AI systems, remote operations, and AI tools.
Cloudflare operates its edge and control plane while customers operate cloudflared connectors. rstream is developed in Europe and offers global hosted, dedicated, and on-premises paths, together with the free self-hosted Engine CE core runtime. Cloudflare remains the clearer fit for a comprehensive web edge or managed Zero Trust network. rstream is a stronger fit when the system needs application-facing protocols, private SDK access, remote operations, AI tooling, or control over the runtime deployment.
Evaluate rstream on a real service
Sources and methodology
Product claims were checked against official Cloudflare documentation for Tunnel, published protocols, locally-managed tunnels, private TCP access, private connectivity, Spectrum, Kubernetes, browser SSH, and pricing, together with the current rstream documentation, guides, and pricing.
The price chart applies Cloudflare Zero Trust Pay-as-you-go to every user once the 50-user Free plan no longer applies. It uses $7 per user and the $49 rstream Pro project price. No performance, network-size, uptime, security, or migration benchmark is claimed. Engine CE is free and self-hosted, not open source.
Verified August 6, 2026