Will Tailscale slow down my internet?

No. Tailscale only handles the traffic between your devices on the mesh. Normal browsing on your laptop or phone still goes out through whatever Wi-Fi you're on, unrouted by Tailscale, at full speed.

Can I run Tailscale and a commercial VPN at the same time?

Usually yes — they handle different traffic. Commercial VPNs sometimes default to blocking "local network access" and that can break Tailscale; turn the LAN-access toggle on in the commercial VPN's settings.

Is Cloudflare Tunnel actually free forever?

Yes for personal Zero Trust use: 50 user seats free, 1,000 tunnels per account, unlimited bandwidth (subject to the 100 MB per-request upload cap and streaming caveats). No credit card needed.

Wi-Fi & Network · Beginner explainer

VPN vs Tailscale vs Cloudflare Tunnel

The word "VPN" got overloaded. In 2026 it can mean three completely different things, and the ad you saw on YouTube is probably about the one that doesn't help you reach your home NAS. This page sorts them out, then explains where Tailscale and Cloudflare Tunnel fit.

The mental model

Three different tools called "VPN" are like three different things called "key." A house key opens your front door. A car key starts your engine. A safety deposit box key lets you into a bank vault. They're all keys; they do completely different jobs.

**Commercial privacy VPN** (NordVPN, Mullvad, Proton VPN) is a privacy tool. It hides your browsing from your ISP and from public Wi-Fi. It does *not* help you reach anything at home.
**Mesh VPN** (Tailscale, ZeroTier, Twingate, NetBird) builds a private network across whichever of your devices you install it on. This is the one that lets your phone reach your NAS from a coffee shop.
**Cloudflare Tunnel** is neither, exactly. Your home server dials *out* to Cloudflare, and Cloudflare publishes the service as a normal HTTPS website. Friends and family can visit a URL without installing anything.
All three are sometimes lumped under "VPN." Only mesh VPN replaces port forwarding; only the privacy VPN hides your outbound browsing; only Cloudflare Tunnel gives non-technical visitors a public link.

Words you will see

Commercial privacy VPN: NordVPN, Mullvad, ProtonVPN, ExpressVPN. Your traffic goes through their server before reaching the internet. Hides your IP from websites and from your ISP. Does not make your home reachable.
Mesh VPN: Tailscale, ZeroTier, Twingate, NetBird, Nebula. Builds a private network across your devices regardless of where they are. The relevant kind for "I want to reach my home NAS from outside."
Cloudflare Tunnel: A daemon (cloudflared) on your home server makes an outbound TLS connection to Cloudflare's edge. You map a subdomain on Cloudflare's side. Visitors hit the Cloudflare URL; Cloudflare hands traffic back over the tunnel. No port forwarding required. Free for personal use.
WireGuard: A modern VPN protocol (~4,000 lines of code, in the Linux kernel since 2020). Faster and smaller than OpenVPN. Tailscale is built on WireGuard under the hood; you can also run raw WireGuard if you enjoy editing config files.
Headscale: Open-source self-hosted version of Tailscale's coordination server. You run it on a $5/month VPS; you use Tailscale's official client apps. Full self-host control, but loses some hosted conveniences.
Tailscale Funnel: A Tailscale feature that publishes a single tailnet device to the public internet as HTTPS, using a *.ts.net domain. Limited to ports 443/8443/10000, TLS-only, no custom domain.
Exit node: A Tailscale device set to route all the other devices' internet traffic out through it. Lets a phone on hotel Wi-Fi appear to be coming from your home. A poor approximation of a commercial privacy VPN.

The three things people mean by "VPN"

**Commercial privacy VPN** like NordVPN or Mullvad: you install the app, your browsing leaves through their server, sites you visit see their IP instead of yours. Solves "I don't want my ISP or the coffee shop Wi-Fi to see what I browse."

**Corporate or road-warrior VPN** like the Cisco AnyConnect your employer makes you use: tunnels you back to a corporate network so you can reach internal company servers.

**Mesh VPN** like Tailscale: builds a private network across your *own* devices, regardless of which network each one is on. These three solve different problems. A YouTube ad for NordVPN does not help you reach your home NAS, and Tailscale does not make your Netflix think you're in Canada.

Tailscale, in one paragraph

Tailscale is the easy modern way for non-IT homeowners to reach their own stuff from outside. You install a small app on your phone, laptop, NAS, Home Assistant — anything you want in the mesh. They all sign in to the same Tailscale account. Now each device has a small private IP address (in the 100.x.x.x range) that only your mesh can see, and they can reach each other directly using those addresses, no matter what network each device is on.

As of April 2026, the free Personal plan covers 6 users and unlimited devices, which is enough for most extended families. Built on WireGuard underneath. Native packages exist for Synology, QNAP, and Unraid; TrueNAS uses TrueCharts in 2026.

Cloudflare Tunnel, in one paragraph

Cloudflare Tunnel is the easy modern way to make a single service at home reachable as a public web link, without a port-forward. You install `cloudflared` on a device at home. It opens an outbound connection to Cloudflare's edge — Cloudflare never has to reach in to your house. In the Cloudflare dashboard, you map a subdomain to the tunnel. Cloudflare terminates the public HTTPS, sends traffic into the tunnel, your service answers. Free for personal use.

**Caveat**: the free and Pro plans cap proxied HTTP uploads at 100 MB per request, which trips up Immich photo uploads and Nextcloud large-file sync. Streaming Plex/Jellyfin via Cloudflare Tunnel is a long-running grey area in Cloudflare's terms; the safer pattern is Tailscale for streaming, Cloudflare Tunnel for read-only dashboards and shared albums.

When to pick which — four common scenarios

**A. Just want to reach my NAS from my phone**: Tailscale. Done.

**B. Want a normal HTTPS link my parents can click without installing anything**: Cloudflare Tunnel. Add a Cloudflare Access policy on top so it's not literally open to the public.

**C. Want full self-host control, no third-party coordinator**: Headscale on a $5 VPS, Tailscale's official client apps pointed at it. ~30-45 minutes to set up.

**D. Want to hide my browsing from my ISP or look like I'm in Canada**: completely different problem. Use a commercial privacy VPN (Mullvad, Proton VPN). Tailscale and Cloudflare Tunnel do nothing for this.

ZeroTier, Twingate, Pangolin, NetBird — the rest of the field

These are alternatives in the same family, each with a different tilt. **ZeroTier** is the closest competitor to Tailscale — same idea, slightly different architecture, free for up to 25 devices per network. **Twingate** is more zero-trust focused — better when you'll grant access to many separate people for different specific apps. **Pangolin** is the newest entrant (2024-2026), open-source, self-hostable Cloudflare Tunnel alternative running on your own VPS. **NetBird** is open-core Tailscale-style mesh, also self-hostable.

None of these are "wrong"; if you have no preference, Tailscale is the default because it's easiest to recover from when something breaks at 11pm.

Common misconceptions

Many people think: All VPNs are basically the same.

Actually: Three completely different categories share the word "VPN." A privacy VPN, a corporate VPN, and a mesh VPN solve different problems. Using one when you needed another is why people get confused why their NordVPN didn't help them reach their Plex server.

Many people think: Tailscale is less secure than a "real" VPN because it's free and easy.

Actually: Tailscale's data plane is WireGuard — the same protocol enterprises pay for. The coordination plane sees public keys and which peers are online, but never the encrypted traffic between peers. "Free and easy" is the user-experience layer, not the cryptography.

Many people think: Cloudflare can read my files because Cloudflare Tunnel terminates TLS at their edge.

Actually: True in the strict sense — Cloudflare can see HTTPS traffic at the proxy. For sensitive services use Tailscale instead. For typical home use (a Grafana dashboard, family photo album, status page), the trade is fine.

Many people think: Tailscale Funnel is the same as Cloudflare Tunnel.

Actually: Funnel publishes a Tailscale device to the public internet, but only via your-name.ts.net subdomains, only on ports 443/8443/10000. If you want a branded URL on your own domain, Cloudflare Tunnel is the right tool. If you want a quick public link from a tailnet device with zero extra setup, Funnel is fine.

Many people think: If I install Tailscale, my browsing is private from my ISP.

Actually: No. Tailscale just lets your devices talk to each other directly. Normal internet browsing on the Tailscale-equipped device still goes out through whatever network the device is on. To hide outbound browsing, you need either a commercial privacy VPN or a configured exit node.

Ready to actually fix it?

Pick the path that matches your situation:

Last reviewed

2026-05-27