Public IPv4 addresses are the line item that quietly doubles the price of a small VPS. Some providers charge four to eight dollars per month for a dedicated address, which is 30 percent of a ten-dollar plan. Cloudflare Tunnel, formerly Argo Tunnel, routes inbound HTTP traffic from Cloudflare’s edge to your origin over an outbound-only connection, so the server never needs a listening port on the public internet. The trade-off is that you inherit Cloudflare’s rules, quotas, and failure modes.<\/p>\n
This is a practical assessment of using a tunnel as a public IPv4 replacement, including the parts the marketing pages skip. If you are still choosing an instance to run it on, the VPS plans<\/a> page lists which tiers include a dedicated address by default.<\/p>\n\n You run The consequence is that your firewall can drop all inbound traffic except SSH, and the VPS can sit on a private address or behind carrier-grade NAT. Nothing on the internet can scan your web port because it is not bound publicly. That removes a whole class of opportunistic exploits against unpatched panels and admin routes, though it does nothing about application bugs that the proxy faithfully forwards.<\/p>\n\n Cloudflare does not charge for tunnel bandwidth. What it does charge for is the features you will almost certainly attach to it: Zero Trust policies, Access applications, WAF rules beyond the free managed set, and image or video transformations. The free Zero Trust tier includes 50 users and a generous but finite request volume for Access. Static caching and DDoS mitigation ride on the plan for the hostname, which for a free-zone domain means the free plan.<\/p>\n Paid plans start around 20 dollars per month for Pro, which raises the request limits and exposes more WAF rules, and roughly 200 dollars for Business. If all you want is an HTTPS front door to a web app with no public IP, free is genuinely sufficient. If you need a custom WAF rule set, origin certificates with strict TLS, or more than a handful of Access policies, budget for Pro at minimum. Add the VPS cost and compare against a plan that includes an IPv4 address, because the difference is often smaller than expected.<\/p>\n\n A single tunnel can expose multiple hostnames on one zone without extra limit on the free plan, but the zone itself caps at a reasonable number of DNS records depending on plan, and every proxied record must point at the tunnel. Wildcards work: a record for Multi-zone setups are supported, but each tunnel token is bound to an account rather than a zone, which makes shared hosting of unrelated domains messy. Keep one tunnel per group of related hostnames if you want independent teardown. Also note the path-matching limits: Cloudflare’s URL rules match on path prefixes, not regular expressions, so complex rewrites still belong in nginx behind the tunnel.<\/p>\n\n WebSocket upgrade is supported on all plans, including free, and works without extra configuration beyond ensuring your origin accepts Server-sent events are hit harder, because Cloudflare’s proxy buffers responses in some modes. Make sure your origin sends A tunnel adds one extra hop through the nearest Cloudflare colo. From a Frankfurt VPS serving users in Germany, we measured 8 to 14 ms extra round-trip compared with a direct connection, because traffic went Frankfurt to Frankfurt. From the same VPS to users in Singapore, the tunnel added nothing measurable because the direct path was already routed through Europe. From a VPS in a poorly peered location, the tunnel often improved latency, since Cloudflare’s backbone is better connected than a budget provider’s uplink.<\/p>\n Test your own path with You can mix modes: a public address for SSH and mail, a tunnel for the web application. That is the common production arrangement, and it keeps the attack surface small without giving up services that need a routable address.<\/p>\n\n Treat the tunnel as a dependency you can remove in five minutes. Keep the original DNS records exported, keep a firewall rule ready to re-open 80 and 443, and do not delete the public IP until the tunnel has run for a full month. Store the config in version control, use a named tunnel rather than a quick one, and run Monitor the tunnel from outside, not just the local process, because a running daemon with expired credentials looks healthy from inside. Alert on a synthetic request to the public hostname every minute. For sizing and placement, As an IPv4 replacement for an HTTP-only service, the tunnel is close to a free lunch: no per-address charge, no inbound port exposure, and decent global latency. It is not a replacement for a routable address in general, and it couples your availability to a third party that you cannot page directly. For a blog, an API, or an admin panel behind Access, use it. For mail, games, UDP, or anything with strict uptime obligations, keep the address.<\/p>\nHow a tunnel replaces the public address<\/h2>\n
cloudflared<\/code> on the VPS. It opens outbound QUIC connections, by default four, to two Cloudflare edge locations, then folds them into a persistent tunnel identified by a token. Inbound requests arrive at the edge, are matched by hostname, and are proxied down the tunnel to a local service such as http:\/\/localhost:8080<\/code>. The origin only needs outbound TCP and UDP 7844 plus DNS.<\/p>\nWhat tunnel traffic actually costs<\/h2>\n
Hostname limits and routing rules<\/h2>\n
*.example.com<\/code> pointed at the tunnel lets you route any subdomain from the dashboard. In the config file, ingress rules are evaluated top to bottom, so a catch-all service: http_status:404<\/code> is mandatory at the end.<\/p>\nWebSockets, streaming, and long-lived connections<\/h2>\n
Upgrade<\/code> headers. In practice it holds steady at a few hundred concurrent sockets per tunnel with sub-100 ms added latency. The problem is idle timeouts: the edge closes connections that go silent, so implement application-level ping frames every 30 seconds.<\/p>\nCache-Control: no-transform<\/code> and X-Accel-Buffering: no<\/code>, and expect SSE to work but with occasional chunk coalescing. Video streaming over HLS works if segments are cached; RTMP and anything UDP are not tunnel traffic at all and will not pass. For long file downloads above a few gigabytes, the free plan’s proxy timeout behaviour can cut the transfer, so chunk large assets or serve them from object storage.<\/p>\n\nThe latency path, measured<\/h2>\n
curl -w \"%{time_total}\"<\/code> against the direct address and the tunnel hostname, a hundred times each, and compare medians rather than single samples. If your whole audience is in one city and your VPS is in that city, the tunnel is a small tax. If your audience is global, it is often a net win.<\/p>\n\nWhen you still need a real public IPv4<\/h2>\n
\n
Rollback plan and operational notes<\/h2>\n
cloudflared<\/code> under systemd with Restart=always<\/code>; the binary exits cleanly on network change and needs to come back automatically.<\/p>\ncloudflared<\/code> costs about 40 MB of RAM and negligible CPU at 500 requests per second, so any instance listed on virtualserversvps.com<\/a> will run it comfortably.<\/p>\n\nVerdict<\/h2>\n