Localport vs Cloudflare Tunnel
Cloudflare Tunnel publishes a site whose DNS is on Cloudflare, and Cloudflare Access adds sign-in through your identity provider. Localport gives a local service a static URL with no DNS move, carries raw TCP and TLS to any client, and gives your team mutual TLS access to remote devices.
Last checked 16 October 2026
What Cloudflare Tunnel is
Cloudflare Tunnel connects a server to Cloudflare's network through an outbound connection from cloudflared. Cloudflare Access puts sign-in rules in front of it, and the Cloudflare One Client reaches private networks by IP.
- Tunnel at no cost
- Sign-in through your identity provider
- Cloudflare's CDN and DDoS protection
What Localport is
Localport gives a local service a static public URL over HTTP, TCP or TLS, with no domain to move. Remote Access gives your team mutual TLS access to deployed devices, granted per device and logged.
- Static URLs and reserved TCP ports
- Public TCP and TLS passthrough on every plan
- Remote Access over mutual TLS
What Cloudflare Tunnel does well.
Localport has no identity-provider sign-in in front of a public URL, no CDN, and no plan at no cost.
- Identity-provider sign-in
- Access asks each visitor to sign in through your identity provider before a request reaches the app.
- A larger network
- Published sites get Cloudflare's CDN, caching and DDoS protection.
- No cost to start
- Cloudflare Tunnel costs nothing, and Cloudflare Zero Trust has a Free plan.
- Device posture
- Access to a private network can depend on the state of the connecting device.
What Localport does better.
- A static URL with no DNS move
- Every tunnel keeps its URL across restarts, on our domain or yours. A named Cloudflare Tunnel needs your domain's DNS on Cloudflare, and a Quick Tunnel hostname changes on every run.
- Public TCP for any client
- A database, SSH server or game server gets a host and port any client connects to, with nothing installed. Cloudflare Tunnel TCP needs cloudflared on each client, and public TCP through Spectrum is an Enterprise add-on.
- A reserved TCP address
- Reserve the port and the host and port never change: 2 on Hobby, 10 on Pro, 50 on Business.
- TLS passthrough
- The edge routes by SNI and never decrypts, so your service keeps its own certificate end to end. On Cloudflare, raw TLS on a custom port needs Spectrum on Enterprise.
- Remote Access over mutual TLS
- Each person, server or CI job holds its own certificate, and a grant names the devices it reaches. Nothing else on the device's network is reachable. The Cloudflare One Client routes people to private IP ranges.
- Webhook signature verification
- The edge checks GitHub, Stripe, Shopify, Slack and HMAC-SHA256 signatures and rejects unsigned requests before they reach your machine.
- Fanout
- Every connected machine receives a copy of each request, so a whole team works from one webhook URL.
- Data residency per tunnel
- EU, US or Asia Pacific, chosen per tunnel. On Cloudflare, choosing where traffic is decrypted and processed is the Data Localization Suite, an Enterprise add-on.
- A Remote Access log you keep
- Each device connection with its identity, port, source address, outcome, duration and bytes: 90 days on Pro, 365 on Business. Cloudflare Zero Trust Free keeps Access logs for 24 hours.
Side by side
| Cloudflare Tunnel | Localport | |
|---|---|---|
| Static URL | Needs your domain's DNS on Cloudflare; Quick Tunnel hostnames change every run | Every tunnel, on our domain or yours |
| Public TCP | cloudflared on each client, or Spectrum as an Enterprise add-on | Every plan, for any TCP client |
| Reserved TCP address | Spectrum, an Enterprise add-on | 2, 10 or 50 by plan |
| TLS passthrough | Spectrum, an Enterprise add-on | Every plan |
| Protecting a public URL | Access, with sign-in through your identity provider | IP allowlist, basic auth, header authentication, webhook signatures |
| Data residency | Data Localization Suite, an Enterprise add-on | EU, US or Asia Pacific, chosen per tunnel |
| Private access | Cloudflare One Client, routed to private IP ranges | Mutual TLS, granted per device by member, role or machine |
| Private access log | Access logs: 24 hours on Free, 30 days on paid plans, 180 on Enterprise | Remote Access log: 90 days on Pro, 365 on Business |
How Localport handles your data.
- Open-source agent
- The program on your machine is Apache 2.0. Read it before you run it.
- Traffic content is not logged
- Request and response bodies are not stored.
- A region for each tunnel
- EU, US or Asia Pacific. Account data is stored in the EU.
- Your keys stay with you
- Private keys for Remote Access are created on your machine and not sent to us.
Common questions.
Cloudflare Tunnel details are from Cloudflare Tunnel docs, Quick Tunnels, Arbitrary TCP, Spectrum protocols per plan, Access policies, Private networks, Data Localization Suite, Zero Trust log retention, Zero Trust account limits as published on 16 October 2026.
Is Localport free like Cloudflare Tunnel?
No. Cloudflare Tunnel is free, and Localport starts at $6 a month after a trial. The price covers what Cloudflare charges for on Enterprise: public TCP, TLS passthrough and data residency.
Do I need a domain on Cloudflare to get a static URL?
Not with Localport. Every tunnel keeps its URL across restarts on our domain, and you can attach your own domain without moving its DNS.
Can I expose a database or game server over TCP?
Yes. A Localport TCP tunnel gives the service a host and port that any TCP client connects to, with nothing installed on the client. Reserve the port to keep the address fixed.
Does Localport replace Cloudflare Access?
Not for identity-provider sign-in. Localport protects a public URL with an IP allowlist, basic auth, header authentication and webhook signatures. For devices, Remote Access uses mutual TLS with a certificate per person, server or CI job.
Where is my traffic processed?
In the region you choose for each tunnel: EU, US or Asia Pacific. Account data is stored in the EU.