Cloudflare Zero Trust alternatives: where to go, and how to switch without downtime
Six destinations, one per reason to leave, and a seven-step migration.
The short answer: Twingate if you want the same per-app access with no open ports and a smaller console; Tailscale if you mostly connect machines to each other; NetBird if you want the option to self-host everything; Pomerium to keep an identity-aware proxy in front of your web apps, open source; ZeroTier for a virtual LAN billed per device; NordLayer if what you really need is a business VPN with a static IP. One thing to know first: none of these tools imports your Cloudflare setup. Tunnels, Access applications and Gateway policies get rebuilt by hand. We compared all six and checked their official pricing in 2026.
The ranking is editorial: a sponsored spot is always labeled on its card, and no affiliate link changes a rating.
Why teams leave Cloudflare Zero Trust, and why some stay
To be fair, Cloudflare Zero Trust is one of the most generous offers out there: free up to 50 users, a connector that needs no inbound ports, a global network. People rarely leave over the entry price. They leave over what shows up as they grow, or because their use case doesn't fit the model. Six reasons, each checked against Cloudflare's own pages in 2026.
One provider carries all your traffic
The cloudflared connector opens an outbound connection to Cloudflare's network, and users come in through the WARP client. That's what makes setup easy. It also makes Cloudflare a single point of failure: when Cloudflare has an outage, access to your internal tools goes down with it. If your DNS and CDN already live there too, that's a lot of eggs in one basket.
24-hour logs on the free plan
Free keeps logs for up to 24 hours. Spot something Monday about a Saturday login? It's gone. Pay-as-you-go keeps 30 days, Contract keeps 6 months and adds Logpush to your SIEM. If you need to prove who accessed what, free won't cut it.
Add-ons stack up fast
Browser isolation isn't on Free and is a paid add-on after that. DLP is limited to predefined profiles on Free and Pay-as-you-go. CASB stops at two read-only API integrations until you sign a contract. Log Explorer is an add-on on every plan. So the $7 per user per month list price is a floor, not a ceiling.
WARP has documented rough edges
Cloudflare's own known-limitations page lists them: the client doesn't run on Windows Server, it fights Teredo over IPv6 routing on Windows, it can break bridged Docker networking on Linux (the fix is an MTU of 1420), and Ivanti Secure Access firewall rules can block its local DNS proxy. On a mixed fleet, each one becomes a ticket.
Community-only support on Free
On Free, support means the forums and Discord. Chat and tickets come with Pay-as-you-go, phone support with a contract. When the whole team's access depends on the tool, waiting on the community during an outage is a long wait.
A console built for large enterprises
Cloudflare One bundles access, web filtering, DNS, DLP, CASB and device monitoring. For a small company that just needs ten people to reach three internal tools, that's a lot of menus. It's the complaint you see most on self-hosting forums. On the flip side, one user wrote that they stayed with Cloudflare because WARP got through firewalls where other tools failed. If that's you, leaving may not make sense.
You're leaving because… go to…
The right Cloudflare Zero Trust alternative depends on what you use it for today: publishing internal apps, connecting machines, or filtering browsing. Usually only one row applies.
Outbound-only connector, resources you declare, free up to 5 users.
You mostly connect servers and laptopsTailscaleWireGuard mesh with direct device-to-device connections.
You don't want to depend on a vendor's cloudNetBirdSame kind of mesh, self-hostable on a small VM.
You mostly put web apps behind a loginPomeriumOpen source identity-aware proxy, or hosted at $7 billed annually.
You need a real virtual LANZeroTierBilled per device, handy for machines with no user.
You want a classic VPN with a static IPNordLayerFor IP allowlisting with vendors and safe public Wi-Fi.
Cloudflare Zero Trust alternatives, one by one
For each tool: why move to it, who it's for, its limit, how to migrate from Cloudflare, and what it costs. Prices are what each vendor lists in 2026, in their own currency.
Twingate: the same model, a shorter console
Closest to Cloudflare AccessWhy move to Twingate. If you use Cloudflare to give people access to internal tools (an intranet, a database, an SSH host), Twingate does the same job with fewer menus. A connector sits in your network, makes outbound connections only, and you declare resources: an address, a hostname, a subnet. Each user sees only what you've granted.
Who it's for. Small and mid-size companies replacing a legacy VPN that want per-resource access without running a whole security platform.
Who it's not for. Teams that also relied on Cloudflare Gateway's DNS and web filtering: Twingate's DNS filtering is a Business add-on.
Its limit. Free stops at 5 users and 50 resources, versus 50 users at Cloudflare. Teams is listed from $5 per user per month and caps at 100 users; Business starts at $10 and goes to 500 (Twingate's table also shows $12 per user depending on billing, so check the amount at checkout).
How to migrate. Install a Twingate connector next to cloudflared, on the same host or one beside it. Work through your Access application list and create a Twingate resource for each. Move a small group first, then shut down the matching Cloudflare tunnel.
- Free
- 5 users, 50 resources
- Paid
- Teams from $5/user/month
- Model
- per-resource access
- Limit
- 100 users on Teams
Tailscale: when you connect machines, not apps
Simplest meshWhy move to Tailscale. Cloudflare routes every connection through its network. Tailscale connects your devices directly over WireGuard and only falls back to a relay when a direct path fails. For a server talking to a database, a developer reaching a test box, or SSH access, that's more direct and often faster.
Who it's for. Technical teams with servers, laptops and VMs to tie together.
Who it's not for. Anyone publishing a web app on their own domain for outside users: Funnel, the public sharing feature, only uses ts.net names and ports 443, 8443 and 10000.
Its limit. The Personal plan covers 6 users but is for non-commercial use only. A business pays from day one: $8 per user per month on Standard, $18 on Premium.
How to migrate. Install Tailscale on every server that sat behind a tunnel, then swap public hostnames for MagicDNS names. Rewrite Access policies as Tailscale access rules, one group at a time. WARP can stay installed during the switch, but make sure the two aren't fighting over DNS. Our guide to switching from Tailscale covers its limits from the inside.
- Free
- 6 users, non-commercial
- Paid
- Standard $8/user/month
- Model
- mesh network
- Limit
- Funnel limited to ts.net
NetBird: get out of someone else's cloud
Self-hostableWhy move to NetBird. If your reason for leaving is vendor dependence, NetBird answers it head on: the project is open source, and you can host the management server and relay yourself. Day to day, it's a WireGuard mesh with group-based access rules and a web console.
Who it's for. Teams that want to own the whole chain, or that have data sovereignty requirements on their traffic.
Who it's not for. A team with nobody to look after a server. Self-hosting needs a Linux VM (at least 1 vCPU and 2 GB of memory), TCP 80 and 443 plus UDP 3478 open, and a public domain name.
Its limit. It's a device mesh, not a web filter, so you lose what Gateway did. NetBird Cloud is free up to 5 users and 100 machines, then Team is €6 and Business €12 per user per month. Tip: NetBird only bills users and machines that connected at least once in the billing period.
How to migrate. Start on NetBird Cloud to validate your rules, then move to your own server if you want to. Install the agent on the machines that sat behind cloudflared and recreate your groups.
- Free
- 5 users, 100 machines
- Paid
- Team €6/user/month
- Self-hosted
- yes, open source
- Limit
- no web filtering
Pomerium: an identity-aware proxy, open source
For web appsWhy move to Pomerium. Plenty of teams use Cloudflare Access for one thing: putting a login in front of internal web apps. Pomerium does exactly that, with no client on laptops. The user opens the URL, signs in with their work account, and the policy decides. Pomerium Core is open source and runs on your own infrastructure.
Who it's for. Technical teams publishing dashboards, admin tools or internal APIs that want to control the proxy themselves.
Who it's not for. Anyone needing full network access (file shares, non-web protocols). Look at Twingate or NetBird instead.
Its limit. The hosted version, Zero, is free for personal use only. Zero Business is $7 per user per month billed annually ($9 monthly), billed on monthly active users, with 100 routes and 100 policies.
How to migrate. Each Access application becomes a Pomerium route: public URL, internal URL, and the policy (group, email domain). Point DNS at Pomerium one app at a time.
- Free
- Core open source; Zero for personal use
- Paid
- Zero Business $7/user/month (annual)
- Model
- identity-aware proxy
- Limit
- web apps only
ZeroTier: a virtual LAN billed per device
For machines without usersWhy move to ZeroTier. Cloudflare bills per user. If what you need is sensors, point-of-sale terminals, servers or industrial machines talking to each other, paying per device makes more sense. ZeroTier builds a virtual LAN: machines see each other as if they were on the same switch.
Who it's for. Device fleets, IoT, remote sites to link up.
Who it's not for. An office team that wants per-app access with per-person rules.
Its limit. The free plan (10 devices, one network) is non-commercial only. Essential is $18 per month for 10 devices, then $2 per device; Scale is $179 per month for 100 devices.
How to migrate. Create a network, install the agent on each machine, authorize them in the console, then swap tunnel addresses for ZeroTier addresses.
- Free
- 10 devices, non-commercial
- Paid
- Essential $18/month
- Model
- virtual LAN
- Limit
- billed per device
NordLayer: when you mainly need a static IP
Business VPNWhy move to NordLayer. Some teams adopted Cloudflare to secure browsing and reach the internet from a known address. If that's you, a business VPN with a dedicated IP does the job with less setup: vendors allowlist your IP, your team connects in one click.
Who it's for. Small teams working from cafes and hotels, or that must show up from an approved IP.
Who it's not for. Teams that want per-app access with fine-grained rules: NordLayer is still a VPN.
Its limit. No free plan, 5-user minimum. Lite is $8, Core $11 and Premium $14 per user per month billed annually, and Core and Premium require a dedicated IP server at $40 extra per month. 14-day money-back guarantee.
How to migrate. Order the dedicated IP, get it added to your vendors' allowlists before you turn Cloudflare off, then roll out the client. Our business VPN comparison ranks more options.
- Free
- none
- Paid
- Lite $8/user/month (annual)
- Model
- business VPN
- Limit
- 5-user minimum
All 6 alternatives side by side
For a sense of scale, take a 20-person company. Cloudflare stays free. Twingate Teams comes to at least $100 a month, Tailscale Standard $160, NetBird Team €120, Pomerium Zero Business $140 billed annually, NordLayer Lite $160 billed annually. ZeroTier counts devices, not people. So under 50 users, you don't leave Cloudflare to save money: you leave for a different model, less lock-in, or better support.
| Free plan | First paid plan and model | |
|---|---|---|
| Cloudflare Zero TrustStarting point | 50 users, 24-hour logs, community support | Pay-as-you-go $7/user/month, 30-day logs |
| TwingatePer-resource access | 5 users, 50 resources | Teams from $5/user/month, 100 users max |
| TailscaleMesh network | 6 users, non-commercial | Standard $8/user/month |
| NetBirdSelf-hostable | 5 users, 100 machines | Team €6/user/month; open source self-hosting |
| PomeriumIdentity-aware proxy | Core open source; Zero for personal use | Zero Business $7/user/month annual ($9 monthly) |
| ZeroTierVirtual LAN | 10 devices, non-commercial | Essential $18/month for 10 devices |
| NordLayerBusiness VPN | None | Lite $8/user/month annual, 5-user minimum |
Moving off Cloudflare Zero Trust in seven steps
Order matters: every step keeps access open while you build the new setup. Run both side by side, then switch off Cloudflare one resource at a time.
Inventory everything that runs through Cloudflare
Day 1List every tunnel and what it publishes, every Access application and its policies, Gateway rules (DNS, network, HTTP), lists, device profiles and identity integrations. Note which hosts run cloudflared.
Why bother? No tool imports this config. Your spreadsheet becomes the cutover checklist.
- Time
- half a day
- Risk if rushed
- a forgotten app
Save your logs before they expire
Day 1On Free, logs last 24 hours. If you need an access trail (audit, customer, insurance), export what you need now, then daily during the switch.
- Free retention
- 24 hours
Connect the same identity provider
Day 2Hook the destination up to the same directory Cloudflare uses (Google Workspace, Microsoft Entra ID, Okta). Keep the same group names and your policies will carry over almost one to one.
Watch out: at Twingate, Okta and Entra ID sign-in comes with Business; Teams supports Google Workspace.
- Check
- which plan supports your IdP
Install the new connector next to cloudflared
In parallelRemove nothing yet. Install the destination's connector or agent on the same host as cloudflared, or a neighbor on the same network. Both can run at once.
- Downtime
- none
Rebuild access policies, group by group
Longest stepWork through your spreadsheet and recreate each access rule. Clean up as you go: a rule nobody uses doesn't deserve to be copied. Cloudflare allows up to 500 applications per account; a smaller destination plan may allow fewer, so check first.
- Tip
- map groups, not people
Move a pilot group
One weekPick five people with a mix of devices (Windows, Mac, Linux, mobile). Have them work on the destination only for a week. Write down what breaks: DNS, internal names, slow apps.
If WARP is still installed, turn it off for this group. Two clients managing DNS at the same time is the most common cause of "it stopped working".
- Size
- 5 people
Move everyone, then shut down one resource at a time
FinishRoll the new client out to the whole team, then remove public hostnames from tunnels one by one. Uninstall WARP from laptops and cloudflared from servers last. Keep your Cloudflare account: it costs nothing on Free, and your DNS may still live there.
- Rollback
- possible while cloudflared runs
Is your tool missing from this page? Email us: hello@hackceleration.com
What makes a Cloudflare Zero Trust exit go wrong
The same mistakes show up on forum after forum. None is deeply technical: they're oversights, and each one costs a team a lost morning.
Forgetting what Gateway did
Many teams only use Access, but some also run DNS filtering through Gateway. Move to an access-only tool and that filtering silently disappears. Keep Gateway on the free plan, or replace it on purpose.
Killing the tunnel before DNS
If your domain lives on Cloudflare, your apps' public hostnames still point there. Change DNS first, wait for propagation, then shut the tunnel.
Letting two clients fight
WARP plus another client both trying to own DNS or routes is a guaranteed outage. One active client per device during the switch.
Comparing price without add-ons
Cloudflare's free plan covers 50 people, so under that, any paid destination costs more. Above it, compare Pay-as-you-go at $7 plus the add-ons you need (isolation, longer logs) with the destination plan that supports your identity provider.
Forgetting service accounts
A backup script or CI job using an Access service token will fail on cutover day. List them in your inventory and recreate them at the destination.
Picking a mesh when you published to outsiders
If clients or contractors opened your apps in their browser with nothing installed, a mesh network won't replace that. Pomerium keeps that flow.
Cloudflare Zero Trust alternative: FAQ
Is Cloudflare Zero Trust really free?
Yes, up to 50 users, with no time limit. In exchange, logs last only 24 hours, support is community-based, and browser isolation isn't included. Past 50 users, it's $7 per user per month.
What's the best free alternative to Cloudflare Zero Trust?
For a business, NetBird: its cloud is free up to 5 users and 100 machines, and the self-hosted version carries no license fee. Twingate is free up to 5 users. The free plans of Tailscale, ZeroTier and Pomerium Zero are for personal use only.
Is Cloudflare Zero Trust a VPN?
Not exactly. A VPN opens access to a whole network. Cloudflare Zero Trust grants access app by app, based on identity and device posture, with no inbound ports. If all you need is a static IP for your team, a business VPN like NordLayer is enough.
Can I self-host a Cloudflare Zero Trust alternative?
Yes. NetBird self-hosts on a Linux VM with 1 vCPU and 2 GB of memory, and Pomerium Core is open source. For a plain mesh, Headscale replaces Tailscale's coordination server; our guide to switching from Tailscale covers it.
Can I keep Cloudflare DNS and move access elsewhere?
Yes, they're independent. Many teams keep their domain on Cloudflare and use another access tool. Our page on switching from Cloudflare covers moving everything.
Twingate or Tailscale to replace Cloudflare Access?
Twingate if you grant access to specific tools, resource by resource, like Access does. Tailscale if you connect machines to each other. For a non-technical team, Twingate is usually easier to explain.
Does the WARP client run on Windows Server?
No, Cloudflare lists it as a known limitation. For a Windows server, use cloudflared, or pick a tool whose agent runs on Windows Server.
How long does the migration take?
For a small team, about a week: a day to inventory and install, a week of pilot, a day to cut over. Rebuilding policies takes longest when there are many.
Get the next migration guide in your inbox
One tool to leave, one destination, one migration plan. Browse every other comparison in the Labs.