5 Ways to Bypass CGNAT in Brunei: Cloudflare, Tailscale, NetBird, WireGuard, and Pangolin Compared

If you are behind CGNAT and need to access your home network remotely, you have three main options: Cloudflare Tunnel, Tailscale, and WireGuard with a VPS relay. Each solves the same problem differently. Here is how they compare.

Cloudflare Tunnel

How it works: A lightweight agent (cloudflared) runs on a device in your home and creates an outbound encrypted connection to Cloudflare's global network. Traffic to your configured domain is routed through Cloudflare's network, through the tunnel, to your home device. No inbound ports are ever opened on your home router. No public IP required.

Pros:

• Cloudflare's global network means excellent performance worldwide
• Automatic SSL certificates and DDoS protection included
• Works through any NAT, firewall, or ISP restriction
• Free for reasonable usage

Cons:

• All traffic passes through Cloudflare's servers. Cloudflare can technically see your unencrypted traffic
• Requires a domain name (roughly 10 US dollars per year)
• Only works for web-based services (HTTP/HTTPS). Not suitable for non-web protocols like SSH or gaming
• Cloudflare is a third party you must trust

Best for: Hosting websites, web applications, or web-accessible services from home. Accessing your NAS web interface or security camera feed from anywhere.

Tailscale

How it works: Tailscale creates a WireGuard-based mesh network between all your devices. It uses NAT traversal techniques (STUN, ICE, DERP relays) to establish direct peer-to-peer connections even through CGNAT. Each device gets a private Tailscale IP address. You connect to devices using their Tailscale IPs.

Pros:

• Easiest to set up: install the app, log in, done
• Peer-to-peer when possible: data goes directly between your devices, not through Tailscale's servers
• Works for any protocol: SSH, RDP, VNC, SMB, game servers, anything TCP or UDP
• Free for up to 100 devices and 3 users

Cons:

• Relies on Tailscale's coordination server for device discovery
• DERP relays are used when P2P fails, and traffic passes through Tailscale's servers
• Free plan limits users to 3
• Tailscale is a third party you must trust

Best for: Personal remote access to all your devices. Accessing your home computer, NAS, or server from your laptop or phone as if you were on the same local network.

WireGuard + VPS Relay

How it works: You rent a VPS with a public IP address. You install WireGuard on both the VPS and your home device. Your home device maintains a persistent WireGuard connection to the VPS. iptables rules on the VPS forward incoming traffic on specific ports through the WireGuard tunnel to your home device.

Pros:

• Complete control: no third-party servers, no coordination service, no tunnel provider
• Lowest latency possible: the VPS is the only hop between you and your home
• Works for any protocol: TCP, UDP, SSH, gaming, anything
• Fixed monthly cost for the VPS, predictable and low

Cons:

• Most complex to set up: WireGuard config, iptables rules, port forwarding, dynamic DNS
• VPS costs 5 to 10 US dollars per month
• VPS bandwidth limits may apply to heavy usage
• You are responsible for the VPS security and maintenance

Best for: Users who want complete control, need to run non-web services from home, and are comfortable with Linux networking. Also good for gamers who need low-latency connections.

NetBird (Open-Source Tailscale Alternative, Self-Hosted)

How it works: NetBird creates a WireGuard-based P2P mesh overlay network between all your devices. Every device runs a lightweight agent. NAT traversal uses STUN/ICE (WebRTC techniques). When P2P fails due to double CGNAT, connections fall back to relay servers. The coordination server is self-hosted on your VPS, so network topology and access policies never leave your control.

Pros:

• Open source (BSD-3 + AGPLv3) with self-hostable management server
• WireGuard-based P2P mesh with automatic NAT traversal
• SSO/MFA (Okta, Azure, Google, GitHub), posture checks, DNS management
• Terraform provider and REST API for infrastructure-as-code
• No third party sees network topology or access patterns
• Free, self-hosted, all protocols supported

Cons:

• More complex to set up than Tailscale (but simpler than raw WireGuard)
• Requires a VPS for the management server (5 to 10 US dollars per month)
• Smaller community than Tailscale

Best for: Security-conscious users and businesses who want Tailscale-like functionality without trusting any third party. Teams that need SSO, posture checks, and granular access policies with open-source licensing.

Pangolin (Self-Hosted, All Protocols, WireGuard + Reverse Proxy)

How it works: Deploy Pangolin on a VPS with a public IP. Install a connector on your home device. The connector creates an outbound WireGuard tunnel with NAT traversal. For HTTP services, Pangolin acts as an identity-aware reverse proxy with in-browser SSH/RDP/VNC terminals. For TCP/UDP services, native client apps (Mac, Windows, Linux, iOS, Android) provide peer-to-peer access via WireGuard with intelligent NAT traversal.

Pros:

• All protocols: HTTP via browser + TCP/UDP via client app
• WireGuard-based with NAT traversal (peer-to-peer or relayed)
• Self-hosted: no third party sees your traffic
• Identity-aware with RBAC and IdP integration (OIDC)
• Automatic SSL, management dashboard
• In-browser SSH, RDP, VNC terminals
• Open source (AGPL-3), 22k+ GitHub stars

Cons:

• Requires a VPS (5 to 10 US dollars per month)
• More complex than Tailscale
• Full protocol access requires installing the client app

Best for: Users who want an all-in-one solution: reverse proxy + VPN + identity-aware access control, all self-hosted. Small businesses and power users who need both browser-based web access and full TCP/UDP connectivity through CGNAT.

Quick Comparison

Feature	Cloudflare	Tailscale	NetBird	WireGuard	Pangolin
Cost	Free + domain	Free (3 users)	Free + VPS	Free + VPS	Free + VPS
Setup difficulty	Medium	Easy	Medium	Hard	Medium
Protocols	HTTP only	All TCP/UDP	All TCP/UDP	All TCP/UDP	All TCP/UDP
Third-party sees data	Yes	DERP only	No	No	No
P2P direct	No	Yes	Yes	Via VPS	P2P + relay
Needs public IP	No	No	VPS needs one	VPS needs one	VPS needs one
Self-hostable	No	No	Yes	Yes	Yes

The Fourth Option: NetBird

If you want Tailscale's ease of use but refuse to trust a third party, NetBird is the answer. It is open-source and can be self-hosted on a VPS. It uses the same WireGuard-based P2P approach as Tailscale. The trade-off is that you manage the coordination server yourself. For technically inclined users, this is the best of both worlds: Tailscale-like functionality with WireGuard-like privacy.

VPS1 helps Brunei residents set up remote access to their home networks. We configure Cloudflare Tunnels, deploy WireGuard VPS relays, or set up Tailscale or NetBird. Whatever method fits your technical comfort level and privacy requirements.