Publishing a service that runs on a laptop or a server behind a router, to receive a webhook, show a demo, or access an internal panel, has become a daily task for many teams, and the choice of tool has more implications than it seems. There are open-source options that deploy on your own infrastructure, such as frp, zrok, sish, or SSH port forwarding, and managed services such as Cloudflare Tunnel, Tailscale Funnel, or ngrok, where traffic passes through a third party’s network.
Tunnels for local services in 20 seconds
- frp, zrok, sish, and SSH let you keep the public endpoint on your own infrastructure.
- Cloudflare Tunnel, Tailscale Funnel, and ngrok are more convenient, but they put a third party in the path.
- Any tunnel is a gateway into the internal network and needs authentication.
- You don’t need any tunnel just to get HTTPS locally.
Our sister publication OpenSecurity has published a detailed guide to local HTTPS tools and tunnels, covering their security risks one by one. Here we focus on the underlying decision for cloud teams: where the traffic ends up, who controls it, and how much it costs to maintain.
First, separate the two problems
Many people reach for a tunnel when all they actually need is for the browser to trust their local environment. That’s solved without exposing anything, using a development certificate authority like mkcert or Caddy’s internal CA, or a real Let’s Encrypt certificate obtained via the DNS-01 challenge, which doesn’t need any inbound connections. A tunnel only makes sense when something external — a payment provider, a client, or a colleague — needs to reach a machine that isn’t accessible from the internet.
Self-hosted: the public endpoint is yours
frp, licensed under Apache 2.0, is the most complete option: a server on your own VPS and a client on the local machine, with HTTP, HTTPS, TCP, and UDP proxies. zrok, also Apache 2.0 and built on the OpenZiti zero-trust network, adds private shares where only another authorized user can get in — similar in spirit to Pangolin, a self-hosted alternative to Cloudflare Tunnel with its own access control. sish offers something similar to ngrok using only SSH, and OpenSSH’s remote forwarding (ssh -R) doesn’t require installing anything if you already have a server — the same self-hosted principle behind running your own WireGuard VPN instead of paying for a commercial one.
The advantage is that there are no intermediaries or free-plan limits, and traffic doesn’t leave infrastructure you control, which matters when handling customer data or facing sovereignty requirements. The price is operational: the server acting as the public endpoint is a service exposed to the internet that needs to be patched, monitored, and protected with tokens or keys. For many businesses, it makes sense to host it on a VPS or a dedicated server with a European provider, with managed networking and firewalls.
Managed: convenience in exchange for dependency
Cloudflare Tunnel connects an open-source daemon, cloudflared, to Cloudflare’s network through an outbound connection, and lets you put Cloudflare Access policies in front of it. Tailscale Funnel opens a service on a Tailscale network to the internet, while Serve limits it to devices on that private network. ngrok, a proprietary tool, stands out for its request inspector, which is very useful for debugging webhooks.
These are quick options to get running, with valid certificates and no servers to maintain. In exchange, traffic passes through a US provider’s infrastructure, free-plan terms change frequently, and the configuration stays tied to an account and, in Cloudflare’s case, to a DNS zone hosted there. For one-off tests it’s usually worth it; for permanent services, it’s worth thinking twice.
The same rule applies in both cases: a tunnel is an entry point. An outbound connection doesn’t stop anyone on the internet from reaching the published port. It needs to be limited to a single service, have authentication added, and be closed down once it’s no longer needed.
Frequently asked questions
Which tunnels can be self-hosted?
frp, zrok, and sish, plus SSH remote port forwarding. All of them are open source and run on your own server.
What’s the difference between Tailscale Serve and Funnel?
Serve publishes a service only inside Tailscale’s private network; Funnel opens it to the whole internet.
Do you need a tunnel to have HTTPS in development?
No. A development CA like mkcert or Caddy is enough, or a Let’s Encrypt certificate obtained via DNS-01.
Sources:
This article is also available in Spanish: “Túneles para exponer servicios locales: autoalojarlos o depender de un tercero,” on revistacloud.com.
