Yes, sorry, I was sloppy in my comment. I meant, say in the case of Cloudflare or Tailscale, I don’t need to open any ports, or operate any server. The server,

Yes, sorry, I was sloppy in my comment. I meant, say in the case of Cloudflare or Tailscale, I don’t need to open any ports, or operate any server. The server, its firewall and security are outsourced to those companies. They take care of configuring and securing the internet-facing component. The clients make outbound connections, and the company takes care of handling inbound. This is similar to running your own VPN server, vs using what’s called zero trust network access with services provided by companies such as Cloudflare. Cloudflare tunnels are simple, robust and include a range of features: various authentication options, a secure internet-facing webpage in Cloudflare Access, DDoS mitigation, IP hiding, DNS and domain setup, etc . If they don’t decrypt and scan the traffic, that’s how an ideal solution would look like.