# Reverse Proxy Architecture: Tailscale Funnel vs Cloudflare Tunnel vs nginx

*Research compiled June 2026. For the Nexstream scraper use case (metadata API for Android TV app, no domain, users on home internet).*

## The Three Approaches

| Criterion | **Tailscale Funnel** | **Cloudflare Tunnel** | **nginx** |
|---|---|---|---|
| Setup cost | ✅ Zero (already running) | ❌ Needs account + cloudflared | ✅ Already on server |
| Latency overhead | 10–80ms (relay-dependent) | 15–45ms (edge-dependent) | **2–8ms** (best) |
| Throughput | 100Mbps–1Gbps | 1–10Gbps (plan-limited) | **10–40Gbps** (hardware-limited) |
| Automatic HTTPS | ✅ Tailscale TLS | ✅ Cloudflare Universal SSL | ❌ Needs domain + Certbot |
| DDoS protection | ❌ None | ✅ 100+ Tbps edge | ❌ Manual only |
| Rate limiting | ❌ None built-in | ✅ WAF rules | ✅ `limit_req_zone` |
| IP hidden? | ✅ Yes (Tailscale relay) | ✅ Yes (Cloudflare proxy) | ❌ IP exposed |
| Domain needed? | ❌ No (`*.ts.net`) | ❌ No (`.trycloudflare.com`) | ✅ Yes, for HTTPS |
| ToS risk | ✅ None | ⚠️ Free plan restricts "video streaming at scale" | ✅ None |
| Cost | Free (already paid) | Free tier (unlimited tunnels) | Free (already installed) |

## Reference Benchmarks

- nginx on optimized VPS: 10–40 Gbps max throughput
- Cloudflare Tunnel: 1–10 Gbps (rate-limited by plan)
- Tailscale Funnel: 100 Mbps – 1 Gbps (relay server limitations)
- nginx additional latency: 2–8ms
- Cloudflare Tunnel additional latency: 15–45ms
- Tailscale Funnel additional latency: 10–80ms (relay-dependent)

## Use Case Guidance

| Scenario | Best Fit |
|---|---|
| Private tailnet-only access | Tailscale Serve (not Funnel) |
| Public metadata API, no domain, minimal infra | Tailscale Funnel + nginx rate limiting |
| Public API, need DDoS protection, have a domain | Cloudflare Tunnel |
| High-throughput, low-latency, have a domain | nginx + Let's Encrypt |
| Temporary dev/QA endpoint | Tailscale Funnel or Cloudflare `.trycloudflare.com` |

## Sources

- Onidel benchmark comparison, 2025: https://onidel.com/blog/tailscale-cloudflare-nginx-vps-2025
- Need to Know IT: Tailscale vs Cloudflare Tunnels for Self-Hosted Access, 2026
- Tailscale official docs: Funnel vs Sharing Devices
- nginx rate limiting documentation