Tollan vs Cloudflare Tunnel for IoT devices
Both run a small connector that dials out, so nothing on your side listens for inbound traffic. The difference is where the encryption ends and what the identity belongs to: a tunnel in front of your web property, or a certificate on every device you ship.
Cloudflare Tunnel is a good tool for a different job
Cloudflare Tunnel runs cloudflared on a host in your network and puts your services behind Cloudflare's edge, with its caching and security features in front. For a public website or an internal web app that is a strong setup. Tollan grew up around hardware you ship to a site and then have to reach for years, one certificate per device.
| What you are deciding | Tollan | Cloudflare Tunnel |
|---|---|---|
| Inbound ports | None. The agent dials out. | None. cloudflared dials out as well. |
| Where encryption ends | Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. | For public hostnames, at Cloudflare's edge, so Cloudflare can see the traffic. That is what lets it cache and filter. |
| Your own domain | Not needed to start: each device gets an HTTPS address from Tollan. Custom domains come with the Pro and Fleet plans. | A named public hostname needs a domain with its DNS on Cloudflare. Quick tunnels give a temporary random address for testing. |
| Who the identity belongs to | The device. Every agent holds its own CA-issued certificate. | The tunnel, through a token or credentials file on the host running cloudflared. |
| Access rules | Attach IP allowlists, basic auth, or mutual-TLS to a route as edge access rules. | Cloudflare Access can put a login and policies in front of an application. |
| Microcontrollers | An ESP32 and Arduino library speaks the same protocol as the agent. | cloudflared runs on a full operating system; a board sits behind a host or gateway that runs it. |
Tools change. Check Cloudflare's current documentation for their side before you decide.
Three things that matter once hardware leaves the building
Per-device certificates
Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
Encryption ends where you choose
Passthrough routes are never decrypted at the relay. Terminating a route at the edge is a per-route choice, made only to apply the access rules you enabled.
Revocation you can prove
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously.
When Cloudflare Tunnel is the better answer
- Your domain already lives on Cloudflare and you want the service behind its edge.
- You want Cloudflare's caching and security features in front of a public website.
- Your team already signs in through Cloudflare Access for other internal apps.
- The thing you are publishing runs on a server, not on a fleet of small devices.
When Tollan fits better
- You want passthrough traffic the relay cannot read, with edge termination as a per-route choice.
- You need each unit to have its own identity, so one can be revoked alone.
- You would rather start without moving a domain's DNS anywhere.
- The same access model has to cover an ESP32, a Raspberry Pi, and a PLC gateway.
Choosing between the two
Can the tunnel provider see my traffic?
For public hostnames, Cloudflare terminates TLS at its edge, which is how its caching and filtering work; check Cloudflare's documentation for your exact setup. With Tollan: Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload. The security model sets out what the relay does and does not see.
Do I need my own domain?
No. Each device gets an HTTPS address from Tollan, and the free plan covers one device. Custom domains come with the Pro and Fleet plans.
Can one connector reach several services?
Both can. One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route.
What happens when a device is lost?
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously. You revoke that one device's certificate, and the rest of the fleet keeps running.
Does the device need a full operating system?
Not with Tollan. The ESP32 & Arduino library opens the same outbound mutual-TLS connection as the full agent — your board answers at a public hostname with no inbound port. The ESP32 & Arduino library is an early build: it ships precompiled for ESP32, ESP32-S2, ESP32-S3 and ESP32-C3 on the Arduino-ESP32 2.x core, and broader on-hardware validation is ongoing.
Try it with one device
Free forever for one device, no card required. Compare it with what you run today.