Cruma vs Cloudflare Tunnel
Cloudflare Tunnel and Cruma both publish a service on your machine without a public IP address. A small agent (cloudflared or cruma) makes an outgoing connection, so nothing needs to be opened on your router. This page compares them feature by feature. Every claim about Cloudflare links to Cloudflare's own documentation.
Side by side
As of November 2026, based on Cloudflare's public Tunnel documentation and plans page. Plans and features change; check the linked sources for the current details.
| Cruma | Cloudflare Tunnel | |
|---|---|---|
| How it connects | The agent connects out to Cruma; no public IP or open ports needed (Quick start). | cloudflared makes an outbound-only connection to Cloudflare's network; no publicly routable IP needed (docs). |
| Start without an account | Anonymous tunnels run for up to 3 hours per session, with 1 GiB of traffic per session (Rate limits). | Quick Tunnels need no Cloudflare account or domain. They are "for testing and development", allow up to 200 in-flight requests (more get a 429) and don't support Server-Sent Events (docs). |
| Price | Anonymous and Free cost nothing; Basic is $5/month and Pro $10/month (Pricing). | "Available on all plans" (docs). The plans page doesn't list Tunnel separately. |
| Your own domain | Basic and Pro: add a CNAME at any DNS provider (Custom domains). | Publishing an application needs "A domain on Cloudflare" (docs). |
| Where TLS ends on your domain | On your machine. The agent gets its own certificate, and Cruma forwards the encrypted stream (Security). | Traffic is proxied through Cloudflare's network, which applies CDN caching, WAF and DDoS protection (docs). Cloudflare keeps two connections: "one between your visitors and Cloudflare, and the other between Cloudflare and your origin server" (docs). |
| Request inspection | Desktop app and terminal UI; request logs stay on your machine (Watching your traffic). | Tunnel logs stream to your terminal with cloudflared tail or to the dashboard's Live logs tab, and cloudflared can write a local log file with --log-directory (docs). |
| Access control | Built into the agent per route: IP filters, a login form, Basic auth, API keys, JWT, and any OAuth2/OIDC provider (Security). | Cloudflare Access policies, deny by default, with rules based on your identity provider (docs). |
| Serve a folder | cruma serve ./www (Common scenarios). | No file server among the service types; the closest are a fixed HTTP status and a hello-world test page (docs). |
| Non-web traffic | TCP ports on Basic and Pro; on Pro, an IPv6 tunnel for any TCP or UDP traffic. People connecting need IPv6 and connect directly, for example with ssh (TCP ports and IPv6). | TCP, SSH, RDP and SMB; "Non-HTTP services require installing cloudflared on the client" (docs). UDP and ICMP reach private networks from devices running the Cloudflare One Client in your Zero Trust organization (docs). |
| Uplink to the service | QUIC and HTTP/2 channels side by side; Cruma sends visitors over QUIC when it can, and --protocol picks auto, quic or h2 (Rate limits). | --protocol picks auto, http2 or quic (docs). |
| Redundancy | Each agent keeps up to 4 parallel connections (QUIC and HTTP/2) to several Cruma edge nodes in the nearest region (EU or US-East), and switches to the other region by itself if its own becomes unreachable. One agent serves many sites. Pro also runs up to 3 agents on one tunnel, all active, with traffic spread across them (Rate limits). | Each tunnel keeps four connections to two data centers, and you can run several cloudflared replicas (docs). |
Where Cruma differs
- Your domain stays where it is. Add a CNAME at your current DNS provider; there's no need to move the domain. See Custom domains.
- TLS ends on your machine. On Basic and Pro, the agent gets a certificate for your domain automatically. Cruma forwards the encrypted stream and can't read it, and the keys never leave your machine. See Security.
- You see every request locally. The desktop app records requests with headers, bodies and timing, and lets you copy one as a
curlcommand. The logs never leave your machine. See Watching your traffic. - The agent is a web server and reverse proxy. It serves folders, starts and restarts your apps, and runs a firewall and sign-in in front of them, all configured in a desktop app or one config file. See Common scenarios.
- Coding agents can drive it. Claude Code, Codex and other agents connect over MCP (
cruma mcp) and ask before they make anything public. See Coding agents.
When to pick Cloudflare Tunnel instead
- You want Cloudflare's edge in front of your site. Traffic through Cloudflare Tunnel gets CDN caching, WAF and DDoS protection (docs). Cruma relays traffic to your machine; its firewall and WAF rules run in your agent (Security).
- Your domain is already on Cloudflare and your team uses Cloudflare Access. Tunnel fits into the policies you already have (docs).
- You're giving a team access to a private network. Devices with the Cloudflare One Client can reach private IP ranges, including UDP and ICMP (docs).
- You want your own domain without a paid tunnel plan. Cloudflare lists Tunnel as available on all plans (docs); Cruma custom domains need Basic or Pro (Custom domains).
- You need a formal SLA. Cruma is run by a small team and has no formal SLA today (Rate limits).
Get started
Install the agent from Downloads, or from a terminal:
- macOS (Apple Silicon):
brew install --cask umbra-yurei/brew/cruma - Linux:
curl -fsSL https://files.cruma.io/files/tunnel-agent/install/linux-install.sh | bash - Windows:
winget install 9NXKT3W34HVL --source msstore
Then share a local port:
cruma proxy http 3000
You get a public HTTPS address right away, with no account. Create a free account when you want the tunnel to keep running.