Ngris vs Cloudflare Tunnel
Looking for a Cloudflare Tunnel (cloudflared) alternative that isn’t tied to one DNS and CDN ecosystem? Ngris is a policy-first edge gateway: a per-endpoint policy engine, dedicated ports and IPs, a Kubernetes operator, and an AI operator (Iris) that writes your rules. Cloudflare Tunnel is a solid product; this is an honest comparison, and we only claim what our code ships today.
Ngris pricing at a glance
What Ngris does differently
Cloudflare Tunnel connects your origin to Cloudflare’s network. Ngris is a standalone, policy-enforcing edge you drive per endpoint — without adopting a whole DNS + CDN platform.
Per-endpoint policy engine
17+ traffic-policy rule types — rate limits, CIDR/geo restrictions, JWT + CEL, API keys, CORS, JA3 bot management, WAF/OWASP, circuit breaker, URL/body rewrite, webhook verification — attached per endpoint, versioned and previewable.
Dedicated ports & IPs
Reserve dedicated TCP/UDP ports and dedicated egress IPs so partners and firewalls can allowlist a stable address. (Dedicated-IP enforcement is still being hardened — see the notes below.)
Kubernetes operator
A native operator with 9 CRDs (Tunnel, NgrisEndpoint, Domain, Certificate, ClientCA, TrafficPolicy, AuthPolicy, RoutingRule, TunnelMatrix), Ingress-class and Gateway-API support, and auto agent deployment with token rotation.
Iris, the AI operator
Ask in plain English; Iris generates firewall, rate-limit, traffic-policy, routing-rule, and error-template rules, explains requests, and can act with a confirmation card + blast-radius dry-run. Opt-in autonomy is firewall-only with auto-revert.
Edge authentication
Protect any endpoint with HTTP basic auth, mutual TLS (client CAs), or an OAuth2 + PKCE portal — enforced at the edge, no separate access product to configure.
Inspect & replay
Live request inspection plus server-side capture and replay — re-fire a captured request against your backend to reproduce a bug without waiting for it to happen again.
Ngris vs Cloudflare Tunnel, feature by feature
“Yes” means the capability ships in Ngris today. For Cloudflare we mark only widely-known facts; some capabilities exist elsewhere in Cloudflare’s platform rather than in cloudflared itself, and we note that rather than guess.
| Feature | Ngris | Cloudflare Tunnel |
|---|---|---|
| Protocols & tunneling | ||
| HTTP/1.1 & HTTP/2 | ||
| HTTP/3 / QUIC | Yes (experimental) | Available on Cloudflare’s edge |
| TCP tunneling | ||
| UDP tunneling | Neutral / check docs | |
| WebSocket | ||
| Custom domains | ||
| Runs without adopting a DNS + CDN platform | Standalone edge | Cloudflare-centric |
| Policy & security at the edge | ||
| Per-endpoint policy engine (17+ rule types) | Built-in | Via platform products |
| Rate limiting | Via platform products | |
| WAF / OWASP rules | Built-in | Via platform products |
| JA3 bot management | Via platform products | |
| JWT + CEL request validation | Neutral / check docs | |
| Circuit breaker | Neutral / check docs | |
| Identity & access | ||
| Edge basic auth | Via Cloudflare Access | |
| Mutual TLS (client CAs) | Via Cloudflare Access | |
| OAuth2 + PKCE portal | Via Cloudflare Access | |
| Dedicated resources | ||
| Dedicated TCP/UDP ports | Neutral / check docs | |
| Dedicated / static egress IPs | Built-in | Neutral / check plan |
| Traffic tooling | ||
| Live request inspector | Neutral / check docs | |
| Server-side capture & replay | Built-in | Not a built-in feature |
| AI rule generation (firewall, rate-limit, policy) | Built-in (Iris) | Neutral / check platform |
| Opt-in firewall autonomy (auto-revert) | Built-in (Iris) | Not a built-in feature |
| Platform | ||
| Kubernetes operator (CRDs + Gateway API) | 9 CRDs | Ingress controller available |
| Auto ACME / Let’s Encrypt | Cloudflare-managed TLS | |
| Agentless static hosting (deploy .zip / git push) | Via Cloudflare Pages | |
| Python SDK | Neutral / check docs | |
Cloudflare Tunnel (cloudflared) is one piece of a large platform; several capabilities above live in separate Cloudflare products (Access, WAF, Pages) rather than in the tunnel itself. Check Cloudflare’s docs for what’s included in your plan. “Neutral / check docs” means we aren’t asserting a yes or a no.
Where Ngris is still maturing
Honesty first — the flags we ship with today.
HTTP/3 is experimental
HTTP/3 / QUIC works but is not yet marked production-stable. HTTP/1.1 and HTTP/2 are the default paths.
Autonomy is firewall-only
Iris can act autonomously only on firewall rules, and auto-reverts. Every other change is gated behind an explicit confirmation card with a dry-run.
Dedicated-IP enforcement is being hardened
Dedicated ports and IPs are built; full end-to-end enforcement of dedicated IPs is still being tightened. Talk to us before you depend on it in production.
Switch in 60 seconds
Install Ngris
One egress-only binary — no daemon, no inbound ports.
curl -fsSL https://ngris.com/install.sh | shExpose a local service
Point the agent at a local port and you’re live on the edge — no DNS changes required.
ngris http 3000Add policy, auth & inspection
Attach a traffic policy, turn on edge auth, or ask Iris to write a rule — all per endpoint.
A standalone, policy-first edge. Free to start.
Developer is $0, Team is $10/mo, Enterprise is $25/mo. No credit card to get going.