Concepts
Teitunnel and Cloudflare's own tools
How Teitunnel compares with managing Cloudflare Tunnel through the cloudflared command line or the Cloudflare dashboard, and when to use which.
Teitunnel doesn't replace Cloudflare Tunnel; it's a way to use it. You can do the same
things with Cloudflare's own tools, the cloudflared command line and the Cloudflare
dashboard, and mix them: Teitunnel reads what's in your account and only changes what it
made.
| cloudflared CLI | Cloudflare dashboard | Teitunnel | |
|---|---|---|---|
| Share a port with no account | cloudflared tunnel --url | no | Quick Share, one click, with a QR code |
| Share a folder of files | no | no | Quick Share or on your domain |
| Create a tunnel, routes and DNS | several commands | several pages | one reviewed change |
| See changes before they're made | no | no | every change, as a plan |
| Undo a change that failed halfway | by hand | by hand | automatic, and Undo right after applying |
| Records it didn't create | overwrites on request | edits anything | asks first, never deletes |
| Keep running at login or boot | cloudflared service install | n/a | one switch; launchd, systemd or Task Scheduler |
| Find what's running locally | no | no | dev servers and containers |
| Explain problems | logs | status pages | Doctor, with fixes |
| Traffic and logs | metrics endpoint, log files | per tunnel | per tunnel and route, live, plus edge analytics and uptime |
| Inspect, replay and edit requests | no | no | the inspector |
| Pause or schedule a hostname | no | no | yes, same address |
| Logins (Access) for a route | separate API calls | separate pages | one switch on the route |
| Bot, rate limit and header rules for one hostname | API calls | several pages | one change, scoped to the hostname |
| Static copy online while you're offline | no | a Worker you deploy | Snapshots, from a folder, a build or a running site |
| Page shown while your computer is off | no | a Worker you write | offline page, one switch |
| Load balancing across machines | API calls | several pages | one change |
Local HTTPS domains (.test, .localhost) | no | no | yes, with a trusted certificate |
| Config in your repository | config.yml | no | teitunnel.yml project files |
| AI agents | no | no | MCP server; changes wait for your approval by default |
| Export to config.yml, Compose, Terraform | n/a | n/a | yes |
| Runs on | anything | a browser | macOS, Windows, Linux, servers, Docker |
When to use what
- Teitunnel when you want it done quickly and safely, especially on a laptop or a few servers, or if DNS mistakes would hurt.
- The dashboard for account-wide Zero Trust settings Teitunnel doesn't cover: identity providers, device posture, Gateway policies, and domain-wide security settings.
- cloudflared directly, or Terraform, when the tunnel is part of infrastructure managed as code. Teitunnel can export its routes as a starting point, and project files keep a setup in your repository.
Using them together
- Teitunnel creates its own tunnel for each computer and changes only that one. Tunnels
made elsewhere are listed, and you can import a
config.ymlsetup or run an existing tunnel. - Routes changed in the dashboard are noticed, and Teitunnel asks before putting its own back (Routes and tunnels).
- DNS records, Access applications and rules you made yourself are never deleted without your confirmation (DNS ownership).
Related
Last updated on
DNS ownership
Which DNS records Teitunnel may change on its own, how it marks and remembers them, why it asks before touching any other record, --replace and --take-over, reservations for teams sharing an account, and how the Doctor cleans up dangling records safely.
Accounts and permissions
Connect Cloudflare accounts with Sign in with Cloudflare or an API token, what each permission is for, how to fix a missing one in place, and where credentials are kept.