Closing port 22 to the internet is the common goal. The tools get there differently: a connector that dials out to an edge network, a private mesh between devices, a public tunnel endpoint, or an agent that carries a terminal rather than SSH itself.
Side by side
| Cloudflare Tunnel + Access | Tailscale | ngrok | Subnomic | |
|---|---|---|---|---|
| Connection | cloudflared opens outbound-only connections to Cloudflare | Devices connect to each other across NAT and firewalls, without port forwarding | The agent dials out over TLS on port 443 | The agent opens one outbound TLS connection to Subnomic |
| Who can reach the server | Users your Access policy allows, through a public hostname or private routing | Only devices on your tailnet, unless you choose Funnel | A public TCP address; source IPs can be restricted; private internal endpoints on Pay-as-you-go | Workspace members with the permission, and only through Subnomic |
| On the laptop | Nothing for the browser terminal; cloudflared or the Cloudflare One Client for the other methods | The Tailscale client | An SSH client | A browser, or the subnomic CLI for subnomic ssh |
| SSH | Browser terminal, cloudflared, or short-lived certificates through Access for Infrastructure | Tailscale SSH, on all plans; the server side on Linux and macOS | ngrok tcp 22, then a normal ssh -p | A terminal through the agent, not an SSH connection; port 22 can stay closed |
| What is kept of a session | SSH command logs, stored encrypted with your key, on all plans | Replayable recordings through Tailscale PAM, in beta and sold separately; the older recorder is being retired | Not documented | Full terminal recordings for replay, live watching, on Team and Enterprise |
| Free | Up to 50 users | Up to 6 users, unlimited devices | 3 endpoints, 1 GB a month; TCP needs a card on file | Servers start on Pro (3 servers) |
When each one fits
- Cloudflare Tunnel with Access fits a team already on Cloudflare: free for up to 50 users, a browser terminal with nothing to install, and the same tunnel publishes internal web apps behind single sign-on.
- Tailscale fits when people need the network, not just a shell: once a laptop is on the tailnet, every tool that speaks TCP works, scp and database clients included.
- ngrok fits a quick, temporary way in, or exposing a local service for a demo or a webhook. Its free TCP endpoint is public, protected by IP rules rather than user identity.
- Subnomic fits when the shell needs rules and records: guardrails check each command, sessions are recorded and can be watched live, a server can require just-in-time approval before anyone connects (Enterprise), and the same agent carries database consoles, internal apps and
kubectl.
What Subnomic does not do
It is not a VPN: the laptop does not join a network, so tools that need a raw connection to the server, such as scp or a desktop database client, are not carried. The host agent is released for Linux with systemd on amd64. Servers are not on the Free plan; they start on Pro, and recording and guardrails start on Team.
How the agent works is in Agents; why it dials out is in SSH without a single open port; the plans are on the Fleet page.
Sources
What this page says about other products is taken from their own pages, read on 12 November 2026. Plans and limits change; if one of these has, tell us and we will correct it.
- Cloudflare Tunnel: overview
- Cloudflare Tunnel: SSH methods
- Cloudflare: Access for Infrastructure SSH
- Cloudflare Access: plans
- Tailscale: what is Tailscale
- Tailscale SSH
- Tailscale Funnel
- Tailscale: session recorder
- Tailscale PAM
- Tailscale: pricing
- ngrok: agent
- ngrok: TCP endpoints
- ngrok: SSH
- ngrok: internal endpoints
- ngrok: restrict IPs
- ngrok: free plan limits