Know what Cloudflare does not build here

This lab gives a remote device access to a private network. Before building it, let’s be precise about what it does not give you. The marketing around “VPN replacement” invites confusion, and I want you to walk in with clear expectations.

It does not create an anonymous consumer VPN. Your organization’s administrator can see traffic logs, because visibility is the point of the product. If your goal is hiding activity from an observer, this tool points in the opposite direction. It exists so that someone, the admin, sees more, not less.

It does not create a Worker-based WireGuard server either. The previous lesson covered why. Workers cannot terminate inbound VPN connections, whatever creative blog posts suggest.

Cloudflare becomes part of the traffic path and of your trust model. You depend on its account, its client, its routing, its policies, and its availability. When Cloudflare has an outage, your people cannot reach internal tools, and there is no server of yours to restart. That is the same shape of trade a consumer VPN customer makes, trusting an operator, with a different company and an actual contract.

You also give up server-level control. There is no root shell on Cloudflare’s edge. You cannot run tcpdump in the middle of the path. You debug through the dashboards and logs Cloudflare chooses to expose. On the WireGuard server, sudo tcpdump -i wg0 showed you every packet. Here, the closest you get is the Gateway logs.

Here is the split:

you still own       the private network, the resources, the policy decisions
you now delegate    transport, client software, policy enforcement, availability
you cannot get      anonymity, protocol control, root access to the middle

Product limits are real and they move. The Zero Trust Free plan currently targets teams under 50 users. Plan details and dashboard labels change over time, so check the current pricing and documentation rather than trusting any course or blog post. That includes this one.

So when does each design win? Use WireGuard when you want to own the endpoint and the protocol configuration, or when a third party in the path is unacceptable. Use Cloudflare private access when identity policy and outbound-only connectivity fit the job better than key distribution does.

My own rule of thumb: one person and a couple of servers, WireGuard. A team where people join and leave, and where “who can reach what” needs an answer with a name attached, Cloudflare.

The mistake to avoid is treating today’s free tier as a permanent architectural guarantee. If your access design only works because a plan is currently free, put a reminder in your calendar and revisit that assumption on a schedule.