Know what Cloudflare does not build here

This lab gives a remote device access to a private network. Before building it, be precise about what it does not give you — the marketing around “VPN replacement” invites confusion.

It does not create an anonymous consumer VPN service. Your organization’s administrator can see traffic logs, because visibility is the product’s point. If your goal is hiding activity from an observer, this tool is aimed in the opposite direction: it exists so that someone — you, the admin — sees more, not less.

It does not create a Worker-based WireGuard server either. The previous lesson covered why: Workers cannot terminate inbound VPN connections, whatever creative blog posts suggest.

Cloudflare becomes part of the traffic path and trust model. You depend on its account, client, routing, policies, and service availability. When Cloudflare has an outage, your people cannot reach internal tools, and there is no server of yours to restart. That is the same shape of trade a consumer VPN customer makes — trusting an operator — with a different company and an actual contract.

You also give up server-level control. There is no root shell on Cloudflare’s edge. You cannot capture packets in the middle of the path. You debug through the dashboards and logs Cloudflare chooses to expose.

you still own       the private network, the resources, the policy decisions
you now delegate    transport, client software, policy enforcement, availability
you cannot get      anonymity, protocol control, root access to the middle

Product limits are real and they move. The Zero Trust Free plan currently targets teams under 50 users. Plan details and dashboard labels can change, so check the current pricing and documentation rather than trusting any course or blog post — including this one.

So when does each design win? Use traditional WireGuard when you want to own the endpoint and protocol configuration, or when a third party in the path is unacceptable. Use Cloudflare private access when identity policy and outbound-only connectivity fit the job better than key distribution does.

The mistake to avoid: treating today’s free tier as a permanent architectural guarantee. If your access design only works because a plan is currently free, revisit that assumption on a schedule.