Private access and exposing a box
Reach private AWS resources, or publish a service from a server.
My stack for this
- 01Tailscale
Your machines into the VPC.
- 02Cloudflare Tunnel (cloudflared)
A private service onto a public domain, no open ports.
The picks, in brief
What each one is, my verdict, and what it costs. Every name opens the full entry: when to use it and when not, the gotchas with their fixes, provisioning and alternatives.
Love it. Easy, secure access from my machines to private AWS resources.
Pricing: Personal: free for non-commercial use (6 users). Standard: $8 per user a month; Premium: $18. Plans include 50 tagged resources (servers, subnet routers), then $1 each a month. For comparison, AWS Client VPN in Sydney is $0.15 per subnet association an hour (about $110 a month) plus $0.05 per connection-hour.
Expose a service on a private box through a custom domain, without opening a port.
Pricing: Tunnel itself has no charge and is available on every Cloudflare plan. An Access login in front of it is free for up to 50 users on Zero Trust Free, then $7 per user a month (pay-as-you-go).
Where they sit
The layers of the stack this job touches, with every tool named on this page.
Networking and hosting
Private access, exposure, DNS, servers.
Want this stack in your AWS account?
Cloudless Labs is a Sydney consultancy. We migrate on-premises systems to AWS, build serverless apps on this stack, and coach teams to ship with Claude Code and Codex.