# Private access and exposing a box

> Reach private AWS resources, or publish a service from a server. Nicolas Dao's picks for this job (Cloudless Labs, Sydney), in order of preference, what he would avoid, and what to use instead.

- Use case 15 of 21 in The Stack, last reviewed 21 October 2026
- Web page: https://cloudlesslabs.com/stack/use-cases/private-access/

Picks, in order of preference:

1. **[Tailscale](https://cloudlesslabs.com/stack/tailscale/index.md)** (My default): Your machines into the VPC.
2. **[Cloudflare Tunnel (cloudflared)](https://cloudlesslabs.com/stack/cloudflare-tunnel/index.md)** (My default): A private service onto a public domain, no open ports.

## The picks in brief

- [Tailscale](https://cloudlesslabs.com/stack/tailscale/index.md): My default. Love it. Easy, secure access from my machines to private AWS resources. Pricing: Personal: free for non-commercial use (6 users). Standard: $8 per user a month; Premium: $18. Plans include 50 tagged resources (servers, subnet routers), then $1 each a month. For comparison, AWS Client VPN in Sydney is $0.15 per subnet association an hour (about $110 a month) plus $0.05 per connection-hour.
- [Cloudflare Tunnel (cloudflared)](https://cloudlesslabs.com/stack/cloudflare-tunnel/index.md): My default. Expose a service on a private box through a custom domain, without opening a port. Pricing: Tunnel itself has no charge and is available on every Cloudflare plan. An Access login in front of it is free for up to 50 users on Zero Trust Free, then $7 per user a month (pay-as-you-go).

## Related

- [Networking and hosting](https://cloudlesslabs.com/stack/layers/network/index.md): every tool in this layer
- [Every use case and tool in one file](https://cloudlesslabs.com/stack/brief.md)
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)