Performance and Latency Benchmark: Cloudflare Tunnel vs Tailscale vs Nebula vs OpenVPN on a $5 VPS

Let’s be real: if you’re running a $5/month VPS (like the popular Hetzner CX11 or DigitalOcean Basic 512MB), you don’t have much CPU or RAM to spare. Every bit of overhead matters—especially when you’re trying to run a secure remote access tunnel and host a small app or service.

I recently set out to benchmark four popular tunneling options under those constraints:

• Cloudflare Tunnel (formerly cloudflared)
• Tailscale
• Nebula (by Slack)
• OpenVPN (classic server setup)

All four aim to solve “secure remote access,” but they do it in very different ways. I wanted to know: how do they actually behave on low-end hardware? CPU usage? Latency? Throughput? SSH responsiveness? And—critically—how much more does each one cost you in real terms?

Let’s walk through the setup, results, and what this means for your infrastructure.

Test Environment#

• VPS: Hetzner CX11 (2 vCPU, 2GB RAM, 20GB NVMe, €3.99/month)
• OS: Ubuntu 22.04 LTS
• Kernel: 5.15.0-91-generic
• Workload: SSH tunneling + simple HTTP proxy (Nginx on port 8080)
• Clients: MacBook Pro (M1, macOS 14) over Wi-Fi (latency ~25ms to Frankfurt)
• Test Tools: iperf3, curl, hyperfine, vmstat, htop, time ssh, ping

Note: All services were tuned for minimal overhead. No systemd-resolved conflicts, no unnecessary logging, no background daemons beyond the test tunnel itself.

Methodology#

For each tunnel, I ran the following tests:

1. Baseline Latency: ping to VPS public IP vs. tunnel endpoint
2. Throughput: iperf3 -c <server> from client, 30s runs
3. SSH Responsiveness: time ssh user@host echo "ping" (10 runs, median)
4. CPU Usage: vmstat 1 during tunnel load (no traffic, 100% SSH load)
5. Memory Usage: free -m after service startup and idle for 5 minutes

All tests were run after the tunnel was stable and the system had settled (no warm-up artifacts).

The Contenders: How They Work#

Each has trade-offs: Cloudflare and Tailscale abstract away networking complexity. Nebula is more transparent but requires more ops. OpenVPN is the baseline “old school” option.

Latency & Responsiveness#

Latency measured via ping -c 100. SSH echo latency measured via hyperfine (10 runs), excluding first run.

• OpenVPN (UDP) wins for raw latency here—no extra hops, just TLS over UDP.
• Cloudflare Tunnel adds ~6ms extra due to Cloudflare edge routing (Frankfurt → Amsterdam → client).
• Nebula shows the highest latency due to STUN negotiation + mesh routing (even with direct peers, it occasionally falls back to DERP in testing).
• Tailscale is in the sweet spot—fast, but with occasional DERP fallback (~10% of packets rerouted).

🚨 Real-world impact: SSH feels snappy with all except Nebula. Nebula had visible ~200–300ms spikes during NAT traversal attempts, even with a direct line-of-sight connection.

Throughput (iperf3, 30s UDP/TCP)#

• Tailscale and OpenVPN dominate throughput.
• Cloudflare Tunnel is half the speed—this is expected. Cloudflare tunnels traffic through its global edge, which adds latency and reduces throughput.
• Nebula’s UDP loss is notable (~3%)—likely due to its aggressive NAT traversal and occasional fallback.

💡 Practical note: For small HTTP workloads (e.g., proxying a single API), all tunnels are fast enough. But if you’re moving files or streaming logs, OpenVPN or Tailscale win.

Resource Usage on the $5 VPS#

All values measured using ps aux --no-headers -o rss,pcpu,pcpu under controlled load.

• OpenVPN uses the least memory and has the lowest overhead under load—classic efficiency.
• Tailscale and Nebula both use ~150MB+ RSS. That’s not huge, but on a 2GB VPS, it adds up if you’re running other services.
• Cloudflare Tunnel is extremely lightweight—but only if you’re okay with routing all traffic through Cloudflare.

⚠️ Gotcha: Tailscale’s memory usage can spike under high peer count (e.g., >100 devices). In our single-client test, it was stable.

Security & Operational Trade-Offs#

Let’s not pretend this is just about numbers.

Cloudflare Tunnel#

✅ Pros: No open ports, DDoS protection, built-in auth (IAM + SSO), free tier includes 100k req/day
❌ Cons: You’re trusting Cloudflare with all traffic; latency varies by region; no direct peer-to-peer; can’t expose internal services without Access policies

Tailscale#

✅ Pros: WireGuard performance, built-in MagicDNS, SSH over TLS, auto-updates, great docs
❌ Cons: Free tier limits (no subnet routing on free), control plane is SaaS, audit log costs extra

Nebula#

✅ Pros: Self-hosted CA, fine-grained firewall rules, no cloud dependency
❌ Cons: Steeper learning curve, limited Windows GUI, STUN can fail in restrictive NATs

OpenVPN#

✅ Pros: Works everywhere, tunneled over port 443, mature ecosystem
❌ Cons: PKI management pain, no NAT traversal, deprecated ciphers still common (e.g., SHA1), no built-in audit

🛡️ Zero-trust reality check: None of these are fully zero-trust by default. You need to configure it (e.g., Tailscale ACLs, Nebula firewall rules, Cloudflare Access policies). OpenVPN is the odd one out—it’s not zero-trust unless you add MFA + SSO.

Real-World SSH Benchmark#

I timed 10 ssh user@host echo "pong" commands. Here’s how they felt:

🧪 Test command: time ssh -o StrictHostKeyChecking=no -i key user@host "echo pong"

Nebula’s variance is concerning. In my logs, it timed out twice during NAT traversal (STUN failed, then fell back to DERP after 1s). Tailscale never had this issue.

Cost Analysis: Beyond the $5 VPS#

Here’s the real cost breakdown for a small team (3 users, 5 services):

💸 Hidden cost: If you use Cloudflare Tunnel or Tailscale, your bandwidth isn’t free. Cloudflare Tunnel’s free plan includes 100k HTTP req/day, but TCP proxying (e.g., SSH) doesn’t count—so you may hit bandwidth caps faster on low-tier VPS plans.

When to Use Which#

🚫 Don’t use: Cloudflare Tunnel for low-latency internal services (e.g., real-time APIs). Don’t use OpenVPN if you need zero-trust features.

FAQ#

1. Does Cloudflare Tunnel really hide my server IP?#

Yes—your server only talks to Cloudflare’s edge. External clients never connect directly. But if you expose services (e.g., via cloudflared tunnel route), you must still configure Access policies to prevent bypass.

2. Can I run Nebula or Tailscale without a control plane?#

• Nebula: Yes—self-hosted Lighthouse nodes act as a lightweight CA/mesh controller.
• Tailscale: No—the control plane is hosted by Tailscale. Self-hosting is only for enterprise (tailscale.com/self-hosted).

3. Why is Nebula slower than Tailscale?#

Nebula uses its own crypto (Noise IK + ChaCha20), and NAT traversal is less robust than Tailscale’s DERP + STUN stack. It also doesn’t do automatic path optimization.

4. Is OpenVPN still viable in 2024?#

Yes—if you control the endpoints, need port flexibility, or have legacy tooling. But avoid SHA1 ciphers and stick to AES-GCM + TLS 1.3.

5. What’s the best for a $5 VPS?#

Tailscale or Cloudflare Tunnel, depending on your needs:

• Need SSH + HTTPS with minimal config? → Tailscale
• Need public HTTPS with DDoS protection? → Cloudflare Tunnel
• Want full control, no SaaS? → Nebula (if you accept the latency trade-off)

Final Thoughts#

The “best” tunnel isn’t the fastest or cheapest—it’s the one that fits your operational reality.

On a $5 VPS, Tailscale gives the best balance: low overhead, great UX, and decent performance. Cloudflare Tunnel is ideal if you already live in the Cloudflare ecosystem and don’t mind proxying everything. Nebula is powerful but not for beginners. OpenVPN is still useful—but only if you need backward compatibility or strict on-prem control.

If you’re building something small, don’t overthink it. Start with Tailscale or Cloudflare Tunnel, measure, and pivot if needed.

🙏 Big thanks to the teams behind these tools—especially the open-source ones. They’ve made secure networking accessible, even on a coffee-budget VPS.

—
If you found this useful, you might also enjoy my deeper dives into WireGuard, QUIC, and zero-trust patterns on mahbuburriad.com.