The $5 included usage is a ONE-TIME credit, not a recurring $5/month allowance. Free HTTP(S) endpoints show an interstitial page; no additional usage beyond credit is allowed. Free TCP endpoints require card verification (no charge for verification); assigned development domains differ from paid branded/custom domains. Do not treat a one-time credit as a time-limited Free plan.

Free Personal is for non-commercial home/personal use only; work-domain or business use may enter a 14-day Enterprise trial and require a paid plan. Additional tagged resources and higher ephemeral limits have separate charges.

Free Cloud is limited to 5 users and 100 machines; paid Team/Business and self-hosted commercial-license features are separate. Payment-card requirement and explicit commercial-use terms need confirmation.

Exceeding daily transfer suspends shares until usage falls below the limit. Public shares have 2.000 requests/IP and 7.500 requests/share per 5 minutes; free no-card accounts show an anti-phishing interstitial. Production SLAs and custom limits require commercial arrangements.

Starter has community support only and limited advanced access controls; premium identity, service accounts and device posture features require paid plans. Verify payment-card requirements during signup. The separate startup Enterprise promotion is time-limited and is not this free tier.

Free tunnels show a browser safety warning; 50 requests/second per tunnel (burst 400), 25 requests/second per visitor (burst 200). Stable URLs require an SSH key; chosen subdomain names and unlimited session duration require Pro. Hosted free-tier commercial-use permission not explicitly confirmed.

Requires your own publicly reachable server/VPS, connectivity and secure authentication; hosting, domain and bandwidth costs are not included. No managed free tunnel, hosted SLA or bundled infrastructure.

Requires your own publicly reachable server and infrastructure. TCP traffic is NOT encrypted by default (the optional shared secret authenticates only the handshake); use TLS or a VPN for sensitive traffic. No built-in HTTPS or HTTP hostname routing; public bore.pub relay is a separate best-effort service.

Runs on your own server; designed for self-hosters and small organisations, not an enterprise-scale Tailscale SaaS replacement. Requires compatible Tailscale clients and self-managed HTTPS, upgrades and optional relay infrastructure; hardware and network costs apply.

Operators must host and maintain controllers, routers, PKI, identities and network connectivity; infrastructure and operations cost extra. NetFoundry hosted, managed and commercially licensed management/support products are separate paid offerings.

Free tunnel URLs change when restarted or after the 60-minute timeout; persistent tunnels, custom domains/subdomains and priority support require paid Pro. Provider does not clearly state commercial-use eligibility for hosted Free.

Free domain names rotate and throughput is speed-limited; persistent named domains and faster transfers require paid plans. Provider does not clearly specify commercial-use eligibility for free hosted tunnels.

Requires your own publicly reachable server and client configuration with shared authentication tokens; bandwidth, server hosting, IP address, security hardening and operations are not included. Not a free hosted tunnel service.

Self-hosted server requires your own public host, wildcard DNS, reverse proxy and TLS setup; hosting and bandwidth are not free. The public localtunnel.me relay is best-effort with ephemeral URLs and no guaranteed uptime or fixed subdomain.

Requires your own server, DNS, TLS, networking and ongoing maintenance. Community Edition is AGPL-3.0 (comply with source-sharing obligations); SSO, advanced RBAC, audit logs, high availability and other enterprise controls are paid. The free Enterprise personal-use license has separate revenue and eligibility limits and is NOT this plan.

You must provision and maintain lighthouse/peer nodes, certificates, networking, routing and any relay infrastructure. Cloud servers, egress, mobile platform dependencies and operations can cost extra; no hosted free VPN service or managed SLA is included.

Requires your own server, public network access, secure configuration and patching. Bandwidth, VPS and any external services are not included; no managed VPN service or SLA is provided.

Not a hosted VPN or automatic device-management service. Requires your own endpoints, key rotation, networking and infrastructure; Linux kernel components use GPLv2 while other platform components have different open-source licenses.

Requires your own gateway/server, public connectivity, certificates or authentication, networking and security operations. ISP/cloud bandwidth and infrastructure may cost money. Optional commercial licensing and paid support are separate; GPLv2 conditions apply to redistribution.

Requires self-managed management/signal/relay servers and identity/network configuration. Server components use AGPLv3 and clients BSD-3-Clause; active-active HA, SCIM, peer approval and some enterprise logging require a paid commercial license. Distinct from NetBird Cloud Free.

Personal, non-commercial use only; paid Essential plan required for commercial licensing, additional networks/devices and advanced API. Pricing effective August 4, 2026; older docs may show outdated 25-device limits.

Cloudflare requires payment details during Zero Trust onboarding even for Free, with no charge for the free subscription. No paid-plan SLA; 24-hour log retention, community support and product-specific quotas. Separate from Cloudflare DNS, Workers and Pages.

Requires your own reachable server, bandwidth and networking; VPS and egress may cost money. Configure authentication, server fingerprint validation and access controls before exposing services. Free software is not a free hosted relay.

You supply and pay for servers, networking and bandwidth. Configure authentication, TLS, firewall rules and access controls; do not expose an unrestricted public proxy. No managed free relay is included.

Self-hosting requires a reachable server, DNS, SSH keys and optionally TLS certificates; compute, domains and bandwidth are not free. The separately offered managed tuns.sh service has its own terms and is not included.

Free tunnels have session time limits and an interstitial warning page; TCP/UDP, custom domains and 24/7 availability require Pro. Intended for testing and light commercial use, not guaranteed production uptime.

Monthly 1 GB limit and one tunnel; reserved subdomains, port allocations, firewall features and higher bandwidth require a paid plan. Credit-card and commercial-use conditions for free accounts are not clearly specified.

Needs a publicly reachable relay/server and networking setup; bandwidth, compute and TLS/security operations are your responsibility. AGPL obligations apply.

Users must supply and secure their own VPN host, network bandwidth, TLS keys, updates, routing and client configurations. GPL-2.0 obligations apply to redistribution; commercial OpenVPN Access Server features, support and hosting are separate paid offerings.

Requires your own reachable server and bandwidth; infrastructure and data transfer may cost money. Not a privacy tool: use trusted TLS and protect tunneled traffic end to end. Embedded self-signed certificate is unsuitable for production trust; WebTransport additionally requires reachable UDP.

Requires your own reachable SSH server and Python 3.10+ on both ends, plus sudo/root access on the client. Remote server or network transfer may cost money; UDP support depends on the local firewall method and Windows support is experimental.

Requires self-managed Docker host, domain/DNS and port access; infrastructure, bandwidth and optional DNS services cost extra; keep the admin interface protected.

Self-hosted proxy requires compute, networking and DNS; infrastructure, certificate DNS providers and optional commercial support are not included. Secure exposed dashboards.

Requires an operator-controlled server or VPS, public connectivity, TLS configuration and bandwidth; none are free with the software. Network-provider policies, regional regulations and server security are the operator's responsibility.

You supply and secure the public server, domain, bandwidth and TLS reverse proxy; the self-hosted server has no native HTTPS. AGPL-3.0 network-use obligations apply to modified server code; vendor-hosted service and paid custom domains are not part of this self-hosted offering.

Self-operate Kubernetes nodes and networking; WireGuard support, routable UDP endpoints, cluster infrastructure and bandwidth are required. Kilo does not include hosted VPN servers or cloud compute.

Runs on your own infrastructure and uses NGINX and etcd; server, bandwidth, observability, and upstream API/LLM usage may incur costs. Paid vendor services or managed hosting are not included.

Requires your own reachable server, network, domain/DNS configuration, TLS and operational security. Hosting, domain registration and optional third-party integrations may cost money; no free managed tunneling service is included. Keep authentication and exposure rules configured securely.

This is the self-hosted Community Edition, not Netmaker SaaS or the time-limited Pro trial. You supply a compatible server/VM, public IP, domain/DNS, bandwidth and maintenance; cloud infrastructure can incur charges. Enterprise/Pro features under pro/ are separately licensed; follow Apache-2.0 notices.

Requires self-managed Linux host with Docker/Podman, networking, security updates, and optionally a reverse proxy; VPS, bandwidth, domains and maintenance are not free. Commercial use is allowed subject to AGPL-3.0 network-source and distribution obligations; no vendor-hosted free account is included.

Firezone operates the hosted control plane but gateways are deployed on your infrastructure, which may incur hosting/network costs. Paid Team/Business features and Enterprise trial are separate. Verify usage restrictions and commercial-use terms before production; no credit card is required for Starter.

Requires a self-operated coordination server reachable by peers, WireGuard dependencies and network configuration; server/VPS and bandwidth may cost money. Upstream warns that the software has not received an independent security audit and should be treated as experimental.

Requires user-operated Docker/server and network scan permissions; infrastructure and notification integrations may incur separate costs. Some network discovery methods require elevated privileges and cannot see all subnets; GPL-3.0 conditions apply.