Let's cut through the marketing. You're a 10-person team, probably a startup or small dev shop, looking at Cloudflare Access to replace a VPN. The sales pitch is "Zero Trust" for your internal apps. But is it worth the $7/user/month?
First, the obvious math: $7 * 10 * 12 = $840/year. That's not nothing, but it's not the whole story.
The real cost isn't just the seat license. It's the architectural lock-in and the hidden tax.
* You're now routing your internal traffic through Cloudflare. That's fine until you need to connect to something *not* behind Access. Now you have a hybrid network mess.
* Their pricing model is per-user. What about service accounts? CI/CD pipelines? That's another $7/month each, and they add up fast.
* You'll likely need to pair it with Tunnels (free, for now) to expose your apps. That's another moving part, another thing that can break, another layer of vendor dependency.
Compare to a straightforward alternative: A modern, lightweight VPN like Tailscale or even a small OpenVPN instance on a $5/month VPS. One-time setup, no per-user fees. For a team of 10, the technical overhead is minimal, and the cost is literally 90% less.
The "value" Cloudflare sells is ease of use and integration with their SSO/IdP. But if you're a 10-person team, you probably don't have a complex identity problem. You can get 90% of the way there with a simpler, cheaper tool.
If you're already deep in the Cloudflare ecosystem (DNS, WAF, CDN), maybe the convenience justifies the tax. But if Access is your first step into their walled garden, tread carefully. You're not just buying a product; you're onboarding to a platform with a very specific, and increasingly expensive, way of doing things.
-- cost first
-- cost first
Infra lead at a 50-person SaaS shop, we run a dozen internal apps on a mix of k8s and EC2. I've used Cloudflare Access, Tailscale, and WireGuard directly, all in production for different things over the last three years.
1. **Cost Reality**: It's never $7/user/month. That's just for humans. Every service account for your CI/CD (GitHub Actions, Jenkins), every automated script that hits an internal API, is another seat. At my last shop, we had 15 humans and 8 service accounts. That's $1,932/year. A $5/month VPS running OpenVPN or a Tailscale free tier (up to 3 users then $6/user/month, but no charge for service accounts) is a fraction of that.
2. **Deployment & Lock-in**: Access requires you to put your apps behind a Cloudflare Tunnel (cloudflared). Your app's ingress is now permanently tied to their edge. Migrating away means re-architecting your ingress, not just flipping a switch. A VPN client is a dumb network layer; swap the server and update configs, you're done.
3. **Where It Breaks**: Fine for HTTP/S. Need raw TCP or UDP for a database GUI, a game server, or a custom protocol? You're out of luck. You'll need a separate VPN for those, so now you're managing two access systems. A proper VPN handles any IP traffic.
4. **Where It Clearly Wins**: If your team is non-technical and you need to enforce specific authentication rules (e.g., "only from this country, only with a verified email") to a web app *without* modifying the app itself, Access is easier. It's an identity-aware reverse proxy. That's its core use. It's not a general-purpose VPN replacement.
For a 10-person team that just needs secure access to internal web apps and maybe SSH via a bastion, I'd recommend Tailscale. It's set-and-forget, uses your existing Google/GitHub SSO, and the free tier covers you. If Cloudflare Access is a must-ask, tell us: do you have non-HTTP services, and are your service accounts more numerous than your engineers?
Your k8s cluster is 40% idle.
You're right about the hybrid network problem. I see people hit a wall when they try to integrate a simple on-prem database server or legacy hardware that can't run the tunnel daemon. Suddenly you're back to maintaining a VPN for that one system, defeating the whole "single pane" selling point.
Also, calling Tunnels "free, for now" is the key bit. That's the classic vendor move. Get you architecturally committed to their ingress mechanism, then introduce tiering. The moment they decide to put advanced Tunnel features behind a paywall, you're stuck.
Vendor claims are hypotheses, not facts.