Alright, I've been down this rabbit hole for the last quarter and my team is tired of me switching. We're a 70-person shop with 90% of our infra on AWS (EC2, RDS, S3, some EKS). We've been testing both Cloudflare Zero Trust (formerly Teams) and Perimeter 81 to replace our old VPN setup.
My initial take: Cloudflare feels like it's built for the web-first, with ZTNA extending to apps beautifully. Perimeter 81 feels more like a traditional SASE/ZTNA wrapper, but with a strong focus on network-level security.
Here's where I'm stuck on the AWS-specific bits:
* **Private AWS Resource Access:** Perimeter 81's network-as-a-service model means spinning up a "gateway" in our VPC. It's a clean tunnel for everything, treating AWS like another private network. Cloudflare's approach with `cloudflared` daemons feels more app-protocol aware (HTTP, SSH, RDP), but sometimes I wonder about raw database ports or non-web services.
* **Pricing & Scale:** Cloudflare's per-user pricing is simple, but their egress fees can bite if we have heavy internal traffic between services *through* their network. Perimeter 81's per-connector model is different—cost scales with concurrent connections, not pure users, which could be better or worse.
* **Integration & Automation:** Both have APIs. For a CRM hopper like me, the Terraform/CLI experience is key. Cloudflare's API is massive, but Perimeter 81's seems more focused on user/device provisioning. How deep can I go in automating gateway deployments in AWS?
**Key comparison points for our use case:**
- Securing SSH access to EC2 instances (bastion replacement)
- Allowing devs to connect to private RDS/Aurora instances
- Admin access to AWS Console (via IdP) and internal web apps (like Jenkins)
- Auditing and logging—tying access back to individual users, not shared IPs.
Has anyone run both in a similar environment? I'm especially curious about the day-to-day ops overhead and any weird latency issues when tunneling all this through a third party. The devil's always in the details with these platforms.
Still looking for the perfect one
Senior infrastructure architect at a 200-person SaaS shop, ~80% on AWS, running a mix of EC2, RDS, and a few EKS clusters. We evaluated both Cloudflare Zero Trust and Perimeter 81 about 18 months ago, ended up running Cloudflare for most of our stack but kept Perimeter 81 in one corner for legacy crap. Here's the breakdown that actually matters for an AWS-heavy environment.
**AWS Resource Access: App-level vs. Network-level**
Cloudflare's `cloudflared` tunnels are fine for HTTP/S, SSH, and RDP - they terminate at the app layer so you get per-route controls and audit logs with URL paths. But raw database ports (PostgreSQL on 5432, MySQL on 3306) are a pain. You either wrap them in a web proxy like `pg_tunnel` or use Cloudflare's private network feature (which is basically a WireGuard tunnel to a cloudflared node, not app-aware). Perimeter 81's gateway sits in your VPC as a plain network-level tunnel - you get a private IP range and can hit any port directly. For us, that meant DBA workflows on RDS worked out of the box with Perimeter 81, while Cloudflare required extra config. If you have any non-web services (Redis, Kafka, legacy TCP apps), Perimeter 81 is simpler.
**Pricing gotchas: egress vs. connector scaling**
Cloudflare's per-user pricing is $4-7/user/mo for the ZTNA tier, but they charge egress for traffic going through their Argo Tunnel - in our environment, that was about $0.09/GB after the first 10GB free per user. If your devs hit internal APIs through Cloudflare's edge, that egress adds up fast. We saw a $1,200/month bill jump when we routed all RDS query traffic through Cloudflare for a team of 40. Perimeter 81 charges per concurrent connector (gateway) - ~$10-15/connector/mo plus $8/user/mo. The connector cost is flat, no egress, but you pay for the number of gateways you need for availability. At 70 users, we estimated Perimeter 81 would be about 20% cheaper than Cloudflare if we had heavy internal traffic, but 30% more expensive if most traffic was just web apps.
**Deployment and integration effort**
Cloudflare's `cloudflared` daemon is dead simple to deploy - one binary, a config file, and it's up. We spun up 10 tunnels in an afternoon. But managing DNS records for each private app gets messy if you have 50+ internal services. Perimeter 81's gateway is a heavier VM or container (I ran it as a t3.medium in our VPC). It needs network permissions to your private subnets, and you have to maintain the gateway software updates. Not hard, but it's another box to babysit. Cloudflare wins here for simplicity, especially if you're already using their DNS.
**Where each breaks**
Cloudflare breaks when you need L4 access to anything that isn't HTTP/S, SSH, or RDP. We had a legacy monitoring tool that used a custom TCP protocol - literally couldn't make it work through Cloudflare without a hacky reverse proxy. Perimeter 81 breaks when you have multi-region AWS architectures - each gateway is tied to one VPC, so you need a gateway per region or a VPN mesh. We had three regions, meant three gateways + routing between them, which added latency. Also, Perimeter 81's client app is heavier than Cloudflare's WARP client - it's a full network TUN adapter, causes more issues with split-tunneling.
**My pick:**
If your internal traffic is mostly HTTP/S, SSH, and you don't mind per-service config for DB access, go Cloudflare - it's simpler, better for web-first devs, and integrates with their WAF and CDN naturally. If you have raw database ports, legacy TCP services, or want a single network tunnel that treats AWS like a flat LAN, Perimeter 81 wins. Tell us what percentage of your traffic is non-web (i.e., not HTTP, SSH, or RDP) and whether you're willing to wrap those in web proxies. That's the deciding factor.
monoliths are not evil