Blog · Comparison
RocketZero vs Cloudflare Tunnel for NAS remote access
Both get you to your Synology NAS without port forwarding — even behind CGNAT. But they solve different problems: Cloudflare Tunnel publishes a web app to the internet, while RocketZero mounts your NAS as a drive. Here's the honest, technical comparison.
TL;DR
- Cloudflare Tunnel is excellent for exposing a web service (DSM in a browser, a website, a photo gallery) to a public HTTPS address. It needs your own domain on Cloudflare, a
cloudflaredcontainer, and some dashboard setup — and Cloudflare sees your traffic. - RocketZero is built to use your NAS: it mounts as a real drive on your computer, end-to-end encrypted, direct peer-to-peer when possible, with no domain and no Docker.
- Want a public web page? Cloudflare Tunnel. Want your files as a drive, privately, in two clicks? RocketZero.
They're built for different jobs
The single most important thing to understand: Cloudflare Tunnel is a way to publish a website or web app; RocketZero is a way to use your NAS's files.
Cloudflare Tunnel runs a small daemon (cloudflared) on your NAS that makes an outbound connection to Cloudflare. You then map a public hostname like files.yourdomain.com to a service on your NAS. Open that URL in a browser and you're in — great for DSM's web interface, Synology Photos, or a site you host. This is exactly what the Cloudflare community forums and r/synology guides walk through.
But the moment you want your NAS to behave like a drive — drag a file in from Explorer, save a Word document straight to it, browse folders in Finder — Cloudflare Tunnel isn't the right tool. SMB (the drive protocol) isn't HTTP, so you end up layering on Cloudflare's WARP client and a raw TCP proxy. It works, barely, and it's a long way from "my NAS shows up as V:".
RocketZero starts from the other end. It mounts your NAS as a normal network drive on Windows and macOS, over an encrypted overlay, so every app on your computer just sees a drive. That's the whole point.
And when you do want a browser, RocketZero covers that too. Every NAS gets an address like https://home-nas.roze.to that opens DSM and its web apps — Photos, File Station, anything web — right in a browser, with HTTPS already set up. No domain to buy, no certificate to manage, no Docker, no Zero Trust dashboard. So RocketZero does both jobs: the browser access Cloudflare Tunnel is built for, plus the mounted drive it can't do. (Like any hosted reverse proxy — Cloudflare included — that browser path is decrypted at the relay so it can be routed; the drive mount is the end-to-end-encrypted, direct peer-to-peer path.)
Side by side
| What you care about | Cloudflare Tunnel | RocketZero |
|---|---|---|
| Mount your NAS as a drive (SMB) | ✕ Web / HTTP only | ✓ Yes — V:, Z:, Y:… |
| Open DSM & web apps in a browser | ✓ Yes — its core job | ✓ Yes — home-nas.roze.to |
| Setup | ✕ Domain on Cloudflare + Docker + Zero Trust | ✓ Install package + app |
| Needs your own domain | ✕ Yes (moved to Cloudflare) | ✓ No — free <id>.roze.to |
| Works behind CGNAT / no public IP | ✓ Yes | ✓ Yes |
| End-to-end encrypted | ✕ No — TLS ends at Cloudflare | ✓ Yes — WireGuard |
| Traffic path | ✕ Always via Cloudflare's servers | ✓ Direct P2P when possible |
| Large files & media streaming | ✕ Restricted by ToS §2.8 | ✓ No limit — your data, your path |
| Exposure | ✕ Public hostname (add Access to lock) | ✓ Private — only your devices |
| Best at | ✓ Publishing a web app to the internet | ✓ Using your NAS as a drive |
Setup: a dashboard vs two installs
This is where most people feel the difference. A typical Cloudflare Tunnel setup for a NAS looks like: register a domain, move it onto Cloudflare (change your nameservers), install cloudflared (usually via Docker / Container Manager), create a tunnel in the Zero Trust dashboard, and add an ingress rule for each service. Then, because the hostname is public, you add Cloudflare Access policies to require login — and DSM's own apps famously fight with Cloudflare Access's two-factor prompts.
RocketZero is two installs: the package on your NAS, the app on your computer. Pick a name, sign in with your NAS account, and your drives appear. No domain, no Docker, no dashboard. (See the step-by-step setup guide.)
Privacy: who can see your files
Cloudflare Tunnel terminates TLS at Cloudflare's edge. In plain terms, your traffic is decrypted on Cloudflare's servers so their network can route and protect it. Cloudflare is a reputable company, but this is not end-to-end — a middleman does see your content.
RocketZero uses WireGuard end-to-end encryption between your devices. When a direct peer-to-peer path is available (very common on real home and office networks), your data never touches our servers. When it can't punch through and falls back to a relay, that relay only ever handles ciphertext — we can't read your files even if we wanted to.
Large files and media
Here's a limit people hit late: Cloudflare's Terms of Service (section 2.8) restrict serving a disproportionate amount of non-HTML content — think large downloads and video streaming — through their CDN on the free plans. Running a media server or moving big backups over a free Cloudflare Tunnel can put you offside.
RocketZero doesn't proxy your bulk traffic through a shared CDN. On a direct connection there's no middleman at all, and even on relay there's no content-type rule to trip over — it's your data on your own link.
So which should you use?
Choose Cloudflare Tunnel if…
- You want to publish a web service — a site, DSM Photos, a web app — at a public URL anyone can open.
- You already use Cloudflare and have a domain there.
- You're comfortable with Docker and the Zero Trust dashboard.
Choose RocketZero if…
- You want your NAS as a drive — open, edit and save files like a local disk.
- You also want browser access to DSM and its web apps, at your own
roze.toaddress, with nothing extra to set up. - You want the drive private and end-to-end encrypted, not published to the internet.
- You want it done in minutes, with no domain and no Docker.
FAQ
Can Cloudflare Tunnel mount my NAS as a network drive?
Not really. Cloudflare Tunnel is built for HTTP/HTTPS services — it publishes your NAS's web apps (DSM, Photos, a website) to a public URL. Mounting your NAS as a drive uses SMB, which isn't HTTP, so you'd need to layer on Cloudflare's WARP client and a cloudflared access tcp proxy — complex, and still not a real mapped drive. RocketZero mounts your NAS as a normal drive (V:, Z:…) out of the box.
Is Cloudflare Tunnel free?
The tunnel software (cloudflared) and the basic service are free. But you need your own domain added to Cloudflare, and Cloudflare's Terms of Service (section 2.8) restrict serving large amounts of non-HTML content — video streaming and big file downloads through the free proxy can violate the ToS. RocketZero's free plan includes a free address and puts no cap on your own file transfers.
Does Cloudflare Tunnel work behind CGNAT?
Yes — cloudflared makes an outbound-only connection, so it works behind CGNAT with no public IP, just like RocketZero. Both solve the CGNAT problem; the difference is what you get on the other end (a public web URL vs a private mounted drive) and how much setup it takes.
Is Cloudflare Tunnel end-to-end encrypted?
No. Cloudflare terminates TLS at their edge, which means Cloudflare can see your decrypted traffic as it passes through their servers. That's fine for many people, but not end-to-end. RocketZero uses WireGuard end-to-end encryption — the relay only ever sees ciphertext, and when a direct peer-to-peer path is available your traffic never touches our servers at all.
Can I open DSM in a browser with RocketZero, like Cloudflare Tunnel?
Yes. Every NAS gets an address like https://home-nas.roze.to that opens DSM and its web apps (Photos, File Station, and so on) in any browser, with HTTPS already set up — no domain, no certificate, no Docker. That's the same use case Cloudflare Tunnel is built for, but with no configuration. RocketZero then adds the mounted network drive on top, which a web-only tunnel can't do.
Which is easier to set up for a Synology NAS?
RocketZero: install the package, install the app, done — no domain, no Docker, no dashboard. Cloudflare Tunnel needs a domain moved onto Cloudflare, a cloudflared container (Docker/Container Manager), a tunnel created in the Zero Trust dashboard, and ingress rules per service.
Try the drive-mount approach
RocketZero is free to get started — your NAS mounts as a drive in minutes.
Download RocketZero Read the setup guide