K3CAN

If you’re using it as a GCNAT tunnel and you don’t want to use tailscale, then your best bet will likely be either a VPS or asking your ISP for a public IP address. Some ISPs will just say no, but others might provide one for an additional fee.

You can also look into your IPV6 situation. You might actually already have a public IPv6 address you can use.

You don’t say what you’re using Cloudflare for, so suggesting an alternative is a bit tough.

Assuming that you’re using a CF tunnel to get through CGNAT, tailscale would be one alternative (no need to turn it off/on, though). The other alternative would be renting a cheap VPS and tunneling through that instead.

On the other hand, if you’re primarily using CF as a reverse proxy, you can run any number of them on your own server instead, like Nginx, Zoraxy, etc.

On the other other hand, if you’re using their WAF, that can also be run locally. Crowdsec offers a WAF component in addition to their usual protections, for example.

On the other other other hand… There are alternatives to most, if not all, of their other services, too.

Nerd blogs, a couple message boards and Reddit subs, and XKCD, of course.

There are some tools to help, but things are sort of specific to particular aspects. Lynis for general systems, ntopng for networks, and such.

For 90% of stuff, though, you can just stick to stable repos and upgrade on a schedule and you’ll be alright.

What’s a good reverse proxy for a set up using Cloudflare?

Having a reverse proxy behind your reverse proxy is a little redundant, but should work fine. My preference after trying several was nginx. The config takes a little to get used to, but it has a ton of features.

is Cloudflare’s proxy really needed?

Not at all.

Cloudflare just makes configuration a bit easier, especially if you’re behind CGNAT. I wrote a little about them here: https://blog.k3can.us/index.php?post/2025/02/Cloudflare-for-the-Selfhoster

The paid plans get you the “premium” blocklists, which includes one specially made to prevent AI scrapers, but a free account will still get you the actual software, the community blocklist, plus up to three "basic"lists.