SSHepherd® vs Cloudflare Zero Trust

Cloudflare Tunnel shuts the firewall.SSHepherd shuts the port.

Cloudflare Zero Trust, with Cloudflare Tunnel, lets you reach private servers without a public IP or inbound firewall rules. SSHepherd goes one step further on the server: the service itself can be switched off. Here is the comparison, line by line.

Book a demoSee the comparison
Animation: a live RDP session to win01. An administrator revokes it in Cloudflare: new logins are blocked and the connected RDP session continues, since Cloudflare does not control an active RDP session; it is not recorded. With SSHepherd the administrator terminates the session, which ends at once, and the recording is saved.
Where they agree

They agree on morethan most comparisons admit.

Cloudflare Zero Trust is a zero trust platform whose Cloudflare Tunnel connects private resources to Cloudflare's network. Before the differences, the common ground.

Both connect outbound

cloudflared creates outbound-only connections to Cloudflare, so you can block all inbound traffic. The SSHepherd agent also dials out.

No public IP needed

Cloudflare Tunnel connects resources without a publicly routable IP address. SSHepherd servers answer no scan at all.

Both check identity first

Cloudflare Access applies policies before a connection is allowed. SSHepherd admits authorised identities from your identity provider.

Where they differ

Side by side,line by line.

Taken from each vendor's own documentation, checked . Numbers link to the source. The edge on each row says which product its documentation favours, and it goes to Cloudflare where Cloudflare is stronger.

CapabilitySSHepherd®Cloudflare
Listening on the protected serverEdge: SSHepherdNothing listeningNone. sshd, RDP and TCP/IP application services can be switched off, so nothing on the server waits for an inbound connection. 1Still listeningThe service keeps listening: Cloudflare's setup points the tunnel at localhost:22 for SSH or the server's RDP port, typically 3389. 23
A scan from inside your networkEdge: SSHepherdNothing to findNo open, listening ports, even while an SSHepherd session is active. 14Reachable insideCloudflare removes the exposure to the internet. On the host or LAN the service still listens, so it is reachable there unless you firewall it separately. 52
What accepts connectionsEvenYour own C3 serverYour SSHepherd C3 server, which you host on Kubernetes (on-premise or cloud). The agent and the user's Control App both connect out to it over TLS. 16Cloudflare's networkCloudflare's global network. cloudflared connects out to it; no inbound rules are needed on your side. 7
Session recordingEdge: SSHepherdSSH and RDPSSH and RDP sessions are recorded, with live view and replay. 8SSH onlySSH: yes, with Access for Infrastructure, whose SSH command logs include a terminal recording encrypted with your key. RDP: not recorded; Cloudflare described RDP session monitoring as future work in March 2025. 910
Ending a live sessionEdge: SSHepherdImmediateYes. An administrator watching a live session can terminate it immediately. 8Not for active sessionsAdministrators can revoke sessions, which stops new logins. Cloudflare's docs state it "does not control the length of an active SSH, VNC, or RDP session". 11
What it coversEdge: CloudflareSSH, RDP, TCP appsSSH, RDP and TCP/IP applications, on Windows and Linux hosts. 6Web, SSH, RDP and moreHTTP web servers, SSH servers, remote desktops and other protocols over Cloudflare Tunnel, plus in-browser SSH, VNC and RDP. 7
  • Clear strength
  • With conditions
  • Not documented, or still exposed
  • No winner
The difference that matters

Off the internet is good.Off entirely is better.

Cloudflare keeps the server off the public internet. SSHepherd also takes the service off the network the server sits on, which is where an attacker who has already got in starts looking.

Cloudflare
UserCloudflare edgecloudflaredsshd on :22, listening
cloudflared proxies to the SSH or RDP service, which keeps listening on the host or LAN.
SSHepherd®
AdminYour C3 serverAgent dials outServer, sshd off
Both ends connect out to the C3. A scan of the server, from outside or inside, finds nothing listening.
How a session reaches a protected server with Cloudflare and with SSHepherd, from each vendor's documentation.
Which fits

Different jobs.Sometimes both.

Choose Cloudflare if

  • You already use Cloudflare for your websites and want private access on the same network and dashboard.
  • You mostly need web applications and SSH reached through a global edge, and in-browser access suits your users.

Choose SSHepherd® if

  • RDP is a large part of your estate and you need those sessions recorded.
  • You need to end a running SSH or RDP session the moment something looks wrong.
  • You want the SSH and RDP services switched off on the server, not only hidden from the internet, and the control plane hosted on your own infrastructure.

They can coexist: Cloudflare for your public sites and web apps, SSHepherd for administrative access to the servers.

Questions

Common questions.

Does Cloudflare Tunnel close ports?

It closes the inbound firewall: cloudflared makes outbound-only connections, so you can block all inbound traffic. The SSH or RDP service on the server keeps listening locally, and the tunnel connects to it there.

Does Cloudflare record SSH sessions?

Yes. Access for Infrastructure produces SSH command logs that include a terminal recording, encrypted with your own key. Cloudflare does not record RDP sessions.

Can Cloudflare end an active SSH or RDP session?

Revoking a session stops new logins, but Cloudflare's documentation says it does not control the length of an active SSH, VNC or RDP session. SSHepherd administrators can terminate a live session immediately.

Where does SSHepherd run?

You host the SSHepherd C3 server on Kubernetes, on-premise or in the cloud. Agents on your Windows and Linux servers and the user's Control App both connect out to it.

Sources

  1. Full Armor: SSHepherd FAQ
  2. Cloudflare Docs: SSH with cloudflared authentication
  3. Cloudflare Docs: Browser-rendered RDP
  4. Full Armor: Make your network traffic invisible to hackers
  5. Cloudflare Docs: Configure a tunnel with a firewall
  6. Full Armor: System requirements
  7. Cloudflare Docs: Cloudflare Tunnel
  8. Full Armor: Monitoring sessions
  9. Cloudflare Docs: SSH command logs
  10. Cloudflare Blog: Browser-based RDP (March 2025)
  11. Cloudflare Docs: Session management
  12. US Patent 11,153,340 B1: Elimination of listen ports on a publicly accessible computer

Checked against each vendor's public documentation on 6 October 2026. Products change: if anything here is out of date, email [email protected] and we will correct it. This page compares documented capabilities, not price or performance. Cloudflare and Cloudflare Zero Trust are trademarks of their owner; Auris is not affiliated with Cloudflare. SSHepherd® is developed by Full Armor Corporation and distributed in Southeast Asia by Auris.

More comparisons: SSHepherd vs Zscaler ZPA · SSHepherd vs Teleport · SSHepherd vs Twingate

Book a demo

See it onyour own servers.

Already running Cloudflare? Tell us what you protect with it and which servers your administrators reach. We will show where SSHepherd fits alongside it, and reply within one business day.

We use these details only to reply to your request, usually within one business day.