Workflow Zero-Trust: Cloudflare Access vs Tailscale

TL;DR

• Cloudflare Access: identity-aware proxy untuk web app, SSO + MFA + audit log. USD 3-7/user/bulan.
• Tailscale: mesh VPN WireGuard untuk SSH/database/K8s API non-HTTP. USD 6-18/user/bulan.
• Pattern enterprise: Cloudflare Access untuk web admin, Tailscale untuk engineer access. Complementary.
• Saving vs VPN legacy: Rp 60-80 juta/bulan di skala 30+ user enterprise.
• Verdict: Recommended untuk enterprise Indonesia modern.

Konteks

Saya operate kedua platform paralel 24 bulan (Juni 2024 - Mei 2026) di:

• Fintech series-B Jakarta: Cloudflare Access untuk 24 web admin / dashboard, Tailscale untuk 35 engineer + SRE
• BUMN energy Jakarta: migrate dari Cisco AnyConnect VPN ke Cloudflare Access + Tailscale (10 minggu rollout di Q3-Q4 2024), 28 user

Sebelum 2024: 6 tahun pengalaman VPN traditional (OpenVPN, Cisco AnyConnect, WireGuard self-host). Pengalaman zero-trust 24 bulan.

Pricing (Juni 2026)

Cloudflare Access

• Free: 50 user (semua fitur core ZTNA, browser isolation, SSH/RDP via SaaS app)
• Standard: USD 3/user/bulan
• Premier: USD 7/user/bulan + advanced (DLP, Cloudflare Tunnel premium, Gateway DNS filtering)
• Saya pakai Standard untuk fintech: 30 user × USD 3 = USD 90/bulan = Rp 1,44 juta/bulan
• BUMN: Premier tier untuk 28 user × USD 7 = USD 196/bulan = Rp 3,1 juta/bulan

Tailscale

• Free: 3 user, 100 device
• Starter: USD 6/user/bulan, 100 device, 2 admin
• Premium: USD 18/user/bulan, 200 device, role-based access control, audit log retention 90 hari
• Saya pakai Premium untuk fintech: 35 engineer × USD 18 = USD 630/bulan = Rp 10,1 juta/bulan
• BUMN: Premium 28 user × USD 18 = USD 504/bulan = Rp 8 juta/bulan

Twingate (sebagai pembanding)

• Starter: USD 5/user/bulan, basic ZTNA
• Business: USD 10/user/bulan, advanced
• Untuk 30 user: USD 300/bulan = Rp 4,8 juta/bulan

Total zero-trust cost

Komponen	Fintech	BUMN
Cloudflare Access	Rp 1,44 juta	Rp 3,1 juta
Tailscale Premium	Rp 10,1 juta	Rp 8 juta
Total	Rp 11,5 juta/bulan	Rp 11,1 juta/bulan

Bandingkan VPN legacy

VPN legacy yang di-replace di BUMN:

• Cisco AnyConnect license: USD 35/user/tahun × 28 user = USD 980/tahun = Rp 1,3 juta/bulan
• Cisco ASA firewall hardware HA: amortized Rp 8 juta/bulan
• Bastion host (Linux jump server HA, 2 VM + observability): Rp 4 juta/bulan
• VPN concentrator compute + network: Rp 6 juta/bulan
• Ops time SRE (60-80 jam/bulan): Rp 20 juta/bulan
• Insiden / troubleshooting (rata-rata 2x P2/bulan): Rp 8 juta/bulan
• Total VPN legacy: Rp 47,3 juta/bulan

Zero-trust saving: Rp 36 juta/bulan = Rp 432 juta/tahun. ROI break-even bulan ke-2 dari migration.

SLO + performance (24 bulan)

Cloudflare Access

Metrik	Target	Realisasi
Authentication latency p99	< 500ms	280ms
Availability	99,95%	99,97% (vendor SLA)
MFA enforcement	100%	100% (via SSO upstream)
Audit log completeness	100%	100% (Logpush ke Splunk)
Per-request authorization	< 50ms	28ms

Tailscale

Metrik	Target	Realisasi
Connection establishment p99	< 2 detik	1,4 detik
Mesh availability	99,9%	99,94%
Magic DNS resolution p99	< 100ms	65ms
Throughput peer-to-peer	> 100 Mbps	200-450 Mbps typical
Audit log retention	90 hari	90 hari (Premium tier)

Insiden 24 bulan: 2 P2 (Cloudflare Access regional outage Asia 22 menit, Tailscale coordination server intermittent 8 menit). Total impact bisnis: minimal (engineer punya fallback via Cloudflare Tunnel direct).

Architecture pattern

Cloudflare Access untuk web app

User browser → app.bumn.com (Cloudflare proxied)
                 │
                 └─→ Cloudflare Access policy check
                       │
                       ├─→ SSO redirect ke Okta/Google/Azure AD
                       │   └─→ MFA challenge
                       │       └─→ Token issued
                       │
                       └─→ Forward ke origin app (di GKE Jakarta)
                              + inject header: Cf-Access-Authenticated-User-Email

Policy example:

• app.bumn.com accessible by group bumn-customer-portal-team (Okta group)
• grafana.bumn.com accessible by group bumn-engineering-team + MFA mandatory
• argocd.bumn.com accessible by group bumn-sre-team + MFA + IP allowlist (Indonesia only)

Per-request audit log → Splunk via Logpush. Format CEF compliant.

Tailscale untuk SSH + database + K8s

Engineer laptop ─→ Tailscale agent ←→ Tailscale coordination server
                          │              (control plane only, not data)
                          │
                          └── WireGuard tunnel (data plane peer-to-peer)
                                │
                                └─→ Subnet router pod di GKE
                                       │
                                       ├─→ kubectl exec ke pod
                                       ├─→ SSH ke node K8s
                                       └─→ psql ke Postgres internal

Subnet router: 1 pod di setiap K8s cluster yang advertise CIDR private cluster. Engineer akses pod IP / service IP private dari laptop seakan-akan local network.

ACL untuk Tailscale Premium:

{
  "groups": {
    "group:engineering": ["[email protected]", "[email protected]"],
    "group:sre": ["[email protected]"],
  },
  "acls": [
    {
      "action": "accept",
      "src": ["group:engineering"],
      "dst": ["tag:k8s-staging:22,6443,5432"],
    },
    {
      "action": "accept",
      "src": ["group:sre"],
      "dst": ["tag:k8s-prod:22,6443,5432"],
    },
  ],
}

Granular per-port per-group access. Audit log per-connection di Tailscale dashboard + export ke Splunk.

Capability comparison

Capability	Cloudflare Access	Tailscale	VPN legacy
Protocol coverage	HTTP/HTTPS	semua (SSH, DB, K8s, IoT)	semua
Identity-aware (SSO)	ya (first-class)	ya	terbatas
MFA enforcement	ya (via SSO upstream)	ya	ya
Per-request authorization	ya	tidak	tidak
Audit log granularity	per-request	per-connection	per-session
Network model	proxy / tunnel	mesh peer-to-peer	hub-and-spoke
Performance	low latency edge	direct peer-to-peer	hub bottleneck
Setup complexity	rendah	rendah	tinggi
Operational complexity	rendah	rendah	tinggi
Mobile support	ya	ya	ya (klien Cisco/OpenVPN)
Compliance audit	export ke SIEM	export ke SIEM (Premium)	manual
Zero-trust per-resource	ya	ya (via ACL)	tidak (network-level)
Cost per user/bulan	USD 3-7	USD 6-18	USD 25-50+ (with ops)

Trade-off arsitektural

Pilih Cloudflare Access kalau:

• Web app gating (admin panel, dashboard, internal tool)
• SSO + MFA + audit log enterprise grade
• Identity-aware authorization
• Cost-sensitive (USD 3/user untuk 30+ user)
• Edge latency penting (Cloudflare PoP Indonesia)

Pilih Tailscale kalau:

• Non-HTTP protocol (SSH, database, K8s API, custom TCP)
• Engineer / SRE access ke production resource
• Mesh networking (peer-to-peer direct, tidak via hub)
• Setup simple (no firewall config kompleks)
• Cross-region (engineer di Bandung akses pod di Jakarta cluster smooth)

Pilih VPN traditional kalau:

• Compliance audit mandate VPN sektoral (rare, decreasing)
• Tim engineer kecil < 5 user (overhead zero-trust tidak justify)
• Legacy infrastructure tidak siap migrate

Pattern hybrid (yang saya jalankan)

Cloudflare Access untuk semua web admin + Tailscale untuk engineering tooling. Tidak ada VPN legacy.

HA + DR

Cloudflare Access

• Vendor SLA 99,95% (Standard), 99,99% (Premier)
• Global anycast edge (Indonesia PoP Jakarta + Singapore fallback)
• RPO/RTO: 0 / 0 (vendor managed)
• Failover transparent ke engineer

Tailscale

• Coordination server SaaS (vendor managed, 99,99%)
• Data plane peer-to-peer (independent dari coordination)
• Kalau coordination down: existing connection continue, new connection blocked
• RPO: 0 (no persistent state di data plane)
• RTO: depends on coordination uptime

VPN legacy fallback

Saya keep 1 emergency VPN account untuk break-glass scenario (kalau Cloudflare + Tailscale both down). Documented runbook, audit per-use.

Migration path dari VPN

10-16 minggu, realisasi BUMN saya 14 minggu untuk 28 user:

Minggu 1-2: Setup paralel

• Setup Cloudflare Access tenant + integrate dengan Okta SSO
• Setup Tailscale tenant + integrate dengan Okta SSO
• Deploy Tailscale subnet router di each K8s cluster
• Test dengan 3 pilot user (1 SRE, 1 senior engineer, 1 internal admin)

Minggu 3-6: Pilot rollout

• Migrate 5-8 power user (semua SRE + senior engineer)
• Paralel run VPN + zero-trust 4 minggu
• Gather feedback, fix friction point

Pain point yang muncul:

• SSH ~/.ssh/config butuh refactor (jump host → Tailscale direct)
• kubectl config butuh update (cluster API server hostname → Tailscale subnet routing)
• Database client (psql, MySQL Workbench) butuh re-config connection string

Minggu 7-12: Team rollout

• Rollout team-by-team, 2-3 user per minggu
• Per user: 1 jam setup session + 30 menit verification + 1 minggu paralel run

Minggu 13-14: Decommission VPN

• Audit usage VPN (last 30 hari)
• User yang masih pakai VPN: investigate why, migrate atau approve exception
• Disable VPN access per-user setelah 14 hari unused
• Decommission VPN hardware setelah 30 hari unused

Minggu 15-16: Hardening + handover

• Documentation runbook
• Audit log validation
• Training tim SRE untuk maintenance zero-trust

Compliance + audit

OJK Cyber Resilience Guideline

Audit trail wajib: siapa-akses-apa-kapan-dari-mana. Zero-trust platform export audit log ke Splunk:

• Cloudflare Access: every request logged dengan user identity + IP + URL + decision (allow/deny)
• Tailscale Premium: every connection logged dengan src/dst + timestamp + duration

Retention 7 tahun via Splunk + archive ke S3 Glacier Indonesia. Cost retention: Rp 1,2 juta/bulan ongoing + Rp 18 juta amortized 7 tahun.

KAP audit Q1 2026: 0 finding terkait akses production. Auditor express satisfaction dengan granularitas zero-trust audit dibanding VPN legacy session-level log.

UU PDP 2022

Akses ke data nasabah: harus tercatat per-request. Cloudflare Access + Splunk dashboard untuk akses ke service yang touch PII = compliant.

Cost of ownership 36 bulan

Skenario: enterprise 30 user, 18 service, 4 cluster K8s.

Item	Zero-trust (Cloudflare + Tailscale)	VPN legacy
Software/SaaS 3 tahun	Rp 414 juta	Rp 47 juta
Hardware (firewall, bastion, concentrator)	Rp 0	Rp 288 juta
Ops engineer	Rp 162 juta (4-6 jam/bulan)	Rp 720 juta (20 jam/bulan)
Migration/setup	Rp 80 juta one-time	Rp 120 juta one-time initial
Insiden (rata-rata)	Rp 24 juta	Rp 280 juta (more frequent)
Total 3 tahun	Rp 680 juta	Rp 1,455 miliar

Zero-trust saves Rp 775 juta dalam 3 tahun = Rp 22 juta/bulan rata-rata. ROI clear.

Common pitfall

1. SSO upstream tidak diatur MFA. Cloudflare Access dan Tailscale dapat MFA dari SSO upstream (Okta/Google). Kalau Okta tidak enforce MFA, zero-trust juga tidak. Audit SSO settings.
2. ACL Tailscale terlalu permissive. Default * access = anyone akses anything. Mandate principle of least privilege, ACL per-group per-resource.
3. No emergency break-glass. Kalau zero-trust platform down, engineer harus bisa access production untuk insiden. Setup 1-2 break-glass account dengan VPN minimal, documented + audit ketat.
4. Tailscale subnet router single replica. SPOF. Deploy 2-3 replica per cluster minimum.
5. Audit log tidak exported ke SIEM. Default audit log ada di Cloudflare/Tailscale dashboard saja. Untuk compliance, wajib export ke Splunk/Datadog dengan retention sesuai regulasi.

Indonesia specific

Latency

Cloudflare Access via PoP Jakarta: latency Indonesia ke service di GKE Jakarta = 5-15ms tambahan (negligible).

Tailscale: peer-to-peer direct. Engineer di Jakarta ke pod di GKE Jakarta = 8-20ms tambahan (WireGuard overhead). Cross-region (engineer di Bali ke pod Jakarta) = depends backbone, biasanya 50-80ms.

Compliance

Cloudflare Access data: traverse Cloudflare network. Audit log retention controllable via Logpush ke R2 Indonesia. Acceptable untuk OJK.

Tailscale coordination server: USA-based vendor managed. Audit log via Premium tier export-able. Untuk BUMN dengan strict data residency: bisa self-host Headscale (open source Tailscale alternative) tapi kehilangan vendor support.

Hiring

Engineer berpengalaman Cloudflare Access / Tailscale di Jakarta: pool kecil-medium. Adoption tinggi 2024+, training mudah (1-2 hari workshop cukup untuk basic ops). Tidak butuh hiring spesialis — train SRE existing.

Yang surprising

Setelah 24 bulan: Tailscale magic DNS + subnet routing ternyata jadi feature yang paling appreciated engineer. Sebelum: SSH jump.bumn.com lalu ssh worker-12.internal. Setelah: SSH worker-12 langsung dari laptop (Tailscale DNS resolve). Friction reduce signifikan, engineer satisfaction naik dari 6,2 ke 8,8 (survey internal).

Surprise lain: Cloudflare Access browser isolation feature jarang dipakai tapi worth-nya jelas untuk security incident. 1 kasus 2025: laptop engineer kena malware, Cloudflare Access policy IP allowlist + browser isolation prevent data exfiltration. Tanpa zero-trust, malware bisa akses internal app via VPN tunnel.

Verdict

Recommended untuk enterprise Indonesia modern.

• Default enterprise SMB-mid Indonesia: Cloudflare Access (web app) + Tailscale (engineer access). Total cost Rp 8-15 juta/bulan untuk 25-40 user. ROI vs VPN legacy clear.
• Cloudflare Access only kalau workload semua web-based (no SSH/DB direct access).
• Tailscale only kalau no public-facing web app (internal tool only).
• VPN legacy: phase out plan 12-18 bulan. Tidak masuk akal untuk enterprise modern 2026.
• Skip kalau tim engineer < 3 user — overhead setup zero-trust tidak justify, simple SSH key + firewall sudah cukup.

Threshold konkret untuk adopt zero-trust: 10+ user dengan production access + 5+ service production + compliance audit requirement. Di atas threshold ini, zero-trust ROI break-even < 6 bulan.