Cloudflare Gateway vs Pomerium
Cloudflare Gateway
cloudflare.com
Pomerium
pomerium.comSide by side
| Figure | Cloudflare Gateway | Pomerium |
|---|---|---|
| Price from | $7/mo | $7/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 6 | 9 |
| Spec score · Zero Trust Network Access Software | 9.3 (#1) | 8.8 (#7) |
| Documentation depth | Cloudflare One documentation covers implementation guides, reference architecture, account limits, troubleshooting, API and Terraform, changelogs and client deployment. | Documentation includes fundamentals courses, deployment guides, configuration reference, API reference, integrations and troubleshooting material. |
| Integrations | Cloudflare One documentation lists identity-provider integrations including Google, Google Workspace, GitHub, Microsoft Entra ID, Okta, OneLogin, PingOne, Keycloak and custom SAML or OIDC providers. | Listed integrations include Grafana, Kubernetes, Okta, Cloud Run, Docker, Google Kubernetes Engine, FleetDM, BambooHR, Auth0, Azure Active Directory, GitHub, GitLab, Google Workspace, OneLogin, OpenID Connect, and Ping Identity. |
| Public API | Zero Trust configuration, including Gateway rules, can be managed through Cloudflare's REST API with scoped API tokens. | The Pomerium API manages configuration resources including keys, policies, routes, service accounts and settings. |
| Rating on G2 | 4.5 out of 5 from 928 reviews for Cloudflare, Inc.'s product portfolio; Cloudflare One (SASE) has 104 reviews. | 4.8 out of 5 from 12 reviews. |
| Self-hosting | Gateway is documented as a Cloudflare-hosted service accessed through the dashboard, One Client, proxies, API and Terraform; the reviewed documentation provides no self-hosted Gateway deployment. | Pomerium Core is the self-managed server and data plane, installable from binaries, OS packages, Docker images or source. |
| What it does | Cloudflare Gateway is a cloud-native secure web gateway that filters DNS, HTTP and network traffic for office and remote users. | Pomerium is an identity-aware reverse proxy that provides application and service access without a traditional VPN or client software. |
Plans
Cloudflare Gateway
- FreeFree
- Pay-as-you-go$7 a month
- ContractPriced on request
- Free PlanFree
- Pay-as-you-go$7 a month
- Contract PlanPrice not published
Pomerium
- Personal FreeFree
- Business$7 a month
- Zero PersonalFree
- Zero PersonalFree
- Zero Business$7 a month
- Zero Business (annual)$7 a month
- Zero Business (monthly)$9 a month
- EnterprisePriced on request
- EnterprisePriced on request
In their own words
Cloudflare Gateway
Cloudflare Gateway has no write-up on Specifiction yet; its figures are above.
Pomerium
Pomerium is an open-source identity-aware proxy for controlling access to internal applications, servers, services, and workloads without requiring VPN client software. It checks identity, device state, and request context before granting access, and authenticates through identity providers that support OpenID Connect. Listed access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported app protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. Pomerium removes its authentication cookies before forwarding requests upstream, and sensitive databroker data is encrypted at rest. Downstream TLS has a minimum of TLS 1.2. Deployment options include Linux and macOS binaries, packages, Docker images, source builds, and desktop clients for Windows, macOS, and Linux. The free Personal plan lists 10 users, 10 routes, five policies, and two service accounts. Business costs $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is also listed.