Home / Egress and tunnels
wormhole-vpn
github.com/ciamshrek/wormhole-vpnTool (wireguard transport)egress/wormhole-vpnJSONcomparereport an errorprovider JSON
- Free allowance
- No free tier: the README requires "Cloudflare account (Workers paid plan, $5/mo)"
- Verdict
- self-hosted, last resortverdict paid-only: no free allowance; listed for its price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- USD 5/monthparsed from the record, in USD
- Identity
- cardcard required, no phone
- Binding limit
- volume-quotano figure stated; the Workers paid plan is billed per request and duration beyond the included allowance
- Evidence
- documented3 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | no free tier: the README requires "Cloudflare account (Workers paid plan, $5/mo)" unit none; metered on none |
|---|
| Price | USD 5 per month, Workers paid plan |
|---|
| Limits | - volume-quota (binding) no figure stated; the Workers paid plan is billed per request and duration beyond the included allowance source
|
|---|
| Binding | volume-quota the Worker sits in the data path and every datagram becomes Worker work, so the plan's request and duration billing is what fails first at sustained volume; the README states no figure for it |
|---|
| Identity | card a Cloudflare account on the Workers paid plan at $5/mo, which needs a payment method |
|---|
| Egress | not applicable; the Worker plan is priced per month, not per byte, and the README states no transfer figure; ingress: tcp free allowance: none published |
|---|
| Interface | cli wrangler deploy plus a 12 MB Go bridge |
|---|
| Tooling | Go bridge plus pnpm and wrangler; a CA certificate must be installed on each device |
|---|
| Composes with | composes with a Cloudflare account and a paid Workers plan, and with cloudflare-tunnel only if the Worker is fronted by one. |
|---|
| Reliability | the Worker terminates and re-originates TLS, so every upstream connection is intercepted by design; single maintainer, no releases |
|---|
| Notes | This is the only wrapper that moves the far end off a host a user runs and onto a hosted service, and it is the reason the structural fact is worth stating precisely: replacing the far host with a Worker costs $5/mo and adds a TLS-intercepting proxy in the path, so it is a paid answer to a paid problem, not a free path. Two stars and no releases means it is a design sketch, not a deployment. |
|---|
| Parsed numbers | - has-free-tier 0
- price USD 5 / month
|
|---|
Evidence 3
More fields 9
| wg path | none |
|---|
| wg detail | device runs a stock WireGuard client against localhost:51820, a Go bridge (wireguard-go plus gvisor netstack) forwards over one WebSocket to a Cloudflare Durable Object |
|---|
| ingress | tcp |
|---|
| volume stated | not applicable; the Worker plan is priced per month, not per byte, and the README states no transfer figure |
|---|
| bytes transit | yes |
|---|
| transit note | through a Cloudflare Durable Object, which sees the plaintext of every intercepted connection |
|---|
| hosting requirement | no host of a user's own, but a Cloudflare Workers paid plan at $5/mo, and a device able to run the Go bridge |
|---|
| last release | none; last push 2026-04-06 |
|---|
| stars | 2 |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer