I believe OP would require an authoritative DNS server, which AFAIK Quad9 is not. desec.io would be my recommendation though.

Yeah, that's a future step. I just haven't finished migrating everything.

It bundles WireGuard transport layer and a SNI reverse proxy natively, along with optional authentication. Good enough for beginners or people who need quick deployments.

What does these “tunnels” actually add?

Ease of deployment / time savings generally. You can certainly do it yourself with wireguard and a reverse proxy.

That's exactly the use case for "tunnels": allowing public, incoming connections behind CGNAT.

Wireguard requires a public IP on at least one side of the connection and only allows private access. If you want to host a blog or website AND you're behind CGNAT, then a "tunnel" service is a very easy solution.

Edit: my previous blog post on the topic: https://blog.k3can.us/posts/2025/feb/2025-02-21_cloudflarefort/

yep, i used to use this behind a cgnat. being a broke kid i couldn't have another machine with exposed ports proxy things

Its a secure way to route the traffic from a public endpoint to your internal services without exposing your home IP address. You could do something similar with wireguard. I didn't indicate you couldn't.

I checked and this does a similar thing. You can use WG to punch out a connection, and I have before. The linked program uses quic in a similar way to WG but doesn't do any of the routing, just registers the connection to a hostname for application level forwarding.

It looks more that it provides an easy setup for an alternative.

Both methods can work on cg-nat as well since you are punching out.

One would be CG-NAT as you mentioned, and some people want to host for other people too, potentially including too many people/too distant/too tech illiterate to easily set up WG.

The benefit here is the software by design can't read your traffic - it's using SNI to route, not the host header, so SSL pass thru keeps the payload private. It's billed as shareable for that reason.

Also this is open source and you can host it yourself.

Edit: I concede BakedCatboy's point.

In either case I would probably just use FRP.

Self hosted alternative is buying a static IP from your ISP I suppose. Mine is an extra $5/mo which is eh, but I'm not paying for a VPS.