Cloudflare Tunnel vs TheRelay for RTSP Cameras — What Actually Works?

Cloudflare Tunnel is one of the most recommended tools on the internet for exposing local services without port forwarding. It's free, it's reliable, and it works beautifully for web applications, internal dashboards, and self-hosted services running on HTTP or HTTPS. So it's natural to wonder: can you use it to access your RTSP security cameras remotely?

The short answer is no — not in any practical, reliable way. This article explains exactly why, what Cloudflare Spectrum is and where it falls short for video, and how TheRelay approaches the problem differently.

What Cloudflare Tunnel Actually Does

Cloudflare Tunnel (the cloudflared daemon) creates an outbound encrypted connection from your server to Cloudflare's network. This means your local service is exposed through a Cloudflare-provided hostname without you needing to open any firewall ports or have a public IP. It's a reverse proxy tunnel at the HTTP layer.

When a user visits your Cloudflare-proxied hostname, the request travels through Cloudflare's edge network, gets forwarded over the tunnel to your local cloudflared daemon, which then forwards it to your local service (e.g., http://localhost:8080). The response travels back the same way.

This design is brilliant for web apps. It gives you DDoS protection, TLS termination, WAF rules, and access policies (via Cloudflare Access) — all for free.

Why RTSP Fails Through Cloudflare Tunnel

RTSP (Real Time Streaming Protocol) operates on TCP port 554 and uses its own application-layer protocol — not HTTP. The protocol flow looks like this:

# RTSP session establishment (not HTTP)
Client → Server:  DESCRIBE rtsp://camera.local/stream1 RTSP/1.0
Server → Client:  200 OK
                  Content-Type: application/sdp
                  ... (SDP body describing media)

Client → Server:  SETUP rtsp://camera.local/stream1/track1 RTSP/1.0
                  Transport: RTP/AVP;unicast;client_port=8000-8001
Server → Client:  200 OK
                  Transport: RTP/AVP;unicast;client_port=8000-8001;server_port=9000-9001

Client → Server:  PLAY rtsp://camera.local/stream1 RTSP/1.0
Server → Client:  200 OK
                  RTP-Info: url=rtsp://camera.local/stream1/track1;seq=1234;rtptime=43526

After the PLAY command, the camera starts sending RTP packets on the UDP ports negotiated in the SETUP step (or interleaved on the TCP connection if using RTSP-over-TCP mode). Cloudflare Tunnel has no concept of this protocol. It cannot forward RTSP DESCRIBE/SETUP/PLAY commands, and it cannot relay the resulting RTP data stream.

Even if you try to point Cloudflare Tunnel at a local service on port 554, cloudflared will attempt to treat the connection as HTTP and fail immediately — the RTSP handshake is not valid HTTP syntax.

Cloudflare Spectrum: The TCP Proxy Option

Cloudflare does have a product called Spectrum that extends the Cloudflare network to arbitrary TCP and UDP protocols — not just HTTP. In theory, Spectrum could forward TCP port 554 from a public hostname to your local camera.

What Spectrum costs

Cloudflare Spectrum is not free. It is available on the Pro plan ($20/month) for a limited set of protocols (primarily SSH, RDP, and Minecraft), and on Business ($200/month) and Enterprise (custom pricing) plans for arbitrary TCP and UDP ports like port 554.

Why Spectrum still doesn't solve RTSP well

Even with Spectrum forwarding port 554, you face deeper problems rooted in how RTSP works:

• RTSP uses separate ports for data. The RTSP SETUP command negotiates RTP/RTCP ports dynamically — typically high-numbered UDP ports (e.g., 8000–8001 on the client, 9000–9001 on the server). Spectrum forwards a specific TCP port (554), not the dynamically negotiated UDP ports. The data channel never arrives.
• You can work around this with RTSP-over-TCP (interleaved mode), which multiplexes RTP data over the same TCP connection as the control channel. This helps with the UDP port problem, but now you're streaming continuous video data through Cloudflare's HTTP-optimized global network — a network designed to cache and route HTTP responses, not sustain long-lived TCP streaming connections with low jitter.
• Cloudflare's network adds latency. Traffic is routed through Cloudflare's anycast edge, which introduces variable latency depending on the geographic distance between the viewer, the nearest Cloudflare PoP, and your tunnel endpoint. For a webpage this is imperceptible. For real-time video, jitter causes buffering and dropped frames.
• No protocol conversion. Even if Spectrum successfully forwards RTSP to the camera, the client still needs to speak RTSP. That means VLC or a dedicated RTSP player — not a browser, not a mobile app, not an iframe on a webpage.

RTSP Is a Stateful Protocol — HTTP Proxies Struggle With It

HTTP is a stateless request-response protocol. Cloudflare's entire infrastructure is built around this model: edge receives a request, forwards it to origin, returns the response. Even WebSocket connections (which are persistent) are treated as long-lived HTTP upgrades.

RTSP is fundamentally different. It is a stateful session protocol with a defined state machine:

1. INIT — connection established, no session
2. READY — DESCRIBE and SETUP completed, session created, stream paused
3. PLAYING — PLAY issued, RTP data flowing

The server maintains session state keyed by a session ID that appears in every request header. If the TCP connection drops and reconnects — as it might through an HTTP proxy that recycles connections — the session state is lost and the client must re-negotiate from scratch. Cloudflare's infrastructure is designed to be transparent to the application layer for HTTP but makes no guarantees about connection persistence for raw TCP.

Additionally, RTSP cameras typically enforce a session timeout — if no RTSP keep-alive (GET_PARAMETER) is received within a certain interval, the camera tears down the session. Any proxy layer that adds latency to these keep-alive messages can trigger unexpected session drops.

What TheRelay Does Differently

TheRelay was built specifically for the camera streaming use case that Cloudflare Tunnel was never designed for. The architecture is fundamentally different:

Outbound agent, not inbound proxy

Like Cloudflare Tunnel, TheRelay uses an outbound agent on your LAN — no port forwarding or public IP needed. But instead of being an HTTP reverse proxy, the agent is a video-aware streaming relay. It speaks RTSP natively to your cameras, handles session negotiation, and maintains persistent RTSP sessions with proper keep-alive management.

SRT transport to the cloud

The agent transports video to TheRelay's cloud infrastructure using SRT (Secure Reliable Transport) — a protocol designed for live video over unreliable networks. SRT handles packet loss recovery, jitter compensation, and connection re-establishment automatically. This is categorically different from tunneling video over HTTP.

Multi-protocol cloud endpoints

Once video arrives at TheRelay's cloud, it is re-published in the formats that different clients need:

• WebRTC — sub-second latency in any browser, no plugin needed
• HLS — maximum compatibility for website embeds
• RTSP — for VLC, NVR software, or other RTSP clients connecting remotely
• RTMP — for streaming platforms or encoders that accept RTMP input
• SRT — for professional video production tools

A single camera registered in TheRelay gets all five endpoint types simultaneously. No additional configuration per protocol is needed.

Side-by-Side Comparison

Frequently Asked Questions

Can Cloudflare Tunnel handle RTSP streams?

No, not by default. Cloudflare Tunnel (cloudflared) only proxies HTTP and HTTPS traffic. RTSP runs on TCP port 554 and uses its own application-layer protocol that has nothing in common with HTTP. Trying to tunnel RTSP through cloudflared will fail at the protocol handshake stage.

Does Cloudflare proxy TCP traffic?

Cloudflare's standard reverse proxy and Cloudflare Tunnel proxy HTTP/HTTPS only. To proxy arbitrary TCP traffic, you need Cloudflare Spectrum, which is a paid add-on starting at the Pro plan level ($20/month) for limited protocols and Business/Enterprise for custom TCP ports. Spectrum forwards TCP bytes without understanding the application protocol — it provides no RTSP session management, no protocol conversion, and no browser-compatible endpoints.

What is Cloudflare Spectrum?

Cloudflare Spectrum extends Cloudflare's DDoS protection and network proxying to non-HTTP TCP and UDP applications. Common uses include protecting SSH servers, game servers, and custom TCP applications. It is available on paid Cloudflare plans — Pro ($20/month) for select protocols, Business ($200/month) for full TCP/UDP access. Using Spectrum to expose RTSP port 554 is technically possible but does not provide browser playback, does not convert protocols, and routes video through an infrastructure not optimized for low-latency streaming.

Can I use Cloudflare for IP camera streaming?

Cloudflare works well for serving camera snapshots (JPEG images fetched via HTTP from a camera's snapshot URL) or for serving HLS segments if you run your own conversion server behind Cloudflare. For live RTSP streaming, WebRTC, or SRT transport, Cloudflare is not the right tool. Purpose-built video relay services like TheRelay handle the protocol requirements that Cloudflare was not designed for.

What is the cheapest way to access RTSP cameras remotely?

A cloud relay agent like TheRelay at $2/stream/month is typically the most cost-effective option that actually works end-to-end. A self-hosted VPS with a VPN or reverse SSH tunnel costs $5–20/month in VPS fees plus time spent on maintenance. Cloudflare Spectrum starts at $20/month and still does not give you browser-accessible WebRTC or HLS endpoints.