It only requires an outbound connection, which is needed if you’re stuck on CGNAT. It also provides DDoS protection and hides your IP address. It comes with the hide downside of using Cloudflare though.