Comment by anderspitman

I believe they use WireGuard internally but the client connections are terminated over HTTP/2 frames, with QUIC support in the works.

https://blog.cloudflare.com/getting-cloudflare-tunnels-to-co...