awesome-tunneling

Tunneling alternatives

A curated list of tunneling solutions focused on self-hosting and decentralization

List of ngrok/Cloudflare Tunnel alternatives and other tunneling software and services. Focus on self-hosting.

GitHub

16k stars
203 watching
779 forks
last commit: almost 2 years ago
Linked from 1 awesome list

ngrokngrok-alternativeself-hostedsshtunnel-proxytunneling

Recommendations

Cloudflare TunnelFor most people, I currently recommend . Although it's closed source, this is the production-quality service that gets the closest to achieving the dream. It's also a loss-leader for Cloudflare's other products which means they can offer it for free
frp87,642almost 2 years agoIf you want to self-host, there are many options. For something production ready is probably what you want. If you're a developer, I'd recommend starting with my own project and modifying it for your needs. For non-developers and those wanting more of a GUI experience, I created . It's my take on a comprehensive tunnel proxy solution. It's in beta but currently solves almost everything I want. Once the server is running this is a very easy tool to use and has some nice features

Open source (at least with a reasonably permissive license)

TelebitWritten in JS.
tunnel.pyjam.asNo custom client; uses WireGuard directly instead. Written in Python
SSH-J.comPublic SSH Jump & Port Forwarding server. No software, no registration, just an anonymous SSH server for forwarding. Users are encouraged to use it for SSH exposure only, to preserve end-to-end encryption. No public ports, only in-SSH connectivity. Run and it will display usage information
frp87,642almost 2 years agoComprehensive open alternative to ngrok. Supports UDP, and has a P2P mode. Supports multiplexing over TCP (single connection or pool), QUIC, and KCP
ngrok 1.024,201over 2 years agoOriginal version of ngrok. No longer developed in favor of the commercial 2.0 version
localtunnel/localtunnelWritten in node. Popular suggestion
chisel13,747about 2 years agoSSH under the hood, but still uses a custom client binary. Supports auto certs from LetsEncrypt. Written in Go
sshuttle11,853almost 2 years agoOpen source project originally from one of the founders of Tailscale. Server doesn't require root; client does. Explicitly designed to avoid TCP-over-TCP issues
rathole9,911about 2 years agoSimilar to frp, including the config format, but with improved performance. Low resource consumption. Hot reload. Written in Rust
bore8,703almost 2 years agoMinimal tunneling solution. MIT Licensed. Written in Rust
expose4,260about 2 years agongrok alternative written in PHP
sish4,048almost 2 years agoOpen source ngrok/serveo alternative. SSH-based but uses a custom server written in Go. Supports WebSocket tunneling
wstunnel4,397almost 2 years agoProxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Rust with executables provided
gostLooks like a comprehensive option. TCP and UDP tunneling. TAP/TUN devices. Load balancing. Web API. Written in Go
progrium/localtunnel3,199over 4 years agoAs far as I know this is the first ever tool of this kind, predating ngrok and the other localtunnel. No longer maintained, but here for posterity. MIT License. Written in Go
go-http-tunnel3,249over 2 years agoUses a single HTTP/2 connection for muxing. Need to manually generate certs for server and clients
pgrok/pgrok3,221almost 2 years agoA multi-tenant HTTP reverse tunnel solution through SSH remote port forwarding
zrokAims for effortless sharing both publicly and privately. Supports multiple types of resources, including HTTP endpoints and files. Built on OpenZiti (see overlay section below). Apache 2 License. Written in Go
portrHas a JavaScript/Python admin page and request inspection/replay features. AGPL-3.0 License. Tunneling implemented in Go
tunneltoOpen source (MIT). Written in Rust
piko1,921almost 2 years agoPiko is an open-source alternative to Ngrok, designed to serve production traffic and be simple to host (particularly on Kubernetes). MIT License. Written in Go
gsocket/Global SocketThe Global Socket Toolkit allows two users behind NAT/Firewall to establish a TCP connection with each other. Securely. Written in C
SirTunnel1,367over 2 years agoMinimal, self-hosted, 0-config alternative to ngrok. Similar to sish but leverages Caddy+OpenSSH rather than custom server code
boringproxyDesigned to be very easy to use. No config files. Clients can be remote-controlled through a simple WebUI and/or REST API on the server
Tunnelmole1,291almost 2 years agoOpen source and optionally self hostable. The client and server are both written in TypeScript
jprq1,070almost 2 years agoProxies over WebSockets. Written in Go
Wiretap872almost 2 years agoTransparent tunneling over WireGuard (UDP) using userspace network stack. Root not required on server. Supports multiple clients and servers. Written in Go
PageKiteComprehensive open source solution with hosted options
onionpipe527almost 2 years agoOnion addresses for anything. forwards ports on the local host to remote Onion addresses as Tor hidden services and vice-versa. Written in Go
Crowbar475over 5 years agoTunnels TCP connections over HTTP GET and POST requests
tunneller478about 2 years agoOpen source. Written in Go
tunnel326almost 3 years agoThis one is a Golang library, not a program you can just run. However, it looks easy to use for creating custom solutions. Uses a single TCP socket, and for multiplexing
jerson/pgrokFork of ngrok 1.0, with more recent commits. Archived
remotemoe278over 2 years agoSSH-based, with custom golang server. Does some cool unique things. Instead of just plain tunnels, it drops you into a basic CLI UI that offers several useful commands interactively, such as adding a custom hostname. Also allows end-to-end encryption for both HTTPS and upstream SSH. Doesn't appear to offer non-e2e HTTPS, ie no auto Let's Encrypt support
docker-tunnel261over 4 years agoSimple Docker-based nginx+SSH solution
hypertunnel241almost 4 years agoPublic server appears to be down. MIT Licensed. Written in JavaScript
tunwg226about 2 years agoWireguard in userspace based. Offers end to end encrypted TLS with LetsEncrypt certificates generated automatically by clients, with support for custom domains. Server can be self-hosted and doesn't require storing any data
reverse-tunnel191almost 3 years agoSupport TCP and UDP tunnels. Has docker images. Supports Let's Encrypt. MIT License. Written in Go
gt124almost 2 years agoSupports peer-to-peer direct connection (P2P) and Internet relay. Focus on performance. Written in Go
jkuri/bore89over 2 years agoReverse HTTP/TCP proxy via SSH. Written in Go
EXPOSESSH-based open source tool, with no configuration or installation, distributed worldwide, to expose your local services. Uses your GitHub username and public SSH keys to authenticate you and provide you with a short personalised URL. AGP-3.0 License. Written in Python
srv.usSSH-based. Terminates TLS. Hostnames based on your key, optionally GitHub and/or GitLab username. 0BSD License. Written in Go
holepunch60almost 7 years agoUses SSH for muxing. Domain has expired. AGP-3.0 Licensed. Written in Python
docker-wireguard-tunnel70almost 2 years agoConnect two or more Docker servers together sharing container ports between them via a WireGuard tunnel
cactus-tunnel46over 2 years ago🌵 A charming TCP tunnel over WebSocket and Browser. Written in TypeScript
chiSSL51about 2 years agoLightweight version of Chisel that allows you to expose local servers running on your development machine to the internet with valid SSL certificates. MIT License. Written in Go
specter27almost 2 years agoInteresting approach utilizing a DHT. QUIC transport. MIT License. Written in Go
tnnlink25over 5 years agoSSH-based. Golang. Not maintained
ngtor27almost 2 years agoEasily expose local services via Tor. Written in Java
Punchmole11over 2 years agoCan be integrated directly into an existing Node.js project. Written in JavaScript
ephemeral-hidden-service7over 2 years agoCreate ephemeral Tor hidden services from the command line. Written in Python
netmask6over 2 years agoA TCP/UDP self-hostable network tunneling solution that supports IPv4 and IPv6. Client has a GUI. MIT License. Written in Python
tunnelite16almost 2 years agoA self-hostable tunneling solution for TCP, HTTP and WS connections over websockets. CLI client. MIT License. Written in .NET

Commercial/Closed source

ngrok 2.0Probably the gold standard and most popular. Closed source. Lots of features, including TLS and TCP tunnels. Doesn't require root to run client
Cloudflare TunnelExcellent free option. Nicely integrates tunneling with the rest of Cloudflare's products, which include DNS and auto HTTPS. Client is Apache 2.0 licensed and written in Golang
Microsoft Dev TunnelsNot as useful for self-hosting (no custom domains and it shows warnings when people visit the URLs), but a solid option for dev work
Livecycle Docker ExtensionOffer much more than just tunneling. Have a collaboration layer (Dashboard) that allows you to bring collaborations, debug, and gather feedback from the people you are working with. Share HTTPS URLs
BeeceptorGoes beyond tunneling. Rest API mocking and intercepting tool. You can view the live requests and send mocked responses. Written in JavaScript
PinggySSH based single command HTTPS / TCP / TLS tunnels, no downloads required. Rich terminal interface and a web debugger. Free tier - 60 min timeout. The paid tier allows custom domains with built-in Let's Encrypt certificates
LoopholeOffers end-to-end TLS encryption with the client automatically getting certs from Let's Encrypt. QR codes for URL sharing. The client is open source. Can serve a local directory over WebDAV. MIT License. Written in Go
localhost.runSimple hosted SSH option. Supports custom domains for a cost
PacketriotComprehensive alternative to ngrok. HTTP Inspector, Let's Encrypt integration, doesn't require root and Linux repos for apt, yum and dnf. Enterprise licenses and self-hosted option
Horizon TunnelEasy to use HTTP(S) and websocket tunneling aimed at development. Free tier available. Fixed URL is part of paid plans
HoppyWireGuard-based. Provides static IPv4 and IPv6 addresses for your machines, which is a simple and useful level of abstraction. Targeted towards self-hosters and people behind NATs
gw.runSpecifically focusing on securely exposing internal web apps to a group of people; not for publicly facing apps. Share access via email address then allow users to log in with common login providers like Google
SSHReach.mePaid SSH-based option. Uses a simple Python script
KubeSailCompany offering tunneling, dynamic DNS, and other services for self-hosting with Kubernetes
inletsUsed to be ; now focused on a polished commercial offering. Designed to work well with Kubernetes
LocalToNetSupports UDP. Free for a single tunnel. Paid supports custom domains
LocalXposeLooks like a solid paid option, with a limited free tier
playit.ggSpecifically marketed as tunneling for game servers. Client is open source. Server is not. Has a free tier. TCP and UDP supported. Custom domains and dedicated IPs available. Client written in Rust
Tabserve.devWeb UI that runs entirely in the browser and uses a Cloudflare Worker for https
ServeoSSH-based, signup optional, offering HTTP(S) and TCP tunneling and SSH jump host forwarding capabilities
HomewaySecure and private remote access for Home Assistant. The free tier has a monthly data limit cap, but unlimited data is only $2.49/month
btunnelExpose localhost and local tcp server to the internet. The free plan includes file server, custom http request and response headers, basic auth protection and 1 hour tunnel timeout
remote.itTunnels SSH, HTTP/S, TCP, Docker, popular database etc. allows mapping a local port to a remote port
StaqLab TunnelSSH-based. The client is open source. The server doesn't appear to be
LocalCanMacOS app for exposing local apps, has custom domains with built-in Let's Encrypt certificates. It also can publish .local domains on the local network
Openport.ioOpen-source client, written in Go. Supports HTTP(S) and TCP. REST Api. No account needed. Web dashboard. Also works on ESP32
Lokal.soHTTP/TCP/UDP Tunneling & Debugging, zero-config .local address with https, built-in S3 Server, AI Assistant, available as Desktop GUI, Web, REST API, and *CLI, available on Mac, Windows and Linux

Overlay networks and other advanced tools

headscale23,976almost 2 years agoOpen source implementation of Tailscale control server. Can be used with Tailscale's official open source client. Written in Go
TailscaleBuilt on WireGuard. Easy to use. Control server is closed source. Client available with a BSD3 license + separate patents file
TeleportComprehensive control plane tool, but also supports behind NATs. Written in Go
Nebula14,691almost 2 years agoPeer-to-peer overlay network. Developed and used internally by Slack. Similar to Tailscale but completely open source. Doesn't use WireGuard. Written in Go
ZeroTierLayer 2 overlay network. They take decentralization seriously, and like to say "decentralize until it hurts, then centralize until it works." Written in C++
Netmaker9,587almost 2 years agoLayer 3 peer-to-peer overlay network and private DNS. Similar to Tailscale, but with a self-hosted server/admin UI. Runs kernel WireGuard so very fast. Apache 2.0 License. Written in Go
NetBird11,485almost 2 years agoNetBird is an open-source VPN management platform built on top of WireGuard® making it easy to create secure private networks for your organization or home
FirezoneLayer 3/4 overlay network. Runs on kernel WireGuard® and supports SSO using generic OIDC/SAML connectors. Distributed under Apache 2.0 license and written in Elixir/Rust
n2n- Built on nodes and supernodes. GPL-3.0 license. Written in C
innernet5,029almost 2 years agoSimilar to Netmaker, Nebula, and Tailscale. Takes advantage of existing networking concepts like CIDRs and the security properties of WireGuard to turn your computer's basic IP networking into more powerful ACL primitives. Written in Rust
Portals for Mac4,488almost 2 years agoA Mac app that uses the library to privately share a service on your Mac to anyone, anywhere. The service is shared securely over an end-to-end encrypted Ockam Portal. Apache 2.0 License. Written in Rust
PritunlSeems quite comprehensive and complicated. OpenVPN, WireGuard, and IPSec support
Tinc1,977about 2 years agoTinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number of nodes. Instead of configuring tunnels, you give Tinc the location and public key of a few nodes in the VPN. After making the initial connections to those nodes, tinc will learn about all other nodes on the VPN, and will make connections automatically. When direct connections are not possible, data will be forwarded by intermediate nodes. Written in C
OpenZiti- Overlay network. The goal of OpenZiti is to extend zero trust all the way into your application, not just to your network. Apache 2.0 license. Written in Go
weron1,826about 2 years ago- Built on WebRTC. Can create Layer 2 and Layer 3 networks. NAT traversal via STUN and TURN. AGPL-3.0 license. Written in Go
bifrost539almost 2 years agoBifrost is a peer-to-peer communications engine with pluggable transports. It supports dynamic configuration of transports, listeners, forwarding rules, and can tunnel other protocols over WebRTC and Quic. Apache 2.0 License. Written in Go
Ngrok-operator103over 3 years agoNgrok but integrated with Kubernetes, allows developers on private Kubernetes to easily access their services via Ngrok
chisel-operator81almost 2 years agoKubernetes integration for Chisel. Similar functionality to inlets. MIT License. Written in Rust
frp-operator39about 2 years agoKubernetes integration for . MIT License. Written in Go
MycoriaOverlay network where the IPv6 address is the key: Easily share address + public key via a DNS AAAA record or map names locally. Secure by default (firewall included). BSD-3 license. Written in Go

Reference

Roll your own Ngrok with Nginx, Let's Encrypt, and SSH reverse tunnelling
Poor man's ngrok with tcp proxy and ssh reverse tunnel
How I built Ngrok Alternative (jprq)
Great SO answer by AJ ONeal about how these things work
Talk by AJ ONeal about tunneling tech
ngrok alternative: localtunnel + Caddy + Lets Encrypt
Can You Grok It - Another DIY tunnel blog post

Discussions

HN comment about needing Namecheap + Cloudflare + ngrok

Backlinks from these awesome lists:

More related projects: