UPDATE 2026-08-10: I did a lot of backlog cleanup over the weekend. I used AI to help with automation and write comments, but I tried to make all the yes/no decisions myself. Some things almost certainly slipped through the cracks. If you feel your issue/PR was closed in error, please comment so I can take a closer look.
UPDATE 2026-02-16: Given the sensitive nature of tunneling tools, I'm going to start requiring at least 100 GitHub stars on any new additions. Projects not hosted on GitHub and commercial offerings will be handled case-by-case. Feel free to open an issue if you see a problem with this policy.
What is this list for
The purpose of this list is to track and compare tunneling solutions. This is
primarily targeted toward self-hosters and developers who want to do things
like exposing a local webserver via a public domain name, with automatic HTTPS,
even if behind a NAT or other restricted network.
The dream
I started this list because I'm looking for a simple tool/service that does the
following:
- Allows me to register a domain name and automatically points the records at
the server running the tunnels.
- Automatically sets up and manages HTTPS certificates (apex and subdomains)
for the domain.
- Provides a client tool that tunnels HTTP/TCP connections through the server
without requiring root on the client.
- Provides a simple GUI interface to allow me to map X domain/subdomain to Y port
on Z client, and proxy all connections to that domain.
So far I haven't found a tool that does all of this. In particular, while some
of them can do automatic certs through Let's Encrypt, none of them integrate
the domain registration and DNS management in a simple way.
Recommendations
- For most people, I currently recommend Cloudflare Tunnel. Although it's closed source, this is the production-quality service that gets the closest to achieving the dream. It's also a loss-leader for Cloudflare's other products which means they can offer it for free.
- If you want to self-host, there are many options. For something production ready I would look at Pangolin or frp. If you're a developer and want something very simple, I'd recommend starting with my own SirTunnel project and modifying it for your needs.
Open source (at least with a reasonably permissive license)
- Telebit - Written in JS. Code.
- tunnel.pyjam.as - No custom client; uses WireGuard directly instead. Written in Python. source code
- SSH-J.com - Public SSH Jump & Port Forwarding server. No software, no registration, just an anonymous SSH server for forwarding. Users are encouraged to use it for SSH exposure only, to preserve end-to-end encryption. No public ports, only in-SSH connectivity. Run
ssh ssh-j.com and it will display usage information.
- Greenhouse - Instant least-authority port-forwarding with automatic HTTPS; the authors "really don't want your TLS private keys." The hosted service (greenhouse.server.garden) is currently unavailable and the project appears unmaintained (last activity 2023).
- frp
- Comprehensive open alternative to ngrok. Supports UDP, and has a P2P mode. Supports multiplexing over TCP (single connection or pool), QUIC, and KCP.
- ngrok 1.0
- Original version of ngrok. No longer developed in favor of the commercial 2.0 version.
- localtunnel/localtunnel
- Written in node. Popular suggestion.
- Pangolin
- Fully self-hostable tunneled reverse proxy management server with identity and access control, automated SSL certificates, and dashboard UI.
- chisel
- SSH under the hood, but still uses a custom client binary. Supports auto certs from LetsEncrypt. Written in Go.
- rathole
- Similar to frp, including the config format, but with improved performance. Low resource consumption. Hot reload. Written in Rust.
- sshuttle
- Open source project originally from one of the founders of Tailscale. Server doesn't require root; client does. Explicitly designed to avoid TCP-over-TCP issues.
- bore
- Minimal tunneling solution. MIT Licensed. Written in Rust.
- gost
- Looks like a comprehensive option. TCP and UDP tunneling. TAP/TUN devices. Load balancing. Web API. Written in Go.
- tunnelto
- Open source (MIT). Written in Rust.
- wstunnel
- Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Rust with executables provided.
- sish
- Open source ngrok/serveo alternative. SSH-based but uses a custom server written in Go. Supports WebSocket tunneling.
- zrok
- Aims for effortless sharing both publicly and privately. Supports multiple types of resources, including HTTP endpoints and files. Built on OpenZiti (see overlay section below). Apache 2 License. Written in Go.
- expose
- ngrok alternative written in PHP.
- pgrok/pgrok
- A multi-tenant HTTP reverse tunnel solution through SSH remote port forwarding.
- go-http-tunnel
- Uses a single HTTP/2 connection for muxing. Need to manually generate certs for server and clients.
- progrium/localtunnel
- As far as I know this is the first ever tool of this kind, predating ngrok and the other localtunnel. No longer maintained, but here for posterity. MIT License. Written in Go.
- portr
- Has a JavaScript/Python admin page and request inspection/replay features. AGPL-3.0 License. Tunneling implemented in Go.
- piko
- Piko is an open-source alternative to Ngrok, designed to serve production traffic and be simple to host (particularly on Kubernetes). MIT License. Written in Go.
- gsocket/Global Socket
- The Global Socket Toolkit allows two users behind NAT/Firewall to establish a TCP connection with each other. Securely. Written in C.
- Tunnelmole
- Open source and optionally self hostable. The client and server are both written in TypeScript.
- Selfhosted Gateway
- Self-hosted Docker-native alternative to Cloudflare Tunnel/ngrok. Reverse Proxy-over-VPN (RPoVPN) using WireGuard, Caddy and NGINX to expose local docker-compose services to the Internet with automatic HTTPS. AGPL-3.0 License.
- Wiredoor
- Self-hosted ingress-as-a-service (WireGuard reverse VPN + NGINX) to expose private HTTP/TCP/UDP services with OAuth2 auth, automatic TLS, CLI & dashboard.
- SirTunnel
- Minimal, self-hosted, 0-config alternative to ngrok. Similar to sish but leverages Caddy+OpenSSH rather than custom server code.
- jprq
- Proxies over WebSockets. Written in Go.
- boringproxy
- Designed to be very easy to use. No config files. Clients can be remote-controlled through a simple WebUI and/or REST API on the server.
- Wiretap
- Transparent tunneling over WireGuard (UDP) using userspace network stack. Root not required on server. Supports multiple clients and servers. Written in Go.
- NPS Enhanced
- Self-hosted NAT traversal and reverse proxy with a Web UI, HTTP/HTTPS and TCP/UDP forwarding, and automatic certificate support. GPL-3.0 Licensed. Written in Go.
- reverst
- Self-hosted HTTP reverse tunnels over HTTP/3 and QUIC, with load-balanced tunnel groups and host-based routing. Apache-2.0 License. Requires manual TLS/DNS; no formal releases; latest tag v0.2.0 (2024-05-27).
- PageKite
- Comprehensive open source solution with hosted options.
- rustunnel
- Replicates the core functionality of ngrok. Exposes local services behind NAT/firewalls to the public internet through a relay server (self-hosted or managed). AGPL-3.0 License. Written in Rust.
- onionpipe
- Onion addresses for anything. onionpipe forwards ports on the local host to remote Onion addresses as Tor hidden services and vice-versa. Written in Go.
- Port Buddy
- Port Buddy is a tool that allows you to share a port opened on your local host or private network to the public network. HTTP/TCP/UDP tunnels. Apache 2.0 License. Written in Java.
- tunnl.gg
- SSH-based hosted tunnel using the standard OpenSSH client with no account: ssh -t -R 80:localhost:8080 proxy.tunnl.gg gives a public HTTPS URL. Complete MIT-licensed Go relay, self-hostable.
- pipenet
- A modern alternative to localtunnel. Bundles client & server with both SDK and CLI. Supports single-port mode for cloud deployments. MIT Licensed. Written in TypeScript.
- tunneller
- Open source. Written in Go.
- Crowbar
- Tunnels TCP connections over HTTP GET and POST requests.
- tunelo
- Single binary Rust QUIC tunnel with client, self-hostable relay, and built-in file server/web explorer. Outbound-only, instant public HTTPS subdomain, no account. MIT (declared; LICENSE file pending).
- tunnel
- This one is a Golang library, not a program you can just run. However, it looks easy to use for creating custom solutions. Uses a single TCP socket, and yamux for multiplexing.
- mmar
- A zero-dependency, self-hostable, cross-platform HTTP tunnel that exposes your localhost to the world on a public URL. AGPL-3.0 License. Written in Go.
- remotemoe
- SSH-based, with custom golang server. Does some cool unique things. Instead of just plain tunnels, it drops you into a basic CLI UI that offers several useful commands interactively, such as adding a custom hostname. Also allows end-to-end encryption for both HTTPS and upstream SSH. Doesn't appear to offer non-e2e HTTPS, ie no auto Let's Encrypt support.
- docker-tunnel
- Simple Docker-based nginx+SSH solution.
- EXPOSE
- SSH-based open source tool, with no configuration or installation, distributed worldwide, to expose your local services. Uses your GitHub username and public SSH keys to authenticate you and provide you with a short personalised URL. AGP-3.0 License. Written in Python.
- tunwg
- Wireguard in userspace based. Offers end to end encrypted TLS with LetsEncrypt certificates generated automatically by clients, with support for custom domains. Server can be self-hosted and doesn't require storing any data.
- jerson/pgrok
- Fork of ngrok 1.0, with more recent commits. Archived.
- BitBang
- Turn your machine into a URL. Your computer and browser connect peer-to-peer over WebRTC. Whoever opens the link needs no account and nothing installed. Shell, file sharing, and HTTP/WebSocket proxy over a single URL. Written in Go.
- hypertunnel
- Public server appears to be down. MIT Licensed. Written in JavaScript.
- Portal
- Self-hostable relay tunnel (MIT, Go). portal expose 3000 publishes a localhost service at a public HTTPS URL through community or self-hosted relays; outbound-only, no account, raw TCP/UDP, SNI-based routing, tenant-side TLS termination. Similar to boringproxy/ngrok.
- reverse-tunnel
- Support TCP and UDP tunnels. Has docker images. Supports Let's Encrypt. MIT License. Written in Go.
- chiSSL
- Lightweight version of Chisel that allows you to expose local servers running on your development machine to the internet with valid SSL certificates. MIT License. Written in Go.
- srv.us
- SSH-based. Terminates TLS. Hostnames based on your key, optionally GitHub and/or GitLab username. 0BSD License. Written in Go.
- jkuri/bore
- Reverse HTTP/TCP proxy via SSH. Written in Go.
- vgrok [
] - CLI to get a secure public URL for your local web server. Built with Vercel Sandbox and written in JavaScript.
- gt
- Supports peer-to-peer direct connection (P2P) and Internet relay. Focus on performance. Written in Go.
- h2tunnel
- A pure Node.js TCP tunnel with zero dependencies in less than 500 LOC. Supports IPv4 and IPv6, half-open / half-closed connections, encrypted using TLS. Uses HTTP2 under the hood for multiplexing. MIT License.
- docker-wireguard-tunnel
- Connect two or more Docker servers together sharing container ports between them via a WireGuard tunnel.
- holepunch
- Uses SSH for muxing. Domain has expired. AGP-3.0 Licensed. Written in Python.
- cactus-tunnel
- 🌵 A charming TCP tunnel over WebSocket and Browser. Written in TypeScript.
- tunnelite
- A self-hostable tunneling solution for TCP, HTTP and WS connections over websockets. CLI client. MIT License. Written in .NET.
- specter
- Interesting approach utilizing a DHT. QUIC transport. MIT License. Written in Go.
- wireport - Multi-protocol tunneling (HTTP[S]/2, WebSockets, gRPC, TCP, UDP, auto-TLS/SSL). Securely resolves remote Docker container names as local hostnames. Easy self-hosting (no tinkering with docker-compose and configs). MIT License. Written in Go.
- YTunnel - MIT Licensed, Rust powered, uses your domains and creates Cloudflare Tunnels with easy to use TUI
- ngtor
- Easily expose local services via Tor. Written in Java.
- tnnlink
- SSH-based. Golang. Not maintained.
- Punchmole
- Can be integrated directly into an existing Node.js project. Written in JavaScript.
- hsync
- Works in Node.js and browsers. Any two instances can easily pair and make a peer-to-peer WebRTC connection to forward TCP/UDP ports (even in browser). No additional signaling server needed. Written in JavaScript.
- netmask
- A TCP/UDP self-hostable network tunneling solution that supports IPv4 and IPv6. Client has a GUI. MIT License. Written in Python.
- ephemeral-hidden-service
- Create ephemeral Tor hidden services from the command line. Written in Python.
- TunnelAPI 1.0
- Expose localhost to the internet. Free secure tunneling as an ngrok alternative. Appears developer focused. MIT License . Written in TypeScript.
Commercial/Closed source
- ngrok 2.0 - Probably the gold standard and most popular. Closed source. Lots of features, including TLS and TCP tunnels. Doesn't require root to run client.
- Webhook Relay - Hosted HTTP/TCP tunnels and webhook forwarding to private services through an outbound client. Provides stable hostnames, custom domains with automatic HTTPS, and a Kubernetes operator; an account and paid plan are required for bidirectional tunnels.
- Cloudflare Tunnel - Excellent free option. Nicely integrates tunneling with the rest of Cloudflare's products, which include DNS and auto HTTPS. Client source code is Apache 2.0 licensed and written in Golang.
- Microsoft Dev Tunnels - Not as useful for self-hosting (no custom domains and it shows warnings when people visit the URLs), but a solid option for dev work.
- Livecycle Docker Extension - Offer much more than just tunneling. Have a collaboration layer (Dashboard) that allows you to bring collaborations, debug, and gather feedback from the people you are working with. Share HTTPS URLs.
- Beeceptor - Goes beyond tunneling. Rest API mocking and intercepting tool. You can view the live requests and send mocked responses. Written in JavaScript.
- Pinggy - SSH based single command HTTPS / TCP / TLS tunnels, no downloads required. Rich terminal interface and a web debugger. Free tier - 60 min timeout. The paid tier allows custom domains with built-in Let's Encrypt certificates.
- tuns.sh - SSH-based hosted tunnel from pico.sh. Uses the system SSH client with no additional installation;
ssh -R dev:80:localhost:3000 tuns.sh exposes a local service at https://{user}-dev.tuns.sh with automatic HTTPS. Supports HTTP/WSS/TCP tunnels, custom domains, US/EU regions, and per-site analytics. Requires pico+ ($2/month billed yearly); the backend is open-source sish.
- Loophole - Offers end-to-end TLS encryption with the client automatically getting certs from Let's Encrypt. QR codes for URL sharing. The client is open source. Can serve a local directory over WebDAV. MIT License. Written in Go.
- localhost.run - Simple hosted SSH option. Supports custom domains for a cost.
- Packetriot - Comprehensive alternative to ngrok. HTTP Inspector, Let's Encrypt integration, doesn't require root and Linux repos for apt, yum and dnf. Enterprise licenses and self-hosted option.
- Horizon Tunnel - Easy to use HTTP(S) and websocket tunneling aimed at development. Free tier available. Fixed URL is part of paid plans.
- Hoppy - WireGuard-based. Provides static IPv4 and IPv6 addresses for your machines, which is a simple and useful level of abstraction. Targeted towards self-hosters and people behind NATs.
- gw.run - Specifically focusing on securely exposing internal web apps to a group of people; not for publicly facing apps. Share access via email address then allow users to log in with common login providers like Google.
- SSHReach.me - Paid SSH-based option. Uses a simple Python script.
- KubeSail - Company offering tunneling, dynamic DNS, and other services for self-hosting with Kubernetes.
- inlets - Used to be open source; now focused on a polished commercial offering. Designed to work well with Kubernetes.
- LocalToNet - Supports UDP. Free for a single tunnel. Paid supports custom domains.
- LocalXpose - Looks like a solid paid option, with a limited free tier.
- playit.gg
- Specifically marketed as tunneling for game servers. Client is open source. Server is not. Has a free tier. TCP and UDP supported. Custom domains and dedicated IPs available. Client written in Rust.
- Tabserve.dev - Web UI that runs entirely in the browser and uses a Cloudflare Worker for https.
- TunnelAPI 2.0 - With a lot of features for teams and enterprises, including the AI API Gateway (a single gateway to multiple models), API Workflow, and exposing localhost to the internet with a custom subdomain. Doesn't require root to run the client.
- Serveo - SSH-based, signup optional, offering HTTP(S) and TCP tunneling and SSH jump host forwarding capabilities.
- Homeway - Secure and private remote access for Home Assistant. The free tier has a monthly data limit cap, but unlimited data is only $2.49/month.
- instatunnel - Hosted tunneling service offering HTTP/TCP tunnels and custom domain support. Suitable for quickly exposing local services with built-in HTTPS and simple setup. Allows for 3 simultaneous tunnels
- remote.it - Tunnels SSH, HTTP/S, TCP, Docker, popular database etc. allows mapping a local port to a remote port.
- StaqLab Tunnel
- SSH-based. The client is open source. The server doesn't appear to be.
- LocalCan - Desktop app and CLI for Mac, Windows and Linux (CLI-only on Linux). HTTP and TCP tunnels with custom domains and automatic HTTPS, .local domains on the local network via mDNS, traffic inspection and replay, MCP server for AI agents. Free tier - one HTTP tunnel, 60 min sessions, 1 GB/month.
- Openport.io
- Open-source client, written in Go. Supports HTTP(S) and TCP. REST Api. No account needed. Web dashboard. Also works on ESP32.
- Lokal.so HTTP/TCP/UDP Tunneling & Debugging, zero-config .local address with https, built-in S3 Server, AI Assistant, available as Desktop GUI, Web, REST API, and *CLI, available on Mac, Windows and Linux.
- Optimistix Tunnel - Easily expose your local server to the internet with simple SSH-based tunneling. Supports HTTP(S) and TCP. No signup, no install—just connect and go. Free plan available.
- Svix Play
- Free, no-signup hosted webhook relay and debugger. Its MIT-licensed CLI exposes a local HTTP webhook endpoint at an automatically generated HTTPS URL with svix listen URL; intended for development rather than general-purpose production tunneling.
- GetPublicIP - Commercial service that routes a dedicated public IPv4/IPv6 address to a server behind NAT over WireGuard, with TCP, UDP, and ICMP support; users manage their own TLS.
- SteadIP - Offers both free and paid tunneling services. SteadIP Anchor gives your tunnel a dedicated IPv4 address, so your endpoint keeps a stable public IP instead of sharing one.
- DockFlare
- Self-hosted control plane that automates Cloudflare Tunnel, DNS, and Zero Trust Access from Docker labels and a web UI. GPL-3.0. Requires a Cloudflare account and API token. Website: https://dockflare.app
- Netrinos - Commercial WireGuard-based overlay VPN. Gateway mode reaches devices that can't run a client (IP cameras, NVRs, NAS, printers); 1:1 NAT lets sites with overlapping LAN subnets coexist; works behind CGNAT without port forwarding.
- headscale
- Open source implementation of Tailscale control server. Can be used with Tailscale's official open source client. Written in Go.
- Tailscale
- Built on WireGuard. Easy to use. Control server is closed source. Client code available with a BSD3 license + separate patents file.
- NetBird
- Open-source WireGuard®-based overlay VPN (peer-to-peer mesh) with SSO/MFA and granular access control, hosted (NetBird Cloud) or self-hosted. Its beta Reverse Proxy exposes internal services at public HTTPS URLs with automatic Let's Encrypt TLS via the dashboard or netbird expose (HTTP and TCP/UDP/TLS; custom domains).
- Teleport
- Comprehensive control plane tool, but also supports accessing apps behind NATs. Written in Go.
- Nebula -
Peer-to-peer overlay network. Developed and used internally by Slack. Similar to Tailscale but completely open source. Doesn't use WireGuard. Written in Go.
- ZeroTier -
Layer 2 overlay network. They take decentralization seriously, and like to say "decentralize until it hurts, then centralize until it works." Written in C++.
- Netmaker
- Layer 3 peer-to-peer overlay network and private DNS. Similar to Tailscale, but with a self-hosted server/admin UI. Runs kernel WireGuard so very fast. Apache 2.0 License. Written in Go.
- Firezone
- Layer 3/4 overlay network. Runs on kernel WireGuard® and supports SSO using generic OIDC/SAML connectors. Distributed under Apache 2.0 license and written in Elixir/Rust.
- iroh
- A QUIC way of doing peer-peer connectivity using 'dialing by public key' for all applications. MIT or Apache 2.0 License. Written in Rust.
- n2n -
- Built on nodes and supernodes. GPL-3.0 license. Written in C.
- innernet
- Similar to Netmaker, Nebula, and Tailscale. Takes advantage of existing networking concepts like CIDRs and the security properties of WireGuard to turn your computer's basic IP networking into more powerful ACL primitives. Written in Rust.
- Portals for Mac
- A Mac app that uses the Ockam library to privately share a service on your Mac to anyone, anywhere. The service is shared securely over an end-to-end encrypted Ockam Portal. Apache 2.0 License. Written in Rust.
- Pritunl
- Seems quite comprehensive and complicated. OpenVPN, WireGuard, and IPSec support.
- OpenZiti -
- Overlay network. The goal of OpenZiti is to extend zero trust all the way into your application, not just to your network. Apache 2.0 license. Written in Go.
- Octelium
- A FOSS self-hosted unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA platform, API/AI/MCP gateway, a PaaS, an ngrok-alternative and a homelab infrastructure. AGPL-3.0 and Apache-2.0 Licenses. Written in Go.
- Tinc
- Tinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number of nodes. Instead of configuring tunnels, you give Tinc the location and public key of a few nodes in the VPN. After making the initial connections to those nodes, tinc will learn about all other nodes on the VPN, and will make connections automatically. When direct connections are not possible, data will be forwarded by intermediate nodes. Written in C.
- weron -
- Built on WebRTC. Can create Layer 2 and Layer 3 networks. NAT traversal via STUN and TURN. AGPL-3.0 license. Written in Go.
- Anywherelan
- Layer 3 peer-to-peer VPN. Fully mesh, with community-run coordination servers and an open-source AWL bootstrap node. Built on the libp2p networking stack (QUIC, TCP). Has NAT traversal and relaying support. Its workflow and GUI are similar to Syncthing, but for networking rather than file transfers. Available on Linux, Mac, Windows and Android. MPL-2.0 License. Written in Go.
- EdgeVPN - Fully decentralized, statically built P2P VPN on libp2p. No central server; peers discover each other via DHT. Supports file transfer and sharing TCP services between peers without a VPN interface. Apache 2.0 License. Written in Go.
- LanEmu/P2PVPN
- LanEmu is a 2023+ continuation of the original P2PVPN from 2009. It uses Bittorrent trackers for matchmaking/rendezvous, and then routes traffic in a peer-to-peer VLAN via OpenVPN's TAP drivers; effectively a decentralized peer-to-peer mesh VPN. It uses RSA-4096 for peer authentication, AES-128-GCM for encrypting peer-to-peer traffic and SHA-512 with RSA algorithm to sign invitations. LGPLv3 License. Written in Java and supported on WinXP+, Linux, FreeBSD, and Mac OS X.
- bifrost
- Bifrost is a peer-to-peer communications engine with pluggable transports. It supports dynamic configuration of transports, listeners, forwarding rules, and can tunnel other protocols over WebRTC and Quic. Apache 2.0 License. Written in Go.
- connet
- connet is a p2p reverse proxy with NAT traversal. Uses QUIC as a protocol and is written in Go. Apache 2.0 License.
- Ngrok-operator
- Ngrok but integrated with Kubernetes, allows developers on private Kubernetes to easily access their services via Ngrok.
- chisel-operator
- Kubernetes integration for Chisel. Similar functionality to inlets. MIT License. Written in Rust.
- frp-operator
- Kubernetes integration for FRP. MIT License. Written in Go.
- Mycoria
- Overlay network where the IPv6 address is the key: Easily share address + public key via a DNS AAAA record or map names locally. Secure by default (firewall included). BSD-3 license. Written in Go.
- wsssh - Websocket jump host based SSH/SCP tunnelling with self hosted server.
- Nilloc - Developer-focused. Aims to have better pricing than ngrok. Free tier.
- Narrowlink
- Self-hosted zero-trust remote access platform with gateway, agent, and client components, P2P QUIC, fine-grained access control, and automatic ACME certificates when publishing local webservers. MPL-2.0/AGPL-3.0. Written in Rust.
- Twingate - Commercial zero-trust network access service for private resources. Easy outbound connector model, but enrolled-user private access rather than public Internet ingress.
- Yggdrasil -
- An IPv6-only, end-to-end encrypted overlay network with routing between all network participants. LGPLv3 license. Written in Go.
- Hysteria
- QUIC-based censorship-resistant proxy and relay (SOCKS5/HTTP, TCP/UDP forwarding, TUN/TProxy) with NAT traversal for hosting the server behind NAT (Realms). MIT License. Written in Go. Note: egress-proxy focused; no built-in public-URL/ngrok-style ingress.
- EasyTier
- Decentralized mesh VPN / SD-WAN written in Rust. Uses NAT traversal and optional community relay nodes to connect enrolled peers; supports subnet proxy and a web console. LGPL-3.0.
- UpVPN
- Commercial WireGuard provisioning service whose apps use APIs to create on-demand WireGuard servers. Overlay/VPN provisioning rather than public-URL ingress.
- iodine
- Tunnel IPv4 over DNS to reach the internet through restrictive networks where only DNS queries are permitted. ISC License. Written in C.
- proxy.py
- General-purpose HTTP/HTTPS proxy framework written in Python; since v2.4.9 it also bundles grout, an ngrok/frp-style tunnel that exposes local HTTP/HTTPS/WebSocket/TCP services at public URLs via the hosted Jaxl relay. Note: the tunnel-client logic is downloaded from the relay at runtime, and a self-hosted relay is available by request only. BSD-3-Clause License. Written in Python.
Reference
Discussions
A curated list of tunneling tools and services (alternatives to ngrok, Cloudflare Tunnel, Tailscale, and ZeroTier) that let you expose a local server to the internet, with a focus on self-hosting.