Open-source alternatives to Encrypted Dns

Blocky is a stateless DNS proxy that functions as a network-wide ad-blocker and content filter. It operates as a single binary or Docker container with no database or persistent state, accepting DNS queries over UDP, TCP, HTTPS, TLS, QUIC, and HTTP/3 through a unified plugin-based query pipeline. The core of the system is a client-group policy engine that assigns devices to named groups and applies per-group blocklists, allowlists, and upstream resolvers, with all configuration changes applied through hot-reloading without requiring a restart. The project distinguishes itself through its modu

Bromite is a privacy-focused fork of the Chromium browser for Android that blocks advertisements and tracking scripts by default, enforces encrypted HTTPS connections, and prevents browser fingerprinting without requiring any extensions or manual configuration. It applies a patch-based build system to layer privacy and security modifications directly onto the upstream Chromium codebase during compilation, integrating a filter list engine for network-level ad blocking and adding noise to browser APIs to mask device identity. The browser distinguishes itself through comprehensive privacy harden

Waterfox is a privacy-focused web browser built on a fork of the Gecko engine that removes all telemetry and tracking code while preserving full extension compatibility. It encrypts DNS queries through independent third-party resolvers to prevent centralized monitoring of browsing destinations, and organizes browser tabs into hierarchical parent-child trees with collapsible branches and keyboard-driven navigation. The browser maintains a backward-compatible runtime bridge that supports both legacy XUL-based add-ons and modern WebExtensions simultaneously, allowing users to keep using older or

This project is a network security tool providing an application network firewall, a DNS blocklist manager, and a VPN client with multi-hop capabilities. It functions as a traffic controller that allows or blocks internet access for specific applications on a device. The system distinguishes itself through a DNS-over-HTTPS firewall and traffic obfuscation tools that inject random packets to mask communication patterns and bypass regional internet censorship. It utilizes multi-hop routing to hide the origin of network traffic by chaining connections through multiple remote servers. The softwa

urllib3 is a Python HTTP client library used for sending network requests and receiving responses. It functions as an HTTP connection pool manager and a TLS certificate validator to ensure secure communication between endpoints. The library provides a system for maintaining reusable network connections to reduce the overhead of repeated handshakes. It also serves as an HTTP proxy client capable of routing requests through proxy servers to manage origin identity or bypass firewalls. The tool covers programmatic file uploads via multipart encoding and automated network resilience through the u

GreenTunnel is a network utility designed to circumvent deep packet inspection and bypass internet censorship. It functions as a tool that modifies outgoing network packets and encrypts DNS lookups to prevent internet service providers and network filtering systems from detecting and blocking specific web destinations. The project implements an HTTP fragmentation proxy and an HTTPS handshake fragmenter. These components split request headers and TLS handshake records across multiple segments to conceal hostnames and destination server names from inspection systems. The software also includes

Hickory-DNS is a DNS implementation written in Rust that provides a full suite of DNS capabilities: a client library for querying and constructing DNS messages, a recursive resolver with caching, an authoritative DNS server, and support for DNSSEC validation and signing. It can operate as a DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) client, and includes a multicast DNS (mDNS) implementation for local network discovery without a central server. The project differentiates itself through its integrated DNSSEC pipeline, which validates signatures by chaining from a root trust anchor and can auto

urllib3 is a Python HTTP client library used to send network requests and receive responses. It provides core components for managing HTTP connection pools, routing traffic through proxies, validating TLS certificates, and executing automatic request retries. The library focuses on network reliability and efficiency by maintaining a system that reuses established connections to multiple hosts to reduce latency. It ensures secure communication through client-side certificate verification and handles transient network errors using policy-based retry logic. The project covers broad networking c

doggo is a multi-protocol DNS lookup client, performance analyzer, and diagnostic troubleshooting tool. It functions as a command-line utility for performing DNS queries across various transport protocols, including UDP, TCP, HTTPS, TLS, and QUIC. The project distinguishes itself through a focus on secure and distributed resolution. It implements encrypted DNS standards such as DNS over HTTPS, DNS over QUIC, and DNSCrypt, and provides DNSSEC validation to verify chains of trust for signed domains. Additionally, it can execute queries from global geographic locations via an external API to ana

This project is a Go DNS library used for implementing DNS clients and servers. It provides a toolkit for packet exchange, record parsing, and the development of custom nameservers. The library includes a DNS server framework and a zone manager for parsing standard zone files and synchronizing data via zone transfers. It features a dedicated DNSSEC implementation library for generating cryptographic keys and validating signatures, as well as a TLS transport for encrypted connections between clients and servers. The system covers a broad range of capabilities including DNS resolver functional

acme-dns is a DNS server and protocol manager designed to proxy TXT records for ACME DNS-01 challenges. It enables the validation of domain ownership for automated certificate issuance without exposing primary DNS zone files or credentials to external clients. The project utilizes CNAME-based delegation to offload verification from a primary zone to a specialized server. It provides a REST API for programmatically updating short-lived validation tokens, which is secured through CIDR-based network restrictions and automated TLS provisioning for the API interface. The system supports stateless

This project is a centralized management interface and orchestrator for deploying censorship circumvention protocols and stealth proxies. It functions as a network censorship bypass tool that routes traffic through encrypted communication protocols to avoid internet firewalls and regional blocks. The system distinguishes itself through a multi-protocol VPN manager and an automated proxy server orchestrator that handles software updates and system backups. It utilizes content delivery networks to mask origin server identities and implements encrypted DNS over HTTPS to prevent DNS poisoning and

NETworkManager is a comprehensive suite of network administration tools designed for the deployment, monitoring, and diagnostic management of enterprise networks. It provides a centralized interface for subnet management, IP address configuration, and wireless network analysis. The project distinguishes itself by integrating a multi-protocol remote administration client that supports SSH, RDP, VNC, Telnet, and PowerShell sessions within a unified tabbed interface. It further differentiates its capabilities through hardware-level discovery using LLDP and CDP frames, alongside the ability to en

A Rust port of shadowsocks

dnsmasq-china-list is a configuration generator and a set of DNS filter and routing lists. It converts curated domain lists into configuration files for dnsmasq to optimize regional name resolution and direct specific domain requests to regional servers. The project focuses on reducing latency and avoiding DNS hijacking for users in China by routing traffic through regional servers and directing requests to the nearest content delivery network nodes. It also provides rules to block malicious domains and advertisements by returning failure responses to prevent network injection. The system ma

DietPi is an ultra-lightweight Debian distribution and software platform purpose-built for single-board computers. It provides a minimal operating system that strips away unnecessary services to reduce CPU and RAM usage, and includes a curated software catalogue of pre-optimised applications that can be installed with a single command. The system reads a plain-text configuration file before first boot to perform unattended OS and software installation, and offers a web interface for remote system administration. What distinguishes DietPi is its comprehensive, integrated approach to turning a

This project provides a containerized DNS sinkhole and network-wide traffic filtering solution. It functions as a central network resolver that intercepts domain queries, allowing users to block advertisements, trackers, and malicious domains by returning null responses to connected devices. The platform distinguishes itself through its integrated DHCP server and comprehensive management capabilities, which allow for automated IP address allocation and granular control over network traffic. It supports complex filtering through regular expression matching, hierarchical rule prioritization, an

Boto3 is the AWS SDK for Python, providing a programmatic interface for managing and automating AWS cloud infrastructure and services. It serves as a cloud management API client and resource manager for provisioning, configuring, and scaling virtual servers, databases, and storage. The library enables the implementation of infrastructure-as-code through declarative templates and scripts, allowing for the deployment of identical resource stacks across multiple accounts and geographic regions. It also provides a framework for coordinating distributed workflows, serverless functions, and contain

Clashmi is a graphical proxy client designed to route internet traffic and bypass network restrictions. It provides a user interface for managing proxy cores, configuring domain lookups, and controlling virtual network interfaces. The project features a dedicated manager for proxy subscriptions and a system for rule-based traffic routing. It includes a transparent proxy controller that intercepts system-wide traffic through a virtual interface and an automatic selection mechanism that chooses the fastest server based on real-time latency. Administration is handled through a web-based control

This project is a GitOps infrastructure framework designed for managing bare metal servers, container clusters, and networking. It serves as a declarative system for orchestrating the deployment and lifecycle of self-hosted services, using Git as the source of truth to synchronize the desired state of the environment. The framework differentiates itself through a comprehensive automation suite that covers the entire hardware-to-service pipeline. It includes a PXE-based bare metal provisioner for network booting and operating system installation, alongside a lightweight container orchestration

This project is a privacy-focused VPN manager and WireGuard client application designed to establish encrypted tunnels that mask user IP addresses and activity. It focuses on maintaining anonymity through a system that supports account creation without personal identifying information. The application distinguishes itself with advanced privacy tools, including a multi-hop orchestrator for routing traffic through multiple sequential servers and a network traffic obfuscator that uses Shadowsocks, TCP, and QUIC to bypass deep packet inspection and censorship. It also implements quantum-resistant

Webmin is a web-based administration interface for Unix systems. It provides a centralized console for managing the full range of server administration tasks — users and groups, software packages, storage, network configuration, system services, and security — all through a browser. Its modular architecture allows separate modules to handle databases (MySQL, MariaDB, PostgreSQL), web servers (Apache), DNS (BIND), email (Sendmail, Dovecot), file sharing (Samba, NFS), and more, with a unified access control system that restricts what each administrator can see and do. What sets Webmin apart is

systemd is a comprehensive system and service manager for Linux that orchestrates the entire operating system lifecycle. It functions as the primary init system, managing the transition from firmware to a fully initialized user space while providing a unified framework for service orchestration, hardware management, and resource control. The project distinguishes itself through its declarative, unit-based configuration model and dynamic dependency resolution, which allow for efficient, on-demand service activation and socket-based process management. It integrates deep system observability th

Synapse is a Matrix homeserver implementation that provides the infrastructure for decentralized, real-time communication and messaging. It functions as a federated chat server that synchronizes room data and event streams across independent server instances to enable cross-domain interoperability. The server utilizes a hybrid core that integrates performance-critical logic in Rust with a Python orchestration layer. It employs a PostgreSQL relational database for persisting user accounts and conversation history, and uses a Redis-based messaging system to distribute tasks across horizontal wo

pgdog is a PostgreSQL sharding proxy, distributed SQL router, and connection pooler. It is designed to enable horizontal data distribution by splitting tables and indices across multiple independent servers to scale storage and processing capacity. The project distinguishes itself through online resharding capabilities, using logical replication to move data between shards without application downtime. It supports multiple routing strategies, including hash, list, and range-based query routing, and manages distributed atomic transactions using a two-phase commit process to ensure consistency

Garage is a distributed object storage system that provides an S3-compatible API gateway. It is designed to synchronize metadata across distributed nodes using conflict-free replicated data types and Merkle-tree state alignment to maintain cluster-wide consistency. The system ensures data resilience through zone-aware replication, distributing data copies across multiple physical locations. It employs quorum-based request routing and versioned layout management to validate and commit cluster configuration changes. The project covers a broad range of operational capabilities, including automa

This project is a curated collection of deployment files and configurations for hosting a wide variety of open-source services on a home server. It primarily utilizes Docker and Docker Compose to automate the orchestration, lifecycle management, and deployment of containerized applications. The repository provides a comprehensive suite for self-hosted infrastructure, covering network management tools, media streaming, and home automation. It includes specialized configurations for securing internal services via reverse proxies, WireGuard VPN tunnels, and automated SSL/TLS certificate manageme