Open-source alternatives to Pivpn

This project is a bash-based installation script and deployer used to automate the setup and configuration of an OpenVPN server on Linux systems. It provides a guided setup process for deploying virtual private network software across various Debian and Red Hat based distributions. The tool functions as a user management interface, allowing for the creation, removal, and administration of client profiles and the security credentials required for network access. It orchestrates the deployment of secure tunnels to enable remote network access to private environments. The system manages the ins

wireguard-ui is a web-based management interface and configuration generator for WireGuard VPN servers. It provides an authenticated administrative dashboard that allows users to manage VPN tunnels and peer connections through a graphical interface instead of manually editing configuration files. The project automates the creation of cryptographic key pairs and produces connection files and QR codes for distributing network settings to clients. It includes tools for tracking client metadata, such as names and email addresses, to identify individual users associated with specific connection se

This project is a containerized IPsec VPN server designed to provide secure remote network access. It functions as an IKEv2 VPN gateway, utilizing the StrongSwan daemon to manage security associations and establish encrypted tunnels between remote clients and a private network. The server acts as a certificate-based VPN manager, handling the generation and distribution of digital certificates and pre-shared keys to authenticate remote users. It includes tools for IKEv2 client management to automate the creation of configuration profiles and security keys for connecting devices. The system co

Amnezia Client is a cross-platform VPN client application and server orchestrator designed to manage secure tunnels and automate the deployment of containerized VPN services on remote self-hosted servers. It functions as a multi-protocol VPN manager that supports various tunneling standards to ensure connectivity across restrictive network environments. The project distinguishes itself through network traffic obfuscation, which disguises VPN traffic as common web protocols or DNS requests to bypass deep packet inspection and censorship. It further enables the automation of remote server admin

Wirehole is a containerized network stack that integrates a WireGuard VPN server with recursive DNS resolution and sinkhole-based advertisement filtering. It bundles these interdependent services into a single managed environment using a compose-based deployment. The system enables network-wide ad blocking and tracker filtering by intercepting DNS queries via a sinkhole. It implements recursive DNS resolution to resolve domain names independently of external upstream providers and provides a web-based interface for managing VPN client peers and keys. Additional capabilities include split-tun

wgcf is a network account manager and profile generator used to register service accounts and create configuration files for Cloudflare WARP. It enables the generation of standard WireGuard profiles that allow clients to connect to these network services. The tool includes mechanisms for service account registration and the binding of subscription licenses to activate premium network features. It manages the persistence of account identities and subscription data locally to maintain connectivity. Additional capabilities include network connection verification and diagnostic tools for tracing

This project is a public key infrastructure management system designed to automate the issuance, renewal, and revocation of X.509, TLS, and SSH certificates. It functions as a machine identity provider and certificate authority, enabling the establishment of private PKI to secure inter-service communication and remote access. The system distinguishes itself through hardware-bound identity attestation, which ties cryptographic keys to physical device silicon or TPMs to prevent credential exfiltration. It supports a wide array of identity verification mechanisms, including OIDC, cloud-provider

Streisand is an orchestration system for deploying multi-protocol tunneling services and traffic obfuscation tools designed to circumvent regional network restrictions. It functions as a deployment utility and manager for various VPN and proxy services on remote cloud servers. The system distinguishes itself through a network obfuscation toolkit that wraps traffic in layers to evade deep packet inspection and bandwidth throttling. It automates the setup of multiple protocols, including WireGuard, OpenVPN, Shadowsocks, OpenConnect, OpenSSH, and Tor bridges. The project also includes utilities

This project is a shell-based orchestration tool designed to automate the deployment and administration of WireGuard virtual private network servers on Linux hosts. It functions as a system-level networking utility that handles the installation of kernel modules, the configuration of secure tunnel interfaces, and the management of network routing rules to enable encrypted remote access. The tool provides an interactive command-line interface that simplifies the lifecycle management of network peers. It allows administrators to dynamically add or remove client access profiles, assign custom DN

This project is a multi-provider dynamic DNS client and synchronizer that monitors local IPv4 and IPv6 addresses and automatically updates DNS records across various cloud providers. It functions as an IP address monitoring tool and a network IP update webhook, ensuring that domain names remain pointed to current network addresses. The system distinguishes itself through a wide range of native provider integrations, including Cloudflare, AliDNS, DNSPod, Huawei Cloud, and HE.net. Beyond simple record updates, it allows for the management of CDN proxy status, TTL durations, and regional routing

NextcloudPi is a deployment suite and pre-configured software stack designed to install and manage a private cloud environment on Linux servers and single-board computers. It includes a specialized operating system image optimized for Raspberry Pi hardware and a dedicated management panel for automating the deployment of cloud storage and collaboration tools. The project distinguishes itself through a web-based configuration interface that allows for the automation of system updates, backup restores, and hardware monitoring. It integrates a dynamic DNS manager to synchronize server IP address

This project is a privacy-focused VPN manager and WireGuard client application designed to establish encrypted tunnels that mask user IP addresses and activity. It focuses on maintaining anonymity through a system that supports account creation without personal identifying information. The application distinguishes itself with advanced privacy tools, including a multi-hop orchestrator for routing traffic through multiple sequential servers and a network traffic obfuscator that uses Shadowsocks, TCP, and QUIC to bypass deep packet inspection and censorship. It also implements quantum-resistant

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

This project is a collection of automated deployment tools centered around a Shadowsocks server auto-installer for Linux distributions. It provides a specialized SOCKS5 proxy manager and a web-based proxy control panel to administer secure network tunneling. The toolkit distinguishes itself by integrating a Linux kernel optimizer that enables congestion control algorithms to increase network throughput. It also includes a dedicated deployer for HTTP/3 web servers and a management interface capable of generating connection QR codes and monitoring real-time performance. The software covers a b

This project is a wireless hotspot management interface for Debian devices. It provides a web-based controller for managing wireless access points, wireless repeaters, VPN gateways, and DNS ad-blocking filters. The system includes a captive portal framework to intercept network traffic via customizable splash pages and a VPN controller that supports WireGuard and OpenVPN with kill-switch functionality. It further differentiates itself with a DNS ad-blocking filter using curated blacklists and the ability to operate in multiple network modes, including bridged access point and wireless repeate

This project is a toolset for automated VPN installation, proxy server management, and server-side network throughput optimization. It provides a Shadowsocks proxy server manager used to deploy and configure proxy servers on virtual private servers. The system utilizes automated deployment scripts to handle the installation of encryption methods, ports, and passwords on remote servers. It includes a VPS network optimizer that activates BBR congestion control to reduce latency and increase throughput for high-bandwidth streaming. The software covers remote proxy configuration and client confi

Pritunl is an enterprise VPN gateway and server manager used to deploy and configure OpenVPN and WireGuard servers through a centralized web interface. It functions as a VPN access control system and an SSH certificate authority, issuing short-lived signed certificates to manage secure shell access and network entry without manual public key distribution. The platform acts as an SSO integrated VPN controller, synchronizing user access and organization mapping with third-party identity providers via OAuth, OIDC, and SAML. It supports high-availability deployments by using database-backed clust

Teleport is a zero-trust access platform designed to provide secure, identity-based connectivity to servers, databases, and Kubernetes clusters. It functions as a centralized gateway that replaces static credentials with short-lived, identity-bound cryptographic certificates, effectively eliminating the need for traditional VPNs and long-term secret exposure. The platform distinguishes itself by orchestrating access through a unified control plane that maps external identity provider claims to granular, role-based infrastructure permissions. It enforces security through mutual TLS gateways an

This project provides a shell-based automation utility for deploying and managing OpenVPN servers on Linux hosts. It functions as an orchestration tool that handles the installation of networking software, the configuration of system-level routing rules, and the generation of cryptographic credentials required to establish secure, encrypted tunnels for remote network access. The tool distinguishes itself by automating the entire lifecycle of a private network gateway, including the management of peer identities and the distribution of standardized configuration profiles. It simplifies the set

NWPusher is an application for macOS and iOS designed to send, debug, and manage payloads delivered via the Apple Push Notification service. It functions as a tool for delivering custom data payloads to remote devices using secure certificates and unique device identification tokens. The project provides utilities for identifying and removing expired or invalid device tokens by interfacing with push notification feedback services. It includes a manager for loading secure certificates and private keys from keychains or encrypted files to authenticate requests to delivery servers. The toolset

Ligolo-ng is a network tunneling framework and control server designed for managing remote agents and coordinating network routing. It functions as a reverse tunneling proxy and a site-to-site VPN tool, utilizing a userland TUN interface to pivot network traffic through remote agents. The project distinguishes itself by using a TUN interface routing system to forward TCP, UDP, and ICMP traffic through multiple remote agents. It implements a C2 model where a central server manages remote agents to bypass firewall restrictions and provide direct subnet access to isolated networks. The system c

node-apn is a Node.js library and push notification driver used to send remote notifications to Apple devices via the Apple Push Notification service. It functions as an HTTP/2 client that manages the construction and transmission of JSON payloads to the Apple notification gateway. The library supports multiple identity verification methods, including certificate-based authentication using PEM or PFX files and token-based authentication with automatically renewing tokens. It includes capabilities for routing traffic through intermediary proxy servers and secure HTTP tunnels to bypass restrict

Knuff is a desktop debugging tool designed for testing Apple Push Notification service payloads. It enables the delivery of custom JSON payloads to mobile devices to verify that notifications are received correctly. The application integrates with the system keychain to manage security certificates and private keys for request signing. It also includes a utility to export these security identities from the keychain into portable file formats for use with other development tools. The tool provides mechanisms for automatic device token retrieval and a payload manager to save and reuse device t

Corda is a distributed ledger technology platform used to build private, interoperable business networks. It provides a framework for creating shared records of facts and executing smart contracts between specific participants without requiring global data broadcasting. The platform distinguishes itself through a point-to-point state distribution model and a UTXO-based ledger, ensuring that transaction data is shared only between involved parties to maintain strict privacy. It utilizes a JVM-based smart contract engine to execute business logic written in Java or Kotlin and employs a notary-b

This project is a curated collection of deployment files and configurations for hosting a wide variety of open-source services on a home server. It primarily utilizes Docker and Docker Compose to automate the orchestration, lifecycle management, and deployment of containerized applications. The repository provides a comprehensive suite for self-hosted infrastructure, covering network management tools, media streaming, and home automation. It includes specialized configurations for securing internal services via reverse proxies, WireGuard VPN tunnels, and automated SSL/TLS certificate manageme

JimsGarage is a collection of shell scripts and automation tools designed to help individuals deploy and manage a wide range of self-hosted services on their own hardware. It provides a structured approach to setting up containerized applications, from media servers and document management systems to VPNs and monitoring stacks, all through automated Docker-based configurations. The project distinguishes itself by offering a comprehensive library of deployment recipes that cover the full lifecycle of a home server environment. This includes not just the services themselves, but also the suppor

Paseo is an LLM coding agent orchestrator and multi-agent workflow manager designed to coordinate multiple AI agents across isolated git worktrees. It provides a unified control interface for managing these agents and their associated environments to execute complex programming tasks. The system distinguishes itself through a remote agent daemon that enables secure access to local coding agents via encrypted relays. It employs a git worktree environment manager to isolate parallel tasks into dedicated directories and branch-based server URLs, preventing file collisions and network port confli