Open-source alternatives to Frp

Chisel is a network tunneling tool that facilitates secure communication by encapsulating TCP and UDP traffic within HTTP requests. It functions as a connection multiplexer, consolidating multiple logical network streams into a single persistent connection to improve throughput and reduce overhead. By leveraging standard web protocols, the system enables firewall traversal and provides a mechanism for remote port forwarding and proxying. The project distinguishes itself through its focus on resilient connectivity and granular access control. It maintains persistent network sessions across uns

ngrok is a secure TCP tunneling proxy and API ingress controller that exposes local services to the public internet. It establishes a persistent connection between a local agent and a cloud-based gateway to route traffic to local ports without requiring firewall or router configuration changes. The project provides a global gateway for routing API traffic, which includes built-in support for rate limiting and authentication policy enforcement. It also functions as an IoT device gateway, enabling remote command execution and access control for embedded hardware via a cloud-to-device bridge. A

Poor man's ngrok - a multi-tenant HTTP/TCP reverse tunnel solution through SSH remote port forwarding

Connect two or more Docker servers together sharing container ports between them via a WireGuard tunnel

Punchmole is a simple tool to give your locally running HTTP servers a public URL and is an easy to self-host alternative to ngrok and/or tunnelmole.

Docker Flow Proxy

Fast WebSocket(s)/HTTP(s)/TCP relay proxy for making tunnels to localhost.

Expose local ports to the internet in seconds

Create ephemeral Tor hidden services from the command line

Holepunch API

TCP, HTTP, SSE and WS tunneling in .NET with SignalR

HTTP(S)/WS(S)/TCP Tunnels to localhost using only SSH.

Sliver is a command and control framework designed for adversary emulation and security assessment operations. It provides a centralized platform for managing remote systems, enabling security professionals to coordinate multi-operator sessions and maintain persistent, secure communication channels across diverse network environments. The framework distinguishes itself through its focus on stealth and infrastructure flexibility. It utilizes dynamic payload obfuscation to generate unique binaries and supports in-memory execution to minimize disk artifacts. Communication is secured through mutu

A beautiful, fully open-source, tunneling service - written in pure PHP

Simple tunneling reverse proxy with a fast web UI and auto HTTPS. Designed for self-hosters.

TCP over HTTP/2

BunkerWeb is a containerized suite of infrastructure tools that functions as a cloud-native web application firewall and Nginx reverse proxy. It provides a security layer for web applications, combining traffic routing with automated SSL certificate management and a web-based security dashboard for monitoring and configuration. The project distinguishes itself through its deep integration with container orchestrators, serving as a Kubernetes ingress controller that automates security settings and service discovery via container labels. It features a plugin-based extension model and a manageme

Docker DNS Forwarder is a lightweight tool that enables the host machine to resolve Docker container names to their IPs via domains in the format "container-name.custom-suffix" (e.g., ".docker")

FlClash is a cross-platform proxy client designed to manage network traffic through configurable rules and system-level tunnel integration. It functions as a native system orchestrator, coordinating application lifecycle events and background services across desktop and mobile environments. The application utilizes a modular architecture that enables extensibility through local plugins and foreign function interfaces, allowing for direct interaction with native system libraries. It maintains security by isolating restricted administrative tasks within a privileged helper process, which valida

Onion addresses for anything.

Traefik is a cloud-native load balancer and dynamic reverse proxy designed for microservices traffic routing. It automatically discovers services and generates network routes by listening to infrastructure changes in orchestrators and service registries. The project distinguishes itself through auto-configuring service routing, which eliminates manual configuration by updating routing rules in real time as infrastructure scales. It also provides automated SSL certificate management, utilizing ACME-based automation to request and renew certificates from remote authorities. Additional capabili

Expose local http, tcp or websocket connections to the public internet

Flannel is a virtual networking layer and Kubernetes CNI plugin that provides automated subnet management and Layer 3 overlay connectivity. It functions as a container network fabric, enabling distributed containers and pods across multiple hosts to communicate using unique IP addresses without manual routing configuration. The system operates as a distributed subnet manager, allocating and persisting unique subnet ranges to hosts using a distributed key-value store. This ensures conflict-free container addressing across the cluster by tracking subnet leases and persisting network metadata.

An open-source alternative to Ngrok, designed to serve production traffic and be simple to host (particularly on Kubernetes)