Open-source alternatives to SoftEtherVPN

This project provides a shell-based automation utility for deploying and managing OpenVPN servers on Linux hosts. It functions as an orchestration tool that handles the installation of networking software, the configuration of system-level routing rules, and the generation of cryptographic credentials required to establish secure, encrypted tunnels for remote network access. The tool distinguishes itself by automating the entire lifecycle of a private network gateway, including the management of peer identities and the distribution of standardized configuration profiles. It simplifies the set

Awesome Tunneling is a curated directory of technologies designed to facilitate secure connectivity between distributed devices and local services. It serves as a comprehensive resource for identifying tools that enable remote access, private network creation, and the exposure of local environments to the public internet. The collection focuses on solutions that bypass network address translation and firewall restrictions through techniques such as reverse proxy tunneling, overlay network infrastructure, and peer-to-peer connectivity. It categorizes resources based on their ability to establi

Nebula is a scalable, decentralized overlay networking tool designed to create secure, encrypted peer-to-peer connections between distributed hosts. By utilizing a certificate-based identity authority, it enables the construction of private communication fabrics across disparate physical infrastructures, such as multiple cloud providers or on-premises data centers, without requiring central authentication servers. The project distinguishes itself through a zero-trust architecture that enforces granular, policy-driven firewall filtering based on certificate-derived group memberships. It facili

Vibetunnel is a remote shell infrastructure project consisting of a headless terminal server, a remote shell manager, and a web-based terminal proxy. It provides the backend and connectivity tools necessary to execute processes on cloud instances and stream the resulting output to a web browser. The system distinguishes itself through secure tunneling connectivity and real-time terminal state synchronization. It uses encrypted tunnels to expose local shell environments to the internet and includes a terminal session recorder to capture activity in a playback-ready format for sharing and revie

This project is a containerized IPsec VPN server designed to provide secure remote network access. It functions as an IKEv2 VPN gateway, utilizing the StrongSwan daemon to manage security associations and establish encrypted tunnels between remote clients and a private network. The server acts as a certificate-based VPN manager, handling the generation and distribution of digital certificates and pre-shared keys to authenticate remote users. It includes tools for IKEv2 client management to automate the creation of configuration profiles and security keys for connecting devices. The system co

This project is a shell-based orchestration tool designed to automate the deployment and administration of WireGuard virtual private network servers on Linux hosts. It functions as a system-level networking utility that handles the installation of kernel modules, the configuration of secure tunnel interfaces, and the management of network routing rules to enable encrypted remote access. The tool provides an interactive command-line interface that simplifies the lifecycle management of network peers. It allows administrators to dynamically add or remove client access profiles, assign custom DN

Rathole is a high-performance reverse proxy and NAT traversal tool written in Rust. It functions as a secure tunneling server and client architecture designed to expose local services to the internet by forwarding traffic from a public IP to a private device behind a firewall. The system establishes encrypted tunnels between a public server and a private host to ensure private communication. It utilizes token-based authentication to validate identities between the server and client for each individual service. The project provides TCP and UDP port forwarding and manages private tunnels to fa

reGeorg is an HTTP tunneling proxy and network tunneling tool designed to route network traffic to internal targets. It functions as a remote port forwarder that wraps socket communication within HTTP requests to bypass firewalls. The tool includes a SOCKS5 proxy server implementation that converts tunneled traffic into a usable interface. This allows external networking tools to route data through a remote host into restricted internal network boundaries. The project provides capabilities for network pivoting, including generic network tunneling and SOCKS proxy configuration to facilitate c

Rathole is a reverse proxy tunneling tool designed to expose local services behind firewalls and network address translation to the public internet. It functions as a secure tunneling infrastructure that enables remote access to private network resources without requiring manual router port forwarding configurations. The system utilizes a client-server architecture where a public-facing gateway coordinates with a private-network agent. It distinguishes itself by multiplexing multiple logical service connections through a single persistent TCP stream, which reduces the overhead of maintaining

Shadowsocks-iOS is a proxy client for iOS devices that implements the Shadowsocks protocol to tunnel network traffic through a secure, encrypted relay. Its primary purpose is to route device traffic through a proxy server to bypass network censorship and regional restrictions. The project establishes secure proxy tunneling to protect data from local monitoring and hide internet activity. It manages iOS network traffic routing using custom encryption protocols to avoid network interference. The implementation utilizes a system-level network extension framework and a local virtual network inte

gost is a multi-protocol proxy tunnel and secure tunneling server designed to route network traffic through encrypted connections. It functions as a traffic obfuscation gateway and a transparent proxy server capable of intercepting TCP and UDP traffic at the IP level. The project also includes a virtual network interface manager for creating TUN and TAP devices to intercept operating system packets. The system distinguishes itself through a chain-based request routing model, allowing traffic to pass through an ordered sequence of proxy nodes. It provides extensive transport-layer encapsulatio

Pangolin is a zero-trust remote access platform designed to provide secure, identity-aware connectivity to private network resources. It functions as a cloud-native network controller that orchestrates encrypted tunnels, traffic routing, and access policies across distributed environments. By leveraging WireGuard for secure data transport, the platform enables authenticated access to internal web applications, terminal sessions, and remote desktops without exposing services to the public internet. The platform distinguishes itself through a declarative infrastructure model that synchronizes n

This project is a community-curated directory of open-source software designed for deployment in private server environments and home labs. It serves as a comprehensive resource for discovering independent, self-hosted alternatives to mainstream cloud services, enabling users to maintain full data ownership and control over their digital infrastructure. The directory is structured through a hierarchical taxonomy that organizes a vast collection of applications into logical categories, ranging from media management and data analytics to private communication and team productivity tools. It dis

Lets-chat is a self-hosted team communication platform and XMPP chat server designed for private messaging. It provides a containerized communication environment for small teams to exchange messages and files, featuring a programmable REST API for automating conversations and managing messages from external tools. The platform functions as an XMPP gateway and server, ensuring interoperability with other compliant messaging clients. It distinguishes itself by supporting enterprise identity management, allowing administrators to verify user identities through local accounts or external director

EasyTier is a decentralized peer-to-peer virtual private network and mesh networking tool. It functions as a layer 3 network overlay that establishes secure tunnels between devices without requiring a centralized server or coordinator. It also serves as a WireGuard-compatible VPN, capable of acting as a server for standard WireGuard clients. The project distinguishes itself through multipath latency-based routing and the use of KCP or QUIC proxies to mitigate packet loss and stabilize connections in high-loss environments. It provides a virtual networking manager featuring a web management co

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

Headscale is a self-hosted control plane for private mesh networking that enables the creation of secure, encrypted peer-to-peer networks. By acting as a centralized coordination server, it manages device authentication, cryptographic key exchange, and network topology, allowing distributed infrastructure to communicate without relying on third-party services. It implements a zero-trust security architecture, verifying device and user identity before granting access to internal resources. The project distinguishes itself by providing a fully independent, self-hosted alternative for managing n

This platform is an identity and access management suite designed to secure and coordinate digital identities for employees, customers, and automated agents. It functions as an enterprise authentication server, providing centralized single sign-on and multi-factor authentication capabilities to protect access across diverse internal and external applications. The engine operates through event-driven orchestration, triggering modular handlers to process authentication and authorization requests. The system is built on a Java-based middleware architecture that utilizes a dynamic component model

Dokploy is a self-hosted platform-as-a-service designed to simplify the deployment and management of containerized applications and databases. It provides a centralized control plane that decouples administrative management from application workloads, allowing users to oversee infrastructure across multiple server nodes through a unified web interface or a command-line tool. The platform distinguishes itself through an extensive library of pre-configured application templates, enabling the rapid deployment of databases, identity providers, and various productivity or development tools. It sup

Claude Code Templates is a comprehensive framework for orchestrating specialized AI agents and automating development workflows within local environments. It provides a structured system for defining, configuring, and deploying AI personas that handle specific technical tasks, ranging from backend architecture and frontend implementation to security auditing and infrastructure management. The project distinguishes itself through a configuration-driven approach that allows teams to standardize development environments and share reusable agent definitions across projects. It includes a robust C

Guides is a collection of standardized architectural guides and best practices for deploying containerized media servers and optimizing download clients. It provides documentation for setting up self-hosted media server environments, focusing on the integration of downloaders and media managers. The project centers on a hardlink storage architecture and a specific directory structure and volume mapping standard. This approach enables atomic moves to prevent data duplication across different media applications. The guides cover a broad range of capability areas, including media automation con

This project is a comprehensive technical documentation site and reference manual for configuring and deploying WireGuard VPN tunnels and interfaces. It serves as a guide for establishing encrypted network connections between peers using public key authentication to secure data traffic across untrusted networks. The documentation provides specific technical manuals for implementing NAT traversal solutions, including UDP hole punching and the use of bounce servers to connect peers behind restrictive firewalls. It also includes detailed guides on tunnel implementation and protocol references fo

This project is a V2Ray configuration repository that provides a collection of pre-configured server settings and connection strings. It serves as a curated set of remote proxy addresses and security metadata used to establish encrypted network tunnels for routing internet traffic. The project focuses on the distribution of Base64-encoded configuration strings, which allow for the retrieval and deployment of server settings to establish secure connections. It includes tools for latency benchmarking, measuring response times and pinging configuration links to filter and rank the most performan

Bore is a TCP tunneling tool and localhost exposure utility used to route local TCP ports to public IP addresses. It functions as a TCP port forwarder that makes services running on a local machine accessible over the internet via a remote listener. The project includes a secure tunnel server implementation that manages incoming connections and routes traffic to connected local clients. It utilizes shared secret handshakes to authorize tunnel creation and restrict access to authorized users. The system provides capabilities for firewall bypass networking and remote tunnel hosting. It manages

WireGuard Manager is a system orchestration tool designed to automate the deployment, configuration, and lifecycle management of virtual private network infrastructure. It functions by translating high-level user intent into precise, declarative system configurations, managing kernel-level network interfaces, and enforcing firewall-based traffic control to ensure secure, isolated network routing. The project distinguishes itself by providing a centralized web-based management interface that abstracts the complexity of manual configuration files. It includes comprehensive administrative tools

Cloak is a set of censorship circumvention tools designed for secure proxy tunneling and internet traffic obfuscation. It focuses on bypassing restrictive firewalls and state surveillance by disguising proxy connections as standard web browsing. The project utilizes HTTP fingerprint masquerading to imitate common browser signatures and routes traffic through content delivery networks to mask the identity of the origin server. To further hide the server's purpose, it includes a mechanism to redirect unauthenticated connection requests to a third-party website. The system implements transport

This project is a bash-based installation script and deployer used to automate the setup and configuration of an OpenVPN server on Linux systems. It provides a guided setup process for deploying virtual private network software across various Debian and Red Hat based distributions. The tool functions as a user management interface, allowing for the creation, removal, and administration of client profiles and the security credentials required for network access. It orchestrates the deployment of secure tunnels to enable remote network access to private environments. The system manages the ins