awesome-tunneling

UPDATE 2026-09-28: Official policy for adding non-open source/commercial services to the list: you must provide some evidence of existing customers that are happy with your product. Google reviews, 100+ GitHub stars, etc. If you are commercial but primarily B2B, you can also have a reputable business that is a customer send me an email vouching for your product. Decisions will still be case-by-case, but I try to be reasonable. UPDATE 2026-08-10: I did a lot of backlog cleanup over the weekend. I used AI to help with automation and write comments, but I tried to make all the yes/no decisions myself. Some things almost certainly slipped through the cracks. If you feel your issue/PR was closed in error, please comment so I can take a closer look. UPDATE 2026-02-16: Given the sensitive nature of tunneling tools, I'm going to start requiring at least 100 GitHub stars on any new additions. Projects not hosted on GitHub and commercial offerings will be handled case-by-case. Feel free to open an issue if you see a problem with this policy. What is this list for The purpose of this list is to track and compare tunneling solutions. This is primarily targeted toward self-hosters and developers who want to do things like exposing a local webserver via a public domain name, with automatic HTTPS, even if behind a NAT or other restricted network. The dream I started this list because I'm looking for a simple tool/service that does the following: Allows me to register a domain name and automatically points the records at the server running the tunnels. Automatically sets up and manages HTTPS certificates (apex and subdomains) for the domain. Provides a client tool that tunnels HTTP/TCP connections through the server without requiring root on the client. Provides a simple GUI interface to allow me to map X domain/subdomain to Y port on Z client, and proxy all connections to that domain. So far I haven't found a tool that does all of this. In particular, while some of them can do automatic certs through Let's Encrypt, none of them integrate the domain registration and DNS management in a simple way. Recommendations For most people, I currently recommend Cloudflare Tunnel. Although it's closed source, this is the production-quality service that gets the closest to achieving the dream. It's also a loss-leader for Cloudflare's other products which means they can offer it for free. If you want to self-host, there are many options. For something production ready I would look at Pangolin or frp. If you're a developer and want something very simple, I'd recommend starting with my own SirTunnel project and modifying it for your needs. Open source (at least with a reasonably permissive license) Telebit - Written in JS. Code. tunnel.pyjam.as - No custom client; uses WireGuard directly instead. Written in Python. source code SSH-J.com - Public SSH Jump & Port Forwarding server. No software, no registration, just an anonymous SSH server for forwarding. Users are encouraged to use it for SSH exposure only, to preserve end-to-end encryption. No public ports, only in-SSH connectivity. Run ssh ssh-j.com and it will display usage information. Greenhouse - Instant least-authority port-forwarding with automatic HTTPS; the authors "really don't want your TLS private keys." The hosted service (greenhouse.server.garden) is currently unavailable and the project appears unmaintained (last activity 2023). frp - Comprehensive open alternative to ngrok. Supports UDP, and has a P2P mode. Supports multiplexing over TCP (single connection or pool), QUIC, and KCP. ngrok 1.0 - Original version of ngrok. No longer developed in favor of the commercial 2.0 version. Pangolin - Fully self-hostable tunneled reverse proxy management server with identity and access control, automated SSL certificates, and dashboard UI. localtunnel/localtunnel - Written in node. Popular suggestion. chisel - SSH under the hood, but still uses a custom client binary. Supports auto certs from LetsEncrypt. Written in Go. rathole - Similar to frp, including the config format, but with improved performance. Low resource consumption. Hot reload. Written in Rust. sshuttle - Open source project originally from one of the founders of Tailscale. Server doesn't require root; client does. Explicitly designed to avoid TCP-over-TCP issues. bore - Minimal tunneling solution. MIT Licensed. Written in Rust. gost - Looks like a comprehensive option. TCP and UDP tunneling. TAP/TUN devices. Load balancing. Web API. Written in Go. tunnelto - Open source (MIT). Written in Rust. wstunnel - Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Rust with executables provided. zrok - Aims for effortless sharing both publicly and privately. Supports multiple types of resources, including HTTP endpoints and files. Built on OpenZiti (see overlay section below). Apache 2 License. Written in Go. sish - Open source ngrok/serveo alternative. SSH-based but uses a custom server written in Go. Supports WebSocket tunneling. expose - ngrok alternative written in PHP. pgrok/pgrok - A multi-tenant HTTP reverse tunnel solution through SSH remote port forwarding. go-http-tunnel - Uses a single HTTP/2 connection for muxing. Need to manually generate certs for server and clients. progrium/localtunnel - As far as I know this is the first ever tool of this kind, predating ngrok and the other localtunnel. No longer maintained, but here for posterity. MIT License. Written in Go. portr - Has a JavaScript/Python admin page and request inspection/replay features. AGPL-3.0 License. Tunneling implemented in Go. piko - Piko is an open-source alternative to Ngrok, designed to serve production traffic and be simple to host (particularly on Kubernetes). MIT License. Written in Go. gsocket/Global Socket - The Global Socket Toolkit allows two users behind NAT/Firewall to establish a TCP connection with each other. Securely. Written in C. Tunnel