Curious question, why pay for Ngrok when so many free and open source alternatives exist? https://github.com/anderspitman/awesome-tunneling
In Ask HN: What software do you pay for monthly?anderspitman
awesome-tunneling
Python2020–2026
anderspitman / awesome-tunneling
awesome-tunneling
List of ngrok, Cloudflare Tunnel, Tailscale, and ZeroTier alternatives and other tunneling software and services. Focus on self-hosting.
41Distinct people
130Mentions
3Explicit recommenders
22KGitHub stars
What to know before exploring
What it is
List of ngrok, Cloudflare Tunnel, Tailscale, and ZeroTier alternatives and other tunneling software and services. Focus on self-hosting.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
Honestly I really agree with this use case and I even created a point asking for some browser like this but one which is more capable than even browsh perhaps, I am not sure if…
Imustaskforhelp used a recommendation phrase. 5 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:59:58 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year130 dated mentions
Observed mentions: 2020-09-17 19:02:23 UTC to 2026-09-18 16:00:42 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 8 | 2 | 6 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 11 | 0 | 11 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 31 | 2 | 29 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 24 | 0 | 24 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 23 | 0 | 23 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 18 | 3 | 15 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 15 | 1 | 14 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
UPDATE 2026-09-28: Official policy for adding non-open source/commercial services to the list: you must provide some evidence of existing customers that are happy with your product. Google reviews, 100+ GitHub stars, etc. If you are commercial but primarily B2B, you can also have a reputable business that is a customer send me an email vouching for your product. Decisions will still be case-by-case, but I try to be reasonable.
UPDATE 2026-08-10: I did a lot of backlog cleanup over the weekend. I used AI to help with automation and write comments, but I tried to make all the yes/no decisions myself. Some things almost certainly slipped through the cracks. If you feel your issue/PR was closed in error, please comment so I can take a closer look.
UPDATE 2026-02-16: Given the sensitive nature of tunneling tools, I'm going to start requiring at least 100 GitHub stars on any new additions. Projects not hosted on GitHub and commercial offerings will be handled case-by-case. Feel free to open an issue if you see a problem with this policy.
What is this list for
The purpose of this list is to track and compare tunneling solutions. This is
primarily targeted toward self-hosters and developers who want to do things
like exposing a local webserver via a public domain name, with automatic HTTPS,
even if behind a NAT or other restricted network.
The dream
I started this list because I'm looking for a simple tool/service that does the
following:
Allows me to register a domain name and automatically points the records at
the server running the tunnels.
Automatically sets up and manages HTTPS certificates (apex and subdomains)
for the domain.
Provides a client tool that tunnels HTTP/TCP connections through the server
without requiring root on the client.
Provides a simple GUI interface to allow me to map X domain/subdomain to Y port
on Z client, and proxy all connections to that domain.
So far I haven't found a tool that does all of this. In particular, while some
of them can do automatic certs through Let's Encrypt, none of them integrate
the domain registration and DNS management in a simple way.
Recommendations
For most people, I currently recommend Cloudflare Tunnel. Although it's closed source, this is the production-quality service that gets the closest to achieving the dream. It's also a loss-leader for Cloudflare's other products which means they can offer it for free.
If you want to self-host, there are many options. For something production ready I would look at Pangolin or frp. If you're a developer and want something very simple, I'd recommend starting with my own SirTunnel project and modifying it for your needs.
Open source (at least with a reasonably permissive license)
Telebit - Written in JS. Code.
tunnel.pyjam.as - No custom client; uses WireGuard directly instead. Written in Python. source code
SSH-J.com - Public SSH Jump & Port Forwarding server. No software, no registration, just an anonymous SSH server for forwarding. Users are encouraged to use it for SSH exposure only, to preserve end-to-end encryption. No public ports, only in-SSH connectivity. Run ssh ssh-j.com and it will display usage information.
Greenhouse - Instant least-authority port-forwarding with automatic HTTPS; the authors "really don't want your TLS private keys." The hosted service (greenhouse.server.garden) is currently unavailable and the project appears unmaintained (last activity 2023).
frp - Comprehensive open alternative to ngrok. Supports UDP, and has a P2P mode. Supports multiplexing over TCP (single connection or pool), QUIC, and KCP.
ngrok 1.0 - Original version of ngrok. No longer developed in favor of the commercial 2.0 version.
Pangolin - Fully self-hostable tunneled reverse proxy management server with identity and access control, automated SSL certificates, and dashboard UI.
localtunnel/localtunnel - Written in node. Popular suggestion.
chisel - SSH under the hood, but still uses a custom client binary. Supports auto certs from LetsEncrypt. Written in Go.
rathole - Similar to frp, including the config format, but with improved performance. Low resource consumption. Hot reload. Written in Rust.
sshuttle - Open source project originally from one of the founders of Tailscale. Server doesn't require root; client does. Explicitly designed to avoid TCP-over-TCP issues.
bore - Minimal tunneling solution. MIT Licensed. Written in Rust.
gost - Looks like a comprehensive option. TCP and UDP tunneling. TAP/TUN devices. Load balancing. Web API. Written in Go.
tunnelto - Open source (MIT). Written in Rust.
wstunnel - Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Rust with executables provided.
zrok - Aims for effortless sharing both publicly and privately. Supports multiple types of resources, including HTTP endpoints and files. Built on OpenZiti (see overlay section below). Apache 2 License. Written in Go.
sish - Open source ngrok/serveo alternative. SSH-based but uses a custom server written in Go. Supports WebSocket tunneling.
expose - ngrok alternative written in PHP.
pgrok/pgrok - A multi-tenant HTTP reverse tunnel solution through SSH remote port forwarding.
go-http-tunnel - Uses a single HTTP/2 connection for muxing. Need to manually generate certs for server and clients.
progrium/localtunnel - As far as I know this is the first ever tool of this kind, predating ngrok and the other localtunnel. No longer maintained, but here for posterity. MIT License. Written in Go.
portr - Has a JavaScript/Python admin page and request inspection/replay features. AGPL-3.0 License. Tunneling implemented in Go.
piko - Piko is an open-source alternative to Ngrok, designed to serve production traffic and be simple to host (particularly on Kubernetes). MIT License. Written in Go.
gsocket/Global Socket - The Global Socket Toolkit allows two users behind NAT/Firewall to establish a TCP connection with each other. Securely. Written in C.
Tunnel
Read the full README on GitHubWhat Hacker News says
24 sourcesWe have a section for overlay networks on the tunneling list[0] I maintain. This is a very interesting space with some excellent software.
I certainly have my gripes about the closed nature of Slack itself, in particular using a closed protocol when the model is clearly "federated" between multiple servers internally. That said, the contribution of something on the scale and quality of Nebula back to the open source community is hard to argue with.
[0]: https://github.com/anderspitman/awesome-tunneling#overlay-ne...
In Would we still create Nebula today?Is this materially different from the alternatives?
https://github.com/anderspitman/awesome-tunneling
In Localtunnel – Easily share a web service on your local development machineThe author talked about this a few months ago on Tim Ferriss' podcast[0]. One of my favorite episodes.
I'm passionate[1] about the concept but articles like this are a reminder to me that we need to make self hosting an order of magnitude simpler and accessible to more people. It shouldn't need to involve any CLI, DNS, TLS certs, port forwarding/NAT traversal, IP addresses, etc etc.
Self hosting shouldn't be any more difficult or less secure than installing an app on your phone. The flow should be 1) install the "self hosting app" on an old laptop or phone. 2) Go through a quick OAuth2 flow to connect your app to a tunnel that enables inbound traffic. 3) Use the self hosting app to install other apps like Jellyfin, Calendar, Nextcloud, etc. Everything should be sandboxed (containers work pretty well on Linux and Windows 10/11 via WSL2) an
Read the rest
d secure by default. Automatic backups (ideally an OAuth2 flow to your friends' self hosted installations) and auto app updates are table stakes.
There's no technical reason this can't all be done, but lots of technical challenges, and it's unclear whether anyone will pay for tunnels. I'm currently trying to figure out how to do reliable auto backups without filesystem snapshots.
[0]: https://youtu.be/0BaDQCjqUHU?si=0wDf-2RH-u9vdm3g&t=1380
[1]: https://github.com/anderspitman/awesome-tunneling
Lots of alternatives to Ngrok and Cloudflare - https://github.com/anderspitman/awesome-tunneling. What we need is more open source and permissives ones which are well maintained and easy to use. fwiw, I work on one in the list called zrok.io, its open source and we have a free SaaS version.
I dont think (as the author suggests) that IPv6 everywhere is happening anytime soon.
In Every phone should be able to run personal websitesI'm a big proponent of this idea. Unfortunately IPv6 alone isn't enough, due to firewalls. It's just not realistic for the average person to be expected to set up port forwarding etc. Now, if something like UPnP was universally deployed alongside IPv6, that would pretty much do it.
Personally, I think the future of self hosting is going to happen through IPv4 tunnels[0] with SNI routing. You also get the added benefit of not exposing your actual IP address, and dealing with things like DDoS become the tunnel provider's concern.
[0]: https://github.com/anderspitman/awesome-tunneling
In Every phone should be able to run personal websitesHere's a list of alternatives and related projects:
https://github.com/anderspitman/awesome-tunneling
In Tailscale vs. NarrowlinkThe internet is no longer as peer-to-peer friendly as it once was. Hence the existence of commercially-motivated hacks run by third parties such as hosting, e.g., Cloudflare, etc., including tunneling, e.g., ngrok, etc. Alternatively, Tor relies on third parties but AFAIK it's not so centralised and it's not commercially-motivated.
That is what differentiates it from all the other options. There is no company behind it trying to make money by exploiting internet subscribers trying to connect with each other (not the so-called "tech" company).
Tor can have uses other than the ones normally discussed such as anonymity and evading censorship. Tor can provide reachability without use of commercial eavesdropping third party intermediaries.
For example, one can use Onion Services for advertising open IP:port information that is needed for p
Read the rest
eer-to-peer connections over other, faster peer-to-peer overlay networks, not the Tor network. The Onion Service can function as the "rendezvous" server for making peer-to-peer connection outside of Tor. Tor's Onion Services can be used to exchange IP:port information for making direct connections over the internet without using Tor. No need to use commercial third parties. Ngrok, Tailscale, etc. all require use of servers run by a commercial third party. Tor does not. There is ample free software that can establish peer-to-peer connections over the internet but in every case it requires some reachable server running this software on the internet, and for most users that means they have to run a server and pay a commercial third party for hosting. Tor has no such requirement.
Imagine being able to share content with family, friends, colleagues without the need for so-called "tech" companies^1 acting as intermediaries ("middlemen"). With a reachable IPv4 address this becomes possible. It would be nice if every home internet access subscriber received a reachable IPv4 address from their ISP. No doubt, some do. But on today's internet most do not. The so-called "tech" companies all have reachable IPv4 addresses. Hence they assume the roles of middlemen and use this position to exploit internet subscribers for profit.
Something like Tor provides a solution. Again, it is not always necessary to route all traffic over Tor. Tor can have other uses. When the goal is simply peer-to-peer connections, Onion Services can be used to bootstrap peer-to-peer overlay connections using the user's choice of software by providing a secure, reliable way to exchange IP:port information. Goal here when using Tor is not anonymity nor censorship evasion, it's reachability. Similarly, goal of peer-to-peer is not necessarily anonymity nor evading censorship either, it's bypassing commercially-motivated, eavesdropping middlemen known as "tech" companies, and avoiding the annoyances of advertising. A possible additional benefot of using Tor in this way is elevated privacy. Google, for example, cannot easily discover Onion Services. No one can discover Onion Services using ICANN DNS.
1. The term "tech" as in "tech company" means a company, usually a website, that collects data from and about people to support the sale of advertising services because advertising services are the only services the company can sell on a scale large enough to sustain a profitable business.
More reading/viewing:
https://github.com/anderspitman/awesome-tunneling
Tor Hidden Services (now called "Onion Services")
https://jamielittle.org/2016/08/28/hidden.html
As one author wrote on Github:
"onion-expose is a utility that allows one to easily create and control temporary Tor onion services.
onion-expose can be used for any sort of TCP traffic, from simple HTTP to Internet radio to Minecraft to SSH servers. It can also be used to expose individual files and allow you to request them from another computer.
Why not just use ngrok?
ngrok is nice. But it requires everything to go through a central authority (a potential security issue), and imposes artificial restrictions, such as a limit of one TCP tunnel per user. It also doesn't allow you to expose files easily (you have to set it up yourself)."
https://github.com/ethan2-0/onion-expose
As another Github contributor put it:
"With onionpipe, that service doesn't need a public IPv4 or IPv6 ingress. You can publish services with a globally-unique persistent onion address, and share access securely and privately to your own allowlist of authorized keys.
You don't need to rely on, and share your personal data with for-profit services (like Tailscale, ZeroTier, etc.) to get to it."
https://github.com/cmars/onionpipe
https://news.ycombinator.com/item?id=36734956
https://news.ycombinator.com/item?id=30445421
https://news.ycombinator.com/item?id=29929399
"Finally, onion services are private by default, meaning that users must discover these sites organically, rather than with a search engine." [Small websites with small audiences get buried by advertising-supported search engines anyway.]
https://nymity.ch/onion-services/pdf/sec18-onion-services.pd...
https://media.ccc.de/v/31c3_-_6112_-_en_-_saal_2_-_201412301...
https://wiki.termux.com/wiki/Bypassing_NAT (Termux recommends Tor over Ngrok)
https://github.com/ajvb/awesome-tor
Fyi there are plenty of commercial/foss solutions in this sort of "port forwarding service" space https://github.com/anderspitman/awesome-tunneling
In Removing support for forwarded portsDocker Desktop provides some compelling options for lowering the barrier of entry for selfhosting. Today you can take a Windows laptop and run just about any Linux service, with pretty fast networking and host disk access. No CLI experience required. The only major missing piece is inbound networking from the internet. Tunneling[0] is my preferred solution to that problem. Or if you don't want to expose your services to the internet there's already a Tailscale extension[1].
It's exciting and important to have an open source alternative in this space.
[0]: https://github.com/anderspitman/awesome-tunneling
[1]: https://tailscale.com/blog/docker/
In Podman Desktop 1.0Cloudflare Tunnel is a great service, but if you're looking for selfhosted alternatives I maintain a list here:
https://github.com/anderspitman/awesome-tunneling
In Tunnel via Cloudflare to any TCP serviceI maintain a list of tunneling solutions[0]. One of the main reasons people choose not to use Cloudflare Tunnel for selfhosting is because technically hosting non-HTML content has been against their ToS. Anyone know if this change affects tunnels?
[0]: https://github.com/anderspitman/awesome-tunneling
In Goodbye, section 2.8 and hello to Cloudflare’s new terms of serviceImagine this but instead of needing any CLI skills, you just install a "blog" app on the phone, do a quick OAuth2 flow with your domain provider[0] to connect a domain through a tunnel, and you're ready to start posting. This is essentially my vision of the future of selfhosting. We have a lot of work to do, but the technology is all there.
Also, if you're looking for similar tools to pinggy, I maintain a list here[1].
[0]: https://takingnames.io/blog/introducing-takingnames-io
[1]: https://github.com/anderspitman/awesome-tunneling/
In This blog is hosted on my Android phoneSpoiler alert, your cynacism is not misplaced. Its also a very short list, there are a whole bunch more, just check out https://github.com/anderspitman/awesome-tunneling. For example, I work on the project behind zrok.io, I am biased but I also think its a better alternative to ngrok.
In [dead]I see.. it's bit confusing, since there's an existing project in the same space (https://github.com/jerson/pgrok). It's even linked on the project above via the awesome https://github.com/anderspitman/awesome-tunneling list, I don't know why this is necessary.
In Pgrok – Poor Man’s NgrokShowing the 15 most recent of 24 sources. Enable JavaScript to search and browse every indexed mention.