kopia lustrzana https://github.com/anderspitman/awesome-tunneling
110 wiersze
14 KiB
Markdown
110 wiersze
14 KiB
Markdown
The purpose of this list is to track and compare tunneling solutions. This is
|
|
primarily targeted toward self-hosters and developers who want to do things
|
|
like exposing a local webserver via a public domain name, with automatic HTTPS,
|
|
even if behind a NAT or other restricted network.
|
|
|
|
# The dream (Sep 2020)
|
|
|
|
I started this list because I'm looking for a simple tool/service that does the
|
|
following:
|
|
|
|
* Allows me to register a domain name and automatically points the records at
|
|
the server running the tunnels.
|
|
* Automatically sets up and manages HTTPS certificates (apex and subdomains)
|
|
for the domain.
|
|
* Provides a client tool that tunnels HTTP/TCP connections through the server
|
|
without requiring root on the client.
|
|
* Provides a simple GUI interface to allow me to map X domain/subdomain to Y port
|
|
on Z client, and proxy all connections to that domain.
|
|
|
|
~~So far I haven't found a tool that does all of this. In particular, while some
|
|
of them can do automatic certs through Lets's Encrypt, none of them integrate
|
|
the domain registration and DNS management.~~
|
|
|
|
## UPDATE (Jan 2022)
|
|
|
|
Since starting this list, things have changed considerably.
|
|
First, Cloudflare Argo Tunnel was renamed to [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup)
|
|
and changed to a free product. Cloudflare also launched their [domain registrar](https://www.cloudflare.com/products/registrar/).
|
|
If you're looking for a simple production-quality tunneling solution, Cloudflare is
|
|
what I recommend for most people today. It doesn't provide a GUI for managing
|
|
tunnels, and you have to trust Cloudflare with your data, but it's a very
|
|
good product.
|
|
|
|
That said, at the same time Cloudflare was making these changes, I started
|
|
two projects of my own: [boringproxy](https://boringproxy.io/), an open
|
|
source, end-to-end encrypted tunneling system, and [TakingNames.io](https://takingnames.io/blog/introducing-takingnames-io),
|
|
a domain name provider designed for self-hosters and based on open protocols.
|
|
Now that it's integrated with TakingNames.io, boringproxy checks all the boxes
|
|
on the list above.
|
|
|
|
Maintenance of this list is now also sponsored by TakingNames.io.
|
|
|
|
<a href='https://takingnames.io/blog/introducing-takingnames-io'>
|
|
<img src='https://user-images.githubusercontent.com/7820200/148330003-5f8062ff-22b2-423d-b945-3db87abf10e5.png' width='400'></img>
|
|
</a>
|
|
|
|
|
|
# Open source (at least with a reasonably permissive license)
|
|
|
|
* [frp](https://github.com/fatedier/frp) [](https://github.com/fatedier/frp/stargazers) - Comprehensive open alternative to ngrok. Supports UDP, and has a P2P mode. I believe it uses a custom TCP protocol for multiplexing, which can either run over a single TCP connection or a connection pool.
|
|
* [ngrok 1.0](https://github.com/inconshreveable/ngrok) [](https://github.com/inconshreveable/ngrok/stargazers) - Original version of ngrok. No longer developed in favor of the commercial 2.0 version.
|
|
* [localtunnel](https://github.com/localtunnel) [](https://github.com/localtunnel/localtunnel/stargazers) - Written in node. Popular suggestion.
|
|
* [Nebula](https://github.com/slackhq/nebula) - [](https://github.com/zerotier/slackhq/nebula) Peer-to-peer overlay network. Developed and used internally by Slack. Similar to Tailscale but completely open source. Written in Go.
|
|
* [ZeroTier](https://www.zerotier.com/) - [](https://github.com/zerotier/ZeroTierOne/stargazers) Layer 2 overlay network.
|
|
* [sshuttle](https://github.com/sshuttle/sshuttle) [](https://github.com/sshuttle/sshuttle/stargazers) - Open source project originally from one of the founders of Tailscale. Server doesn't require root; client does. Explicitly designed to avoid TCP-over-TCP issues.
|
|
* [chisel](https://github.com/jpillora/chisel) [](https://github.com/jpillora/chisel/stargazers) - SSH under the hood, but still uses a custom client binary. Supports auto certs from LetsEncrypt. Written in Go.
|
|
* [expose](https://github.com/beyondcode/expose) [](https://github.com/beyondcode/expose/stargazers) - ngrok alternative written in PHP.
|
|
* [Pritunl](https://pritunl.com/) [](https://github.com/pritunl/pritunl/stargazers) - Seems quite comprehensive and complicated. OpenVPN, WireGuard, and IPSec support.
|
|
* [teleconsole](https://www.teleconsole.com/) [](https://github.com/gravitational/teleconsole/stargazers) - SSH-based, but uses special client script. Focused on forwarding SSH console sessions, but can also forward ports.
|
|
* [go-http-tunnel](https://github.com/mmatczuk/go-http-tunnel) [](https://github.com/mmatczuk/go-http-tunnel/stargazers) - Uses a single HTTP/2 connection for muxing. Need to manually generate certs for server and clients.
|
|
* [sish](https://github.com/antoniomika/sish) [](https://github.com/antoniomika/sish/stargazers) - Open source ngrok/serveo alternative. SSH-based but uses a custom server written in Go. Supports WebSocket tunneling.
|
|
* [rathole](https://github.com/rapiz1/rathole) [](https://github.com/rapiz1/rathole/stargazers) - Similar to frp, including the config format, but with improved performance. Low resource consumption. Hot reload. Written in Rust.
|
|
* [tunnelto](https://tunnelto.dev/) [](https://github.com/agrinman/tunnelto/stargazers) - Open source (MIT). Written in Rust.
|
|
* [wstunnel](https://github.com/erebe/wstunnel) [](https://github.com/erebe/wstunnel/stargazers) - Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Haskell with executables provided.
|
|
* [PageKite](https://pagekite.net/) [](https://github.com/pagekite/PyPagekite/stargazers) - Comprehensive open source solution with hosted options.
|
|
* [Crowbar](https://github.com/q3k/crowbar) [](https://github.com/q3k/crowbar/stargazers) - Tunnels TCP connections over HTTP GET and POST requests.
|
|
* [tunneller](https://github.com/skx/tunneller) [](https://github.com/skx/tunneller/stargazers) - Open source. Written in Go.
|
|
* [jprq](https://github.com/azimjohn/jprq) [](https://github.com/azimjohn/jprq/stargazers) - Proxies over WebSockets. Written in Python.
|
|
* [boringproxy](https://boringproxy.io/) [](https://github.com/boringproxy/boringproxy/stargazers) - Designed to be very easy to use. No config files. Clients can be remote-controlled through a simple WebUI and/or REST API on the server.
|
|
* [tunnel](https://github.com/koding/tunnel) [](https://github.com/koding/tunnel/stargazers) - This one is a Golang library, not a program you can just run. However, it looks easy to use for creating custom solutions. Uses a single TCP socket, and [yamux](https://github.com/hashicorp/yamux) for multiplexing.
|
|
* [pgrok](https://www.proxy.jetzt/) [](https://github.com/jerson/pgrok/stargazers) - Fork of ngrok 1.0, with more recent commits.
|
|
* [SirTunnel](https://github.com/anderspitman/SirTunnel) [](https://github.com/anderspitman/SirTunnel/stargazers) - Minimal, self-hosted, 0-config alternative to ngrok. Similar to sish but leverages Caddy+OpenSSH rather than custom server code.
|
|
* [docker-tunnel](https://github.com/vitobotta/docker-tunnel) [](https://github.com/vitobotta/docker-tunnel/stargazers) - Simple Docker-based nginx+SSH solution.
|
|
* [remotemoe](https://github.com/fasmide/remotemoe) [](https://github.com/fasmide/remotemoe/stargazers) - SSH-based, with custom golang server. Does some cool unique things. Instead of just plain tunnels, it drops you into a basic CLI UI that offers several useful commands interactively, such as adding a custom hostname. Also allows end-to-end encryption for both HTTPS and upstream SSH. Doesn't appear to offer non-e2e HTTPS, ie no auto Let's Encrypt support.
|
|
* [holepunch.io](https://holepunch.io) [](https://github.com/CypherpunkArmory/holepunch/stargazers) - Has nice hosted solution. Uses SSH for muxing.
|
|
* [StaqLab Tunnel](https://tunnel.staqlab.com/) [](https://github.com/abhishekq61/tunnel-client/stargazers) - SSH-based. Client is open source. Server doesn't appear to be.
|
|
* [tnnlink](https://github.com/LiljebergXYZ/tnnlink) [](https://github.com/LiljebergXYZ/tnnlink/stargazers) - SSH-based. Golang. Not maintained.
|
|
* [Telebit](https://telebit.cloud/) - Written in JS. [Code](https://git.coolaj86.com/coolaj86/telebit.js).
|
|
* [SSH-J.com](https://bitbucket.org/ValdikSS/dropbear-sshj/) - Public SSH Jump & Port Forwarding server. No software, no registration, just an anonymous SSH server for forwarding. Users are encouraged to use it for SSH exposure only, to preserve end-to-end encryption. No public ports, only in-SSH connectivity. Run `ssh ssh-j.com` and it will display usage information.
|
|
* [Ngrok-operator](https://github.com/zufardhiyaulhaq/ngrok-operator) - Ngrok but integrated with Kubernetes, allows developers on private kubernetes to easily access their services via Ngrok.
|
|
|
|
# Commercial/Closed source
|
|
|
|
* [ngrok 2.0](https://ngrok.com/) - Probably the gold standard and most popular. Closed source. Lots of features, including TLS and TCP tunnels. Doesn't require root to run client.
|
|
* [CloudFlare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup) - Excellent free option. Nicely integrates tunneling with the rest of Cloudflare's products, which include DNS and auto HTTPS. Client source code is [available](https://github.com/cloudflare/cloudflared).
|
|
* [Tailscale](https://www.tailscale.com/) [](https://github.com/tailscale/tailscale/stargazers) - Built on WireGuard. Easy to use. Doesn't include an HTTPS proxy on the public side, but could be combined with nginx/Caddy/etc. Client [code](https://github.com/tailscale) available with a BSD3 license + separate patents file.
|
|
* [Loophole](https://loophole.cloud/) - Offers end-to-end TLS encryption with the client automatically getting certs from Let's Encrypt. QR codes for URL sharing. Client is open source. Can serve a local directory over WebDAV. MIT License. Written in Go.
|
|
* [localhost.run](https://localhost.run/) - Simple hosted SSH option. Supports custom domains for a cost.
|
|
* [Packetriot](https://packetriot.com) - Comprehensive alternative to ngrok. HTTP Inspector, Let's Encrypt integration, doesn't require root and Linux repos for apt, yum and dnf. Enterprise licenses and self-hosted option.
|
|
* [Hoppy](https://hoppy.network/) - WireGuard-based. Provides static IPv4 and IPv6 addresses for your machines, which is a simple and useful level of abstraction. Targeted towards self-hosters and people behind NATs.
|
|
* [gw.run](https://gw.run/) - Specifically focusing on securely exposing internal web apps to a group of people; not for publicly facing apps. Share access via email address then allow users to log in with common login providers like Google.
|
|
* [SSHReach.me](https://sshreach.me/) - Paid SSH-based option. Uses a simple python script.
|
|
* [KubeSail](https://kubesail.com/) - Company offering tunneling, dynamic DNS, and other services for self-hosting with Kubernetes.
|
|
* [inlets](https://inlets.dev/) - Used to be [open source](https://github.com/inlets/inlets-archived); now focused on a polished commercial offering. Designed to work well with Kubernetes.
|
|
* [LocalToNet](https://localtonet.com/) - Supports UDP. Free for a single tunnel. Paid supports custom domains.
|
|
|
|
# Reference
|
|
|
|
* [Roll your own Ngrok with Nginx, Letsencrypt, and SSH reverse tunnelling](https://jerrington.me/posts/2019-01-29-self-hosted-ngrok.html)
|
|
* [Poor man's ngrok with tcp proxy and ssh reverse tunnel](https://dev.to/k4ml/poor-man-ngrok-with-tcp-proxy-and-ssh-reverse-tunnel-1fm)
|
|
* [How I built Ngrok Alternative (jprq)](https://dev.to/azimjohn/how-i-built-ngrok-alternative-3n0g)
|
|
* [Great SO answer by AJ ONeal about how these things work](https://stackoverflow.com/a/52614266/943814)
|
|
* [Talk by AJ ONeal about tunneling tech](https://youtu.be/E1Q2MWGCADo)
|
|
* [ngrok alternative: localtunnel + Caddy + Lets Encrypt](https://morph027.gitlab.io/blog/localtunnel-ngrok/)
|
|
|
|
|
|
# Discussions
|
|
|
|
* [HN comment about needing Namecheap + CloudFlare + ngrok](https://news.ycombinator.com/item?id=24475946).
|