11 KiB
The purpose of this list is to track and compare tunneling solutions. This is primarily targeted toward self-hosters and developers who want to do things like exposing a local webserver via a public domain name, with automatic HTTPS, even if behind a NAT or other restricted network.
The dream
I started this list because I'm looking for a simple tool/service that does the following:
- Allows me to register a domain name and automatically points the records at the server running the tunnels.
- Automatically sets up and manages HTTPS certificates (apex and subdomains) for the domain.
- Provides a client tool that tunnels HTTP/TCP connections through the server without requiring root on the client.
- Provides a simple GUI interface to allow me to map X domain/subdomain to Y port on Z client, and proxy all connections to that domain.
So far I haven't found a tool that does all of this. In particular, while some of them can do automatic certs through Lets's Encrypt, none of them integrate the domain registration and DNS management.
UPDATE: boringproxy is my take on a solution to this problem. It's in beta but currently solves everything above except auto DNS management, and that's planned.
Open source (at least with a reasonably permissive license)
-
pgrok - Fork from ngrok 1.0 work very well ngrok. Download the release from github and look in this website to see how to work.
-
frp
- Seems to be a pretty comprehensive open alternative to ngrok.
-
ngrok 1.0
- Original version of ngrok. No longer developed in favor of the commercial 2.0 version.
-
localtunnel
- Written in node. Popular suggestion.
-
inlets
- Open source ngrok alternative. Has pro option.
-
sshuttle
- Open source project originally from one of the founders of Tailscale. Server doesn't require root; client does. Explicitly designed to avoid TCP-over-TCP issues.
-
ZeroTier -
Layer 2 overlay network.
-
chisel
- SSH under the hood, but still uses a custom client binary. Supports auto certs from LetsEncrypt.
-
expose
- ngrok alternative written in PHP.
-
Pritunl
- Seems quite comprehensive and complicated. OpenVPN, WireGuard, and IPSec support.
-
teleconsole
- SSH-based, but uses special client script. Focused on forwarding SSH console sessions, but can also forward ports.
-
go-http-tunnel
- Uses a single HTTP/2 connection for muxing. Need to manually generate certs for server and clients.
-
sish
- Open source ngrok/serveo alternative. SSH-based but uses a custom server written in Go. Supports WebSocket tunneling.
-
tunnelto
- Open core (MIT). Written in Rust.
-
wstunnel
- Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Haskell with executables provided.
-
PageKite
- Comprehensive open source solution with hosted options.
-
Crowbar
- Tunnels TCP connections over HTTP GET and POST requests.
-
tunneller
- Open source. Written in Go.
-
jprq
- Proxies over WebSockets. Written in Python.
-
docker-tunnel
- Simple Docker-based nginx+SSH solution.
-
boringproxy
- Designed to be very easy to use. No config files. Clients can be remote-controlled through a simple WebUI and/or REST API on the server.
-
remotemoe
- SSH-based, with custom golang server. Does some cool unique things. Instead of just plain tunnels, it drops you into a basic CLI UI that offers several useful commands interactively, such as adding a custom hostname. Also allows end-to-end encryption for both HTTPS and upstream SSH. Doesn't appear to offer non-e2e HTTPS, ie no auto Let's Encrypt support.
-
holepunch.io
- Has nice hosted solution. Uses SSH for muxing.
-
SirTunnel
- Minimal, self-hosted, 0-config alternative to ngrok. Similar to sish but leverages Caddy+OpenSSH rather than custom server code.
-
StaqLab Tunnel
- SSH-based. Client is open source. Server doesn't appear to be.
-
tnnlink
- SSH-based. Golang. Not maintained.
Commercial/Closed source
- ngrok 2.0 - Probably the gold standard and most popular. Closed source. Lots of features, including TLS and TCP tunnels. Doesn't require root to run client.
- Tailscale
- Built on WireGuard. Easy to use. Doesn't include an HTTPS proxy on the public side, but could be combined with nginx/Caddy/etc. Some code available, but I'm not sure what the implications of the custom license is.
- Loophole - Offers end-to-end TLS encryption with the client automatically getting certs from Let's Encrypt. QR codes for URL sharing.
- CloudFlare Argo Tunnel - $5/mo + $0.1/GB. Integrates with Argo smart routing. Client source code is available.
- localhost.run - Simple hosted SSH option. Supports custom domains for a cost.
- Packetriot - Comprehensive alternative to ngrok. HTTP Inspector, Let's Encrypt integration, doesn't require root and Linux repos for apt, yum and dnf. Enterprise licenses and self-hosted option.
- Lynk - Advertises itself as a cheaper, faster, self-hostable (but not open source) alternative to ngrok. Blog post.
- Hoppy - WireGuard-based. Provides static IPv4 and IPv6 addresses for your machines, which is a simple and useful level of abstraction. Targeted towards self-hosters and people behind NATs.
- gw.run - Specifically focusing on securely exposing internal web apps to a group of people; not for publicly facing apps. Share access via email address then allow users to log in with common login providers like Google.
- serveo - Mentioned quite a bit the last couple years, but appears to be down currently. Simply uses SSH for tunneling.
Reference
- Roll your own Ngrok with Nginx, Letsencrypt, and SSH reverse tunnelling
- Poor man's ngrok with tcp proxy and ssh reverse tunnel
- How I built Ngrok Alternative (jprq)
- Great SO answer by AJ ONeal about how these things work
- Talk by AJ ONeal about tunneling tech