17 self-hosted Cloudflare Tunnel alternatives

Caddy is a fast, extensible Go web server and reverse proxy with automatic HTTPS (ACME), HTTP/1.1, HTTP/2, and HTTP/3 support, and a JSON config API.

75.2k stars4.9k forksApache-2.0last commit 25 Aug 2026Actively maintained

Open-source identity-based remote access platform combining WireGuard VPN and tunneled reverse proxy access with granular zero-trust controls.

22.5k stars765 forkslast commit 26 Aug 2026Actively maintained

CLI tool to create Cloudflare Tunnels and route traffic through Cloudflare’s edge.

15.4k stars1.4k forksApache-2.0last commit 26 Aug 2026Actively maintained

iodine is a DNS tunneling tool that forwards IPv4 traffic through DNS queries and replies, providing a TUN interface to route IP traffic when only DNS is allowed.

8k stars596 forksISClast commit 4 Sept 2025Slowing down

Cosmos Cloud is a security-focused self-hosting platform that provides an app store, reverse proxy with automatic HTTPS, SSO/MFA, container management, backups, and monitoring.

6.1k stars250 forkslast commit 26 Aug 2026Actively maintained

A general-purpose HTTP reverse proxy and forwarding tool for homelabs, offering web UI, ACME/TLS, stream proxy, plugins and realtime monitoring.

5.4k stars320 forksAGPL-3.0last commit 22 Aug 2026Actively maintained

sish is an open-source Serveo/ngrok alternative that exposes local HTTP(S), WebSockets, and TCP services to the internet using SSH reverse tunnels.

4.7k stars333 forksMITlast commit 25 Jun 2026Actively maintained

High-performance reverse proxy and container orchestrator with Web UI, automatic Docker/Podman route discovery, idle-sleep, access control, and automated Let's Encrypt support.

4.1k stars188 forkslast commit 25 Aug 2026Actively maintained

High-performance reverse proxy for self-hosted apps with Web UI, Docker/Podman auto-routing, HTTPS via Let's Encrypt, access control, and OIDC/ForwardAuth support.

4.1k stars188 forkslast commit 25 Aug 2026Actively maintained

LinuxServer.io SWAG is a Docker image bundling Nginx reverse proxy, ACME certificate automation (Let’s Encrypt/ZeroSSL), optional PHP, and fail2ban intrusion prevention.

3.7k stars276 forksGPL-3.0last commit 22 Aug 2026Actively maintained

Enterprise-grade zero-trust access management platform providing WireGuard VPN with true protocol-level 2FA/MFA, plus integrated OpenID Connect SSO and user/device controls.

2.8k stars110 forkslast commit 10 Aug 2026Actively maintained

Self-hosted controller that automates Cloudflare Tunnels, DNS records, and Access policies using Docker labels, with a web UI and optional multi-server agents.

2.4k stars107 forkslast commit 17 Aug 2026Actively maintained

Automates Reverse Proxy-over-VPN (RPoVPN) using WireGuard, Caddy and NGINX to expose Docker Compose services to the public Internet with automated TLS.

1.7k stars87 forksAGPL-3.0last commit 17 Mar 2025Slowing down

Self-hosted ingress platform that exposes internal HTTP/TCP services to the internet through reverse WireGuard tunnels, with NGINX routing and automatic TLS certificates.

1.6k stars77 forksApache-2.0last commit 19 Aug 2026Actively maintained

NetGoat is a self-hostable reverse proxy and traffic management platform offering Cloudflare-like features such as TLS termination, rate limiting, WAF-style filtering, and dashboards.

890 stars47 forksAGPL-3.0last commit 29 Jul 2026Actively maintained

Publishes Docker container label-based service definitions into Redis so a central Traefik instance can discover and route services across multiple Docker hosts.

510 stars27 forksMITlast commit 11 May 2026Actively maintained

Integrated installer and platform for home infrastructure. Provides VPN relay for NAT traversal, preconfigured email, automatic HTTPS, reverse proxy, and a web management utility.

69 stars7 forksGPL-3.0last commit 27 Aug 2026Actively maintained