17 self-hosted Cloudflare Tunnel alternatives

Caddy is a fast, extensible Go web server and reverse proxy with automatic HTTPS (ACME), HTTP/1.1, HTTP/2, and HTTP/3 support, and a JSON config API.

74.4k stars4.8k forksApache-2.0last commit 25 Jul 2026Actively maintained

Open-source identity-based remote access platform combining WireGuard VPN and tunneled reverse proxy access with granular zero-trust controls.

21.9k stars745 forkslast commit 22 Jul 2026Actively maintained

CLI tool to create Cloudflare Tunnels and route traffic through Cloudflare’s edge.

15k stars1.4k forksApache-2.0last commit 22 Jul 2026Actively maintained

iodine is a DNS tunneling tool that forwards IPv4 traffic through DNS queries and replies, providing a TUN interface to route IP traffic when only DNS is allowed.

7.9k stars596 forksISClast commit 4 Sept 2025Slowing down

Cosmos Cloud is a security-focused self-hosting platform that provides an app store, reverse proxy with automatic HTTPS, SSO/MFA, container management, backups, and monitoring.

6.1k stars237 forkslast commit 16 Jul 2026Actively maintained

A general-purpose HTTP reverse proxy and forwarding tool for homelabs, offering web UI, ACME/TLS, stream proxy, plugins and realtime monitoring.

5.3k stars315 forksAGPL-3.0last commit 25 Jul 2026Actively maintained

sish is an open-source Serveo/ngrok alternative that exposes local HTTP(S), WebSockets, and TCP services to the internet using SSH reverse tunnels.

4.7k stars332 forksMITlast commit 25 Jun 2026Actively maintained

LinuxServer.io SWAG is a Docker image bundling Nginx reverse proxy, ACME certificate automation (Let’s Encrypt/ZeroSSL), optional PHP, and fail2ban intrusion prevention.

3.7k stars277 forksGPL-3.0last commit 25 Jul 2026Actively maintained

High-performance reverse proxy and container orchestrator with Web UI, automatic Docker/Podman route discovery, idle-sleep, access control, and automated Let's Encrypt support.

3.5k stars150 forkslast commit 27 Jul 2026Actively maintained

High-performance reverse proxy for self-hosted apps with Web UI, Docker/Podman auto-routing, HTTPS via Let's Encrypt, access control, and OIDC/ForwardAuth support.

3.5k stars150 forkslast commit 27 Jul 2026Actively maintained

Enterprise-grade zero-trust access management platform providing WireGuard VPN with true protocol-level 2FA/MFA, plus integrated OpenID Connect SSO and user/device controls.

2.8k stars107 forkslast commit 24 Jul 2026Actively maintained

Self-hosted controller that automates Cloudflare Tunnels, DNS records, and Access policies using Docker labels, with a web UI and optional multi-server agents.

2.3k stars102 forkslast commit 12 May 2026Actively maintained

Automates Reverse Proxy-over-VPN (RPoVPN) using WireGuard, Caddy and NGINX to expose Docker Compose services to the public Internet with automated TLS.

1.7k stars87 forksAGPL-3.0last commit 17 Mar 2025Slowing down

Self-hosted ingress platform that exposes internal HTTP/TCP services to the internet through reverse WireGuard tunnels, with NGINX routing and automatic TLS certificates.

1.6k stars76 forksApache-2.0last commit 23 Jul 2026Actively maintained

NetGoat is a self-hostable reverse proxy and traffic management platform offering Cloudflare-like features such as TLS termination, rate limiting, WAF-style filtering, and dashboards.

888 stars47 forksAGPL-3.0last commit 7 Jul 2026Actively maintained

Publishes Docker container label-based service definitions into Redis so a central Traefik instance can discover and route services across multiple Docker hosts.

501 stars26 forksMITlast commit 11 May 2026Actively maintained

Integrated installer and platform for home infrastructure. Provides VPN relay for NAT traversal, preconfigured email, automatic HTTPS, reverse proxy, and a web management utility.

65 stars7 forksGPL-3.0last commit 19 Jul 2026Actively maintained