Open-source Cloudflare alternatives

NGINX, pronounced engine x, is a web server that also serves as a reverse proxy, load balancer, API gateway and content cache. The official open source repository is written in C and distributed under a simplified two-clause BSD license. Enterprise distributions, commercial support and training are sold separately by F5, Inc.

NGINX is installed software with binary packages for the major operating systems and Linux distributions, in stable and mainline versions, plus Windows executables and dynamic modules. Typical tasks covered by the project's introduction include installing SSL certificates and enabling TLS, load balancing, rate limiting and content caching. Topics on the repository list TCP, UDP and mail proxying, HTTP/2, HTTP/3 and QUIC. You can also build from source, and the full documentation includes a beginners guide, development guide and directive reference.

Pangolin is an open-source secure access service edge platform built on WireGuard. It aims to connect and protect users wherever they are by combining networking and security in one system: a zero-trust VPN, a zero-trust reverse proxy, privileged access control and a gateway for AI workloads that is aware of user identity, with one identity and policy model underneath.

The project compares its idea to commercial platforms such as Cloudflare One, Zscaler and Prisma, but argues that it is open, self-hostable and light enough to be easy to deploy. Legacy SASE products, it says, are heavy, closed and cloud-locked. Topics include reverse proxy, single sign-on, OIDC, SSH, tunneling, NAT traversal and remote access. Because the source is open to inspection, you can verify how traffic and access decisions are handled.

You can use Pangolin Cloud at app.pangolin.net or run it yourself. The repository's license is listed as 'Other' on GitHub, because it mixes open-source and enterprise components, so check the terms. It suits homelab users, small companies and IT teams that want zero-trust remote access without a large vendor contract.

SafeLine is a self-hosted web application firewall (WAF) from Chaitin, released under the GPL-3.0 license. It sits in front of a web application as a reverse proxy, so visitors' requests pass through it first. It filters, monitors, and blocks malicious HTTP and HTTPS traffic before that traffic reaches the origin server, and it is also meant to stop unauthorized data from leaving the application.

The firewall targets common web attack classes, including SQL injection, cross-site scripting, command and code injection, server-side request forgery, path traversal, XXE, and remote code execution, as well as brute-force attempts, HTTP floods, and abusive bots. Beyond rule-based filtering, its documented core capabilities include IP-based rate limiting, a web access control list, bot defense, and encryption of the HTML and JavaScript code served to clients.

Security and operations teams that run their own websites or APIs can use it to add a protective layer in front of existing applications. The project is written in Go and hosted on GitHub, and the maintainers provide documentation, a live demo, and a Discord community. Because it is self-hosted, traffic inspection stays on infrastructure you control.

CrowdSec is an open-source and participative security solution that detects and blocks malicious behavior on servers. Its Security Engine acts as an all-in-one intrusion detection and prevention system and web application firewall, analyzing log sources and HTTP requests and enforcing decisions through separate remediation components. It runs on Linux, Windows, Docker and Kubernetes.

A Community Blocklist of IP addresses identified as malicious is shared among users, so an address that attacks one participant can be blocked for others before it arrives. Detection and remediation are decoupled, which means logs can be parsed on one machine while blocking happens at a firewall, reverse proxy or CDN elsewhere. A web console supports monitoring and automation.

The README compares it with fail2ban, which reads similar logs, and with ModSecurity, Coraza and naxsi, since the AppSec component is a WAF built on Coraza that loads SecLang rules and the OWASP Core Rule Set. It can also answer suspicious requests with a JavaScript proof-of-work challenge to stop headless scrapers. CrowdSec is written in Go and licensed under MIT.

BunkerWeb is an open-source web application firewall that protects web services and aims to make them secure by default. It is a complete web server based on NGINX that sits in front of your applications as a reverse proxy, filtering traffic before it reaches them.

It can be deployed in Linux, Docker, Swarm and Kubernetes environments and is configurable through a command line or a web user interface. Core security features ship in the box, and additional ones can be added with a plugin system. Related topics in the repository include ModSecurity, anti-bot protection, DNS blocklists and Let's Encrypt certificate handling.

The software is written mainly in Python and released under the AGPL-3.0 license. The project provides documentation, a demo, community templates, examples and a forum. Its goal is for administrators to get a reasonable level of protection with minimal configuration while keeping room to tune individual settings for their own use cases.

Technitium DNS Server is an open-source DNS server that can act as both an authoritative and a recursive resolver. People host it themselves for privacy and security, and it works out of the box with little or no configuration. A friendly web console is reachable from any modern browser.

It can block ads and malware at the DNS level for an entire network. By forwarding queries over DNS-over-TLS, DNS-over-HTTPS or DNS-over-QUIC, it limits what an internet provider can see or tamper with. A local DNS server also gives logs and statistics for understanding network activity, serves many queries from cache, and allows network-wide domain blocking. Repository topics also mention DHCP server functions and DNS-over-Tor.

The server is written in C# on .NET and runs on Windows, Linux, macOS and Raspberry Pi, with Docker support. It is released under the GPL-3.0 license, and the project site at technitium.com provides downloads and documentation. It is suited to home networks and organizations that want more control over name resolution.

ModSecurity is an open-source, cross-platform web application firewall engine. It started as an Apache module and now serves Apache, IIS and Nginx, protecting web applications from a range of attacks while also allowing HTTP traffic monitoring, logging and real-time analysis through an event-based rule language.

This repository contains libmodsecurity, the ModSecurity v3 library. It acts as an interface to connectors that pass web traffic in, loads and interprets rules written in the SecRules format, and applies them to HTTP content from your application. Version 3 is a full rewrite that removes the Apache dependencies, aims for higher performance and a new architecture, and plans native JSON audit logs.

The older ModSecurity v2.x for Apache is still maintained in its own repository. The code is written in C++ and released under the Apache-2.0 license, under the OWASP organization. Rule sets such as the OWASP Core Rule Set are typically used alongside it.

zrok lets you share web services, files and network resources with other people, whether they are across the internet or on a private network. It is built on zero-trust networking, so it works through firewalls and NAT without port forwarding or other network changes, and it behaves like a secure reverse proxy and peer-to-peer sharing tool.

Getting started takes a few steps: install zrok, create an account with the invite command, using the free zrok.io service, and enable sharing on your machine. After that you can publish a local web app, share a folder or expose a private resource to selected users. The project is part of the OpenZiti ecosystem and written in Go.

zrok is licensed under Apache-2.0. You can use the hosted zrok.io service or run your own zrok instance, which suits developers who need to expose a local service temporarily, teams sharing files securely and homelab owners who want remote access without opening ports.

This repository contains the sources for PowerDNS, a set of DNS server software. It includes the PowerDNS Authoritative Server, the PowerDNS Recursor and dnsdist, a DNS load balancer. All three can be built from the same repository, although they are also released separately as tarball, deb and rpm packages.

The authoritative server depends on Boost, OpenSSL and Lua and needs a compiler with C++17 support, and the project provides pdns-builder, a Docker-based build process for producing the different releases. Docker images are available, with the README mirrored to Docker Hub, and full documentation lives at doc.powerdns.com.

PowerDNS is copyright PowerDNS.COM BV and many contributors and is distributed under the GNU GPLv2, with the NOTICE file describing the exact license and exception. Bugs are reported on the GitHub issue tracker, and the changelog on the documentation site is the place to check for recent updates.

Octelium is a self-hosted, open-source platform that unifies zero trust secure access under one system. It is flexible enough to act as a zero-config remote access VPN, a Zero Trust Network Access and BeyondCorp-style platform, an alternative to ngrok and Cloudflare Tunnel, an API gateway, an AI and LLM gateway, and an infrastructure for building MCP gateways and AI agent access.

Repository topics list attribute-based access control, policy as code, WireGuard, QUIC, SSO, multi-factor authentication, OpenTelemetry and SSH access. The README includes use cases, a feature overview, a guide to try it in a Codespace, CLI installation and instructions to install your first cluster. It is written in Go and runs on Kubernetes. It is compared to ngrok, Cloudflare Tunnel and Apigee for different roles.

Octelium is licensed under AGPL-3.0 and you operate the cluster yourself. It suits platform and security teams, homelab users and developers who want to replace several access, tunnel and gateway tools with one self-hosted system.