Open-source ngrok alternatives

frp is an open-source reverse proxy that makes a server sitting behind a NAT or firewall reachable from the internet. It supports TCP and UDP traffic as well as HTTP and HTTPS, so requests can be forwarded to internal services using a domain name. It also offers a peer-to-peer connect mode. The project is written in Go and licensed under Apache-2.0.

Typical setups include reaching a computer on a home or office LAN over SSH, sharing one port between several SSH services, serving internal web apps on custom domains, forwarding DNS queries and Unix domain sockets, exposing a simple HTTP file server, enabling HTTPS for a local service, and exposing a service privately. Configuration is handled through files, with support for environment variables and splitting settings across several files.

Operations features include a server dashboard, a client admin UI, dynamic proxy management, Prometheus monitoring and client authentication. A server component runs on a machine with a public address, and a client runs beside your internal service. It suits developers, homelab users and small teams who want to host their own tunnel instead of using a commercial tunneling service.

Pangolin is an open-source secure access service edge platform built on WireGuard. It aims to connect and protect users wherever they are by combining networking and security in one system: a zero-trust VPN, a zero-trust reverse proxy, privileged access control and a gateway for AI workloads that is aware of user identity, with one identity and policy model underneath.

The project compares its idea to commercial platforms such as Cloudflare One, Zscaler and Prisma, but argues that it is open, self-hostable and light enough to be easy to deploy. Legacy SASE products, it says, are heavy, closed and cloud-locked. Topics include reverse proxy, single sign-on, OIDC, SSH, tunneling, NAT traversal and remote access. Because the source is open to inspection, you can verify how traffic and access decisions are handled.

You can use Pangolin Cloud at app.pangolin.net or run it yourself. The repository's license is listed as 'Other' on GitHub, because it mixes open-source and enterprise components, so check the terms. It suits homelab users, small companies and IT teams that want zero-trust remote access without a large vendor contract.

Rathole is a reverse proxy for NAT traversal, written in Rust. Like frp and ngrok, it exposes a service on a device behind a NAT to the internet through a server that has a public IP, for example to reach a home NAS over SSH from outside the network.

The README highlights several design points. It claims higher throughput than frp and more stability under many connections, with benchmarks provided, and low memory use that allows a small binary suitable for embedded devices such as routers. Each service requires a token, and server and client each hold their own configuration. Encryption can be set up with the optional Noise Protocol without self-signed certificates, and TLS is also supported. Services can be added or removed by hot-reloading the configuration file.

Rathole is licensed under Apache-2.0. Usage is similar to frp, with the difference that a service is configured separately on the client and server sides. Binaries are published on the release page, you can build from source, and a Docker image is available.

zrok lets you share web services, files and network resources with other people, whether they are across the internet or on a private network. It is built on zero-trust networking, so it works through firewalls and NAT without port forwarding or other network changes, and it behaves like a secure reverse proxy and peer-to-peer sharing tool.

Getting started takes a few steps: install zrok, create an account with the invite command, using the free zrok.io service, and enable sharing on your machine. After that you can publish a local web app, share a folder or expose a private resource to selected users. The project is part of the OpenZiti ecosystem and written in Go.

zrok is licensed under Apache-2.0. You can use the hosted zrok.io service or run your own zrok instance, which suits developers who need to expose a local service temporarily, teams sharing files securely and homelab owners who want remote access without opening ports.

Ziti is the parent project of OpenZiti, an open-source zero-trust networking platform that makes network services invisible to unauthorized users. Every connection, whether from a person, service, device or workload, is authenticated with a cryptographic identity, authorized by policy and encrypted end to end.

It works with existing applications through lightweight tunnelers that need no code changes, and with new applications through embedded SDKs for the strongest zero-trust model. The README lists use cases such as replacing VPNs with per-service authorization, hiding APIs and services so they have no listening ports, and giving IoT devices and other non-human workloads their own identities.

OpenZiti was created and sponsored by NetFoundry and is licensed under Apache-2.0. The code is written in Go, the README describes three deployment models, and a managed solution is available for teams that prefer not to operate it themselves.

Octelium is a self-hosted, open-source platform that unifies zero trust secure access under one system. It is flexible enough to act as a zero-config remote access VPN, a Zero Trust Network Access and BeyondCorp-style platform, an alternative to ngrok and Cloudflare Tunnel, an API gateway, an AI and LLM gateway, and an infrastructure for building MCP gateways and AI agent access.

Repository topics list attribute-based access control, policy as code, WireGuard, QUIC, SSO, multi-factor authentication, OpenTelemetry and SSH access. The README includes use cases, a feature overview, a guide to try it in a Codespace, CLI installation and instructions to install your first cluster. It is written in Go and runs on Kubernetes. It is compared to ngrok, Cloudflare Tunnel and Apigee for different roles.

Octelium is licensed under AGPL-3.0 and you operate the cluster yourself. It suits platform and security teams, homelab users and developers who want to replace several access, tunnel and gateway tools with one self-hosted system.