Commercial/Closed source

The purpose of this list is to track and compare tunneling solutions. This is primarily targeted toward self-hosters and developers who want to do things like exposing a local webserver via a public domain name, with automatic HTTPS, even if behind a NAT or other restricted network.

Note

We're building a community around self-hosting, data ownership, and decentralization in general. Join us over at IndieBits.io.

The dream

I started this list because I'm looking for a simple tool/service that does the following:

Allows me to register a domain name and automatically points the records at the server running the tunnels.
Automatically sets up and manages HTTPS certificates (apex and subdomains) for the domain.
Provides a client tool that tunnels HTTP/TCP connections through the server without requiring root on the client.
Provides a simple GUI interface to allow me to map X domain/subdomain to Y port on Z client, and proxy all connections to that domain.

So far I haven't found a tool that does all of this. In particular, while some of them can do automatic certs through Lets's Encrypt, none of them integrate the domain registration and DNS management.

UPDATE 2022-09-23:

A lot of new tools have been developed since the list started, and many tools have been submitted for addition to the list. It's great to see so much interest in tunneling. That said, I want to make sure this remains a useful resource for not just listing all the possible options, but helping people pick one that will solve their problem. With that goal in mind, I've moved some of the items to a separate section at the bottom. This is dedicated to more complicated tools like overlay networks which can support tunneling and similar use cases, but aren't focused exclusively on tunneling. Please let me know if you think something is in the wrong section.

Recommendations

For most people, I currently recommend CloudFlare Tunnel. Although it's closed source, this is the production-quality service that gets the closest to achieving the dream. It's also a loss-leader for CloudFlare's other products which means they can offer it for free. Note that it's technically against their ToS to host anything other than basic HTML pages on the free plan, including photos, audio, and video. In practice I'm not aware of many instances of this being enforced.

If you want to self-host, there are many options. For something production ready frp is probably what you want. If you're a developer, I'd recommend starting with my own SirTunnel project and modifying it for your needs.

For non-developers and those wanting more of a GUI experience, I created boringproxy. It's my take on a comprehensive tunnel proxy solution. It's in beta but currently solves almost everything I want. Once the server is running this is a very easy tool to use and has some nice features.

SSH based

The ssh command allows to create tunnels and this is simplest and popular way because not need for a dedicated client. As a downside a TLS traffic will be additionally encrypted by SSH. But it's usually not a big slowdown. In order to keep tunnel working after disconnect you need to configure additional service like:

autossh
systemd
For MacOS launchd
For OpenWrt use sshtunnel
sshtunnel for SystemD works in Debian, Ubuntu, Arch etc.
NetworkManager SSH plugin - GUI to use SSH as VPN

SSH Services

burrow.io - SSH, HTTP, basic auth, custom domains. No free plan.
localhost.run - Simple hosted SSH option. Supports custom domains for a cost.
Pinggy - SSH based single command HTTPS / TCP / TLS tunnels, no downloads required. Rich terminal interface and a web debugger. Free tier - 60 min timeout. Paid tier allows custom domains with built-in Let's Encrypt certificates.
RaspberryAnywhere.com - an SSH tunnel. No free plan.
remotemoe - a free SSH, HTTP and HTTPS tunnel. Run ssh remote.moe firsttime and it will display usage information. Its server is open source, see bellow.
srv.us - a free HTTP tunnel. Supports custom domain same as on GitHub. Its server is open source, see bellow.
SSH-J.com - Public SSH Jump & Port Forwarding server. Free to use, no registration, just an anonymous SSH server for forwarding. Users are encouraged to use it for SSH exposure only, to preserve end-to-end encryption. No public ports, only in-SSH connectivity. Run ssh ssh-j.com and it will display usage information. Its server is open source, see bellow.
SSHReach.me - Paid SSH-based option. Uses a simple python script.

SSH Servers

dropbear-sshj -server used by the SSH-J.com. It's just a patched version of Dropbear SSH daemon. C
pgrok/pgrok - A multi-tenant HTTP reverse tunnel solution through SSH remote port forwarding.
remotemoe - SSH-based, with custom golang server. Does some cool unique things. Instead of just plain tunnels, it drops you into a basic CLI UI that offers several useful commands interactively, such as adding a custom hostname. Also allows end-to-end encryption for both HTTPS and upstream SSH. Doesn't appear to offer non-e2e HTTPS, ie no auto Let's Encrypt support.
StaqLab Tunnel - SSH-based. Client is open source. Server doesn't appear to be.
chisel - SSH under the hood, but still uses a custom client binary. Supports auto certs from LetsEncrypt. Written in Go.
sish - Open source ngrok/serveo alternative. SSH-based but uses a custom server written in Go. Supports WebSocket tunneling.
SirTunnel - Minimal, self-hosted, 0-config alternative to ngrok. Similar to sish but leverages Caddy+OpenSSH rather than custom server code.
srv.us - the srv.us backend. Golang.
tnnlink - SSH-based. Golang. Not maintained.

Articles

Tor

Tor provides a Hidden Services which are a secret tunnels and free to use. But they are slow, their domains are not human-readable and you need a Tor Browser or Tor SOCKS5 proxy to access them.

Tor
onionpipe - Onion addresses for anything. onionpipe forwards ports on the local host to remote Onion addresses as Tor hidden services and vice-versa. Written in Go.
OnionShare - a user-friendly program to create a hidden service.
ngtor - Easily expose local services via Tor. Written in Java.

Open source (at least with a reasonably permissive license)

Tunnelmole - Open source and optionally self hostable. The client and server are both written in TypeScript.
Telebit - Written in JS. Code.
tunnel.pyjam.as - No custom client; uses WireGuard directly instead. Written in Python. source code
frp - Comprehensive open alternative to ngrok. Supports UDP, and has a P2P mode. Supports multiplexing over TCP (single connection or pool), QUIC, and KCP.
ngrok 1.0 - Original version of ngrok. No longer developed in favor of the commercial 2.0 version.
localtunnel - Written in node. Popular suggestion.
sshuttle - Open source project originally from one of the founders of Tailscale. Server doesn't require root; client does. Explicitly designed to avoid TCP-over-TCP issues.
bore - Minimal tunneling solution. MIT Licensed. Written in Rust.
rathole - Similar to frp, including the config format, but with improved performance. Low resource consumption. Hot reload. Written in Rust.
expose - ngrok alternative written in PHP.
go-http-tunnel - Uses a single HTTP/2 connection for muxing. Need to manually generate certs for server and clients.
tunnelto - Open source (MIT). Written in Rust.
wstunnel - Proxies over WebSockets. Focus on proxying from behind networks that block certain protocols. Written in Haskell with executables provided.
boringproxy - Designed to be very easy to use. No config files. Clients can be remote-controlled through a simple WebUI and/or REST API on the server.
zrok - Aims for effortless sharing both publicly and privately. Supports multiple types of resources, including HTTP endpoints and files. Built on OpenZiti (see overlay section below). Apache 2 License. Written in Go.
PageKite - Comprehensive open source solution with hosted options.
jprq - Proxies over WebSockets. Written in Python.
Crowbar - Tunnels TCP connections over HTTP GET and POST requests.
tunneller - Open source. Written in Go.
tunnel - This one is a Golang library, not a program you can just run. However, it looks easy to use for creating custom solutions. Uses a single TCP socket, and yamux for multiplexing.
jerson/pgrok - Fork of ngrok 1.0, with more recent commits. Archived.
docker-tunnel - Simple Docker-based nginx+SSH solution.
hypertunnel - Public server appears to be down. MIT Licensed. Written in JavaScript.
holepunch - Has nice hosted solution. Uses SSH for muxing.

Commercial/Closed source

AstroRelay - Secure Tunnel for Remote Accessing Your Devices.
ngrok 2.0 - Probably the gold standard and most popular. Closed source. Lots of features, including TLS and TCP tunnels. Doesn't require root to run client.
CloudFlare Tunnel - Excellent free option. Nicely integrates tunneling with the rest of Cloudflare's products, which include DNS and auto HTTPS. Client source code is Apache 2.0 licensed and written in Golang.
Beeceptor - Goes beyond tunneling. Rest API mocking and intercepting tool. You can view the live requests and send mocked response. Written in JavaScript.
Loophole - Offers end-to-end TLS encryption with the client automatically getting certs from Let's Encrypt. QR codes for URL sharing. Client is open source. Can serve a local directory over WebDAV. MIT License. Written in Go.
Packetriot - Comprehensive alternative to ngrok. HTTP Inspector, Let's Encrypt integration, doesn't require root and Linux repos for apt, yum and dnf. Enterprise licenses and self-hosted option.
Hoppy - WireGuard-based. Provides static IPv4 and IPv6 addresses for your machines, which is a simple and useful level of abstraction. Targeted towards self-hosters and people behind NATs.
gw.run - Specifically focusing on securely exposing internal web apps to a group of people; not for publicly facing apps. Share access via email address then allow users to log in with common login providers like Google.
KubeSail - Company offering tunneling, dynamic DNS, and other services for self-hosting with Kubernetes.
inlets - Used to be open source; now focused on a polished commercial offering. Designed to work well with Kubernetes.
LocalToNet - Supports UDP. Free for a single tunnel. Paid supports custom domains.
LocalXpose - Looks like a solid paid option, with a limited free tier.

Overlay networks and other advanced tools

Teleport - Comprehensive control plane tool, but also supports accessing apps behind NATs. Written in Go.
Nebula - Peer-to-peer overlay network. Developed and used internally by Slack. Similar to Tailscale but completely open source. Doesn't use WireGuard. Written in Go.
ZeroTier - Layer 2 overlay network. They take decentralization seriously, and like to say "decentralize until it hurts, then centralize until it works." Written in C++.
headscale - Open source implementation of Tailscale control server. Can be used with Tailscale's official open source client. Written in Go.
Tailscale - Built on WireGuard. Easy to use. Doesn't include an HTTPS proxy on the public side, but could be combined with nginx/Caddy/etc. Control server is closed source. Client code available with a BSD3 license + separate patents file.
Netmaker - Layer 3 peer-to-peer overlay network and private DNS. Similar to Tailscale, but with a self-hosted server/admin UI. Runs kernel WireGuard so very fast. Not FOSS, but source is available. Written in Go.
NetBird - NetBird is an open-source VPN management platform built on top of WireGuard® making it easy to create secure private networks for your organization or home.
innernet - Similar to Netmaker, nebula, and Tailscale. Takes advantage of existing networking concepts like CIDRs and the security properties of WireGuard to turn your computer's basic IP networking into more powerful ACL primitives. Written in Rust.
Firezone - Layer 3/4 overlay network. Runs on kernel WireGuard® and supports SSO using generic OIDC/SAML connectors. Distributed under apache 2.0 license and written in Elixir/Rust.
Pritunl - Seems quite comprehensive and complicated. OpenVPN, WireGuard, and IPSec support.
Tinc - Tinc is a peer-to-peer VPN daemon that supports VPNs with an arbitrary number of nodes. Instead of configuring tunnels, you give tinc the location and public key of a few nodes in the VPN. After making the initial connections to those nodes, tinc will learn about all other nodes on the VPN, and will make connections automatically. When direct connections are not possible, data will be forwarded by intermediate nodes. Written in C.
OpenZiti - - Overlay network. The goal of OpenZiti is to extend zero trust all the way into your application, not just to your network. Apache 2.0 license. Written in Go.
Ngrok-operator - Ngrok but integrated with Kubernetes, allows developers on private kubernetes to easily access their services via Ngrok.