Ledger / private networking and tunnels
Self-hosted alternatives to Tailscale, ngrok, Cloudflare Tunnel
Read 2026-11-14 · 5 projects · 3 pass
We read the repository pages of 5 projects that people put forward as a replacement for Tailscale, ngrok, Cloudflare Tunnel (private networking and tunnels). 3 pass all three checks: fatedier/frp, juanfont/headscale, slackhq/nebula. Left out of that list: netbirdio/netbird (open source plus separately licensed parts); fosrl/pangolin (open source plus separately licensed parts).
| Project | License as read | License · Live · Active | Stars | Latest release / last push |
|---|---|---|---|---|
| fatedier/frpGo | Apache-2.0 | licliveactive | 110,578 | v0.72.0 2026-11-04 pushed 2026-11-10 |
What it says it is A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet. Install No Dockerfile, compose file or Helm chart found in the top levels of the repository README mentions NAT, tunnel, reverse proxy, DNS | ||||
| juanfont/headscaleGo | BSD-3-Clause | licliveactive | 45,690 | v0.29.7 2026-10-30 pushed 2026-11-14 |
What it says it is An open source, self-hosted implementation of the Tailscale control server Install In the repository: Dockerfile README mentions WireGuard, NAT, Tailscale | ||||
| slackhq/nebulaGo | MIT | licliveactive | 18,527 | v1.12.0 2026-10-29 pushed 2026-11-13 |
What it says it is A scalable overlay networking tool with a focus on performance, simplicity and security Install In the repository: Dockerfile README mentions NAT | ||||
| netbirdio/netbirdGo | BSD-3-Clause, with AGPL-3.0 server directories | x licliveactive | 30,987 | v0.83.1 2026-11-13 pushed 2026-11-14 |
What it says it is NetBird securely connects people, machines and AI agents across any network with one identity-based Zero Trust platform. Powered by peer-to-peer WireGuard® Install In the repository: Dockerfile README mentions WireGuard, tunnel, SSO, mesh, reverse proxy, exit node, DNS | ||||
| fosrl/pangolinTypeScript | AGPL-3.0 plus a commercial license on some files | x licliveactive | 23,724 | 1.26.0 2026-11-04 pushed 2026-11-13 |
What it says it is Modern networking and security platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users. Install In the repository: Dockerfile, compose file README mentions WireGuard, NAT, tunnel, reverse proxy | ||||
Checks per row: lic = one open-source license across the whole repository (a commercial option on request is allowed), live = not archived, active = a release or push within 90 days of 2026-11-14. A red x marks a failed check. Full definitions and limits: method.
Why 2 of 5 did not pass
- netbirdio/netbird · BSD-3-Clause, with AGPL-3.0 server directories
The license file says: “This BSD-3-Clause license applies to all parts of the repository except for the directories management/, signal/, relay/ and combined/. Those directories are licensed under the GNU Affero General Public License version 3.0 (AGPLv3).” Repository - fosrl/pangolin · AGPL-3.0 plus a commercial license on some files
The license file says: “All files that include a header specifying they are licensed under the "Fossorial Commercial License" are governed by the Fossorial Commercial License terms.” Repository
How they differ
Mentioned in some READMEs and not others
- WireGuard: juanfont/headscale, netbirdio/netbird, fosrl/pangolin
- NAT: fatedier/frp, juanfont/headscale, slackhq/nebula, fosrl/pangolin
- tunnel: fatedier/frp, netbirdio/netbird, fosrl/pangolin
- SSO: netbirdio/netbird
- mesh: netbirdio/netbird
- reverse proxy: fatedier/frp, netbirdio/netbird, fosrl/pangolin
- Tailscale: juanfont/headscale
- exit node: netbirdio/netbird
- DNS: fatedier/frp, netbirdio/netbird
Main language
- Go: fatedier/frp, juanfont/headscale, slackhq/nebula, netbirdio/netbird
- TypeScript: fosrl/pangolin
Install files
- No Dockerfile, compose file or Helm chart found in the top levels of the repository: fatedier/frp
- In the repository: Dockerfile: juanfont/headscale, slackhq/nebula, netbirdio/netbird
- In the repository: Dockerfile, compose file: fosrl/pangolin
From each README (first part) and file tree as read; a missing mention only means the README does not use the word.
Where people asked for this
- Show HN: Pangolin – Open source alternative to Cloudflare Tunnels 500 points, 125 comments
- Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok 358 points, 151 comments
Thread titles and counts as collected 2026-11-09. The original product: Tailscale, ngrok, Cloudflare Tunnel.