Best open-source alternatives to ngrok

OpenZiti is a zero-trust networking platform designed to hide services from unauthorized access while securing every connection with authenticated identity and end-to-end encryption. It is aimed at teams that need to connect users, services, devices, and workloads across networks without exposing open ports or relying on traditional VPNs. The project supports several deployment styles, including network-level access, host-based tunneling, and application-embedded SDK integration. That makes it suitable for both existing brownfield services and new greenfield applications, as well as environments spanning cloud, on-premises, Kubernetes, IoT, and hybrid infrastructure. Its controller provides identity management, policy enforcement, a REST API, and a web admin console, while edge routers carry encrypted traffic through the overlay network.

rathole is a Rust-based reverse proxy designed for NAT traversal. It is intended for situations where a machine behind a NAT needs to expose services such as SSH, and it works by connecting a client running on the private host to a server with a public IP. Traffic arriving at the server is then forwarded back to the private service through the established tunnel. The project targets users who need a lightweight, secure alternative to tools like frp or ngrok. The README emphasizes performance, low memory usage, and operational simplicity, with configuration split between client and server sides. It supports multiple transport options including TCP, TLS, Noise, and websocket, and can be run directly from release binaries, built from source, or deployed via Docker. The configuration-driven design also includes hot reload support and per-service authentication tokens.

sish is an open source SSH-based tunneling and forwarding service designed for people who want ngrok-style sharing without a custom client. It lets users expose local services over HTTP(S), WebSockets, or raw TCP by using standard SSH commands, and it can be self-hosted on their own infrastructure. The project is aimed at developers and operators who need quick sharing, private internal access patterns, or production-grade tunnel management. Its README highlights support for public and private workflows, TLS routing by SNI, alias-based access, load balancing, and a service console for inspecting forwarded requests. It provides Docker and binary releases, along with documentation for setup, forwarding patterns, and local development.

Pangolin is an open-source remote access platform aimed at teams and organizations that need secure, zero-trust connectivity to internal services. It is positioned as a way to expose web apps and private resources without opening public ports, using identity-aware access controls and tunneled connectivity built on WireGuard. The project supports both browser-based access to web applications and client-based access to resources such as SSH, databases, RDP, and entire network ranges. It also includes site connectors for NAT traversal, routing and load balancing, health checking, automatic SSL certificate handling, and role-based access control. The README indicates options for cloud use, self-hosting, and an enterprise edition, with clients available for major desktop and mobile platforms.