alternatives to
Outbound-only connector that publishes services from a private network through Cloudflare's edge. A closed product from Cloudflare.
| Tool | Fit | Stars | Licence | Terms | Self-hosted | Language | Latest | Last push |
|---|---|---|---|---|---|---|---|---|
| Pangolin | Full replacement | 23k | Other | Open core | Yes | TypeScript | 1.24.0 | 2026-10-05 |
| frp | Partial | 110k | Apache-2.0 | Open source | Yes | Go | v0.71.0 | 2026-09-15 |
| zrok | Partial | 4.8k | Apache-2.0 | Open source | Yes | Go | v2.0.7 | 2026-10-06 |
| Octelium | Partial | 4.1k | AGPL-3.0 | Open source | Yes | Go | v0.44.0 | 2026-10-05 |
4 alternatives
Modern networking and security platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users.
WireGuard tunnels from private networks to a reverse proxy you run, with access control in front of each resource.
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
Publishes services from a private network through a server you run over an outbound client connection, without access policies or a CDN.
Secure internet sharing made simple.
Publishes private services through an OpenZiti overlay with outbound connections only, without a CDN or per-application access policies.
A next-gen FOSS self-hosted unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA platform, API/AI/MCP gateway, a PaaS, an ngrok-alternative and a homelab infrastructure.
Publishes private resources publicly or behind identity-based access policies through a cluster you run on Kubernetes, without a CDN.