If you've been relying on Cloudflare Tunnel to expose your local services to the internet, you already know its appeal. Zero open ports, automatic TLS, and global infrastructure — it's a compelling package. But Cloudflare Tunnel comes with trade-offs:

every byte of your traffic flows through Cloudflare's infrastructure, where they can read it, terminate TLS, and change their Terms of Service.

For developers and homelabbers who prioritise data sovereignty, privacy, or simply more control, these trade-offs are dealbreakers.

The good news? The open-source ecosystem has matured significantly, and in 2025 there are powerful, self-hostable alternatives that can replicate — and in some cases surpass — what Cloudflare Tunnel offers. This guide compares the best open-source Cloudflare Tunnel alternatives so you can make an informed decision for your infrastructure.

What Cloudflare Tunnel Actually Does (And Why People Leave)

Before diving into alternatives, let's be clear on exactly what we're replacing.

Cloudflare Tunnel provides a secure way to connect your resources to Cloudflare without a publicly routable IP address. With Tunnel, you do not send traffic to an external IP — instead, a lightweight daemon in your infrastructure (cloudflared) creates outbound-only connections to Cloudflare's global network.

Cloudflare Tunnels work by creating persistent outbound connections to Cloudflare's data centres. When an external request is made to your server, it passes through Cloudflare's data centres before being routed to your server through the connection opened earlier. Since visitors never make direct requests to your server, they never know its IP address — protecting you from attacks like Denial of Service, brute force, or port scanning.

It's elegant — but

after running it for a while, you hit the walls: a 100 MB upload limit per file, ToS restrictions on video streaming, and the fact that Cloudflare terminates your TLS and reads your traffic in plaintext on their network.

If you want more autonomy, less dependency, or simply want an option that better fits your own infrastructure, there are several tools worth considering.

The Self-Hosting Trade-Off: What You're Signing Up For

Before evaluating the tools, understand the fundamental shift:

the self-hosted alternatives require a VPS (roughly €4–$10/month) that you maintain yourself. The trade-off is control and privacy vs. convenience.

You become responsible for security hardening, updates, and uptime — tasks Cloudflare handles for you behind the scenes. For many teams, this is an entirely worthwhile exchange. Let's look at the tools that make it possible.

1. frp (Fast Reverse Proxy) — The Feature-Rich Workhorse

Best for: Developers needing multi-protocol support, web dashboards, and high configurability.

frp is a fast reverse proxy that allows you to expose a local server located behind a NAT or firewall to the Internet.

With over 85,000 GitHub stars, it's one of the most widely used open-source tunnelling tools in the world.

Unlike services like ngrok, frp is self-hosted — you control the server, you control the data, with no third party involved.

The architecture is straightforward:

you run frps (server) on a machine with a public IP, and frpc (client) on your local machine. The client establishes a connection through your firewall and traffic flows through the tunnel.

What makes frp stand out is its protocol coverage.

It supports TCP, UDP, HTTP, HTTPS, STCP (secret TCP), and even P2P connections — all from one tool.

frp supports the KCP protocol (reducing latency over lossy networks) and can handle multiple users with individual secret tokens.

If you're building a shared internal tunnelling service for your entire engineering team, frp is the architectural foundation.

Key strengths:
- Supports HTTP/HTTPS subdomain routing with custom domains
- Built-in web dashboard for monitoring
- Load balancing and high availability features
- Extensible via server plugins
- Cross-platform: Linux, macOS, and Windows

The catch: frp's power comes at the cost of configuration complexity.

It may involve more configuration steps compared to simpler alternatives.

2. Rathole — The Rust-Powered Performance Champion

Best for: Resource-constrained environments where throughput and stability matter most.

Rathole is an open-source reverse proxy solution written in Rust, known for its high performance and low resource consumption. It's designed to handle NAT traversal efficiently, achieving higher throughput and stability compared to similar tools.

The benchmarks are compelling:

rathole achieves much higher throughput than frp and is more stable when handling a large volume of connections, while consuming significantly less memory than similar tools.

One of rathole's most practical features is its binary footprint.

The binary can be as small as ~500KiB, fitting the constraints of embedded devices like routers.

This makes it an excellent choice for IoT deployments or environments where every megabyte counts.

Security is baked in rather than bolted on.

Service tokens are mandatory and service-wise — the server and clients are responsible for their own configurations. With the optional Noise Protocol, encryption can be configured with ease, with no need to create a self-signed certificate. TLS is also supported.

Rathole can dynamically add or remove services by hot-reloading the configuration file

— a significant operational advantage over tools that require restarts for configuration changes.

Key strengths:
- Exceptional performance and low RAM footprint
- Hot-reload configuration
- Mandatory per-service security tokens
- Noise Protocol and TLS encryption options
- Minimal, clean TOML-based configuration

3. Pangolin — The Closest Open-Source Cloudflare Tunnel Replacement

Best for: Homelabbers and small teams who want a polished, Cloudflare-like self-hosted experience.

If there's one project that's captured the homelab community's attention in 2025, it's Pangolin.

Pangolin is a self-hosted, identity-based remote access platform built on WireGuard that has rapidly become one of the most popular self-hosted projects in the homelab and infrastructure space.

Developed by Fossorial (a YC 2025 company), Pangolin combines reverse proxy and VPN capabilities into a single platform, providing browser-based access to web applications and client-based access to private resources, all with zero-trust security and granular access controls.

Pangolin is an open-source, self-hosted tunnelled reverse proxy with built-in identity and access control. Released in version 1.0 in early 2025, it aims to provide similar functionality to Cloudflare Tunnels while giving users full control over their infrastructure.

Where Pangolin genuinely surpasses Cloudflare Tunnel is in TCP support:

Cloudflare Tunnels only do HTTP/S, while Pangolin does TCP — which means you can expose SSH, databases, game servers, and more.

Traffic between your services and the Pangolin VPS is encrypted end-to-end using WireGuard with no plaintext in transit, built-in authentication with role-based access, and support for external identity providers like Authentik, Keycloak, or Google via OIDC.

Setup is genuinely approachable.

The installer handles Pangolin, Gerbil, Traefik, and Let's Encrypt configuration automatically. Deploying Newt on a remote machine is a single Docker container or binary with three environment variables, and the dashboard UI makes resource and user management accessible without touching config files.

Key strengths:
- Modern web dashboard — no CLI required for day-to-day management
- WireGuard-based end-to-end encryption
- TCP tunnelling beyond HTTP/S
- Built-in identity and access management with OIDC support
- Backed by a YC-funded company for sustained development

4. Headscale + WireGuard — The Privacy-First Mesh Network

Best for: Teams that need full device-to-device mesh networking without any third-party dependency.

If privacy is your priority and you want direct device-to-device connectivity, Tailscale can replace tunnelling entirely

— but Tailscale itself runs a proprietary control server. The open-source answer is Headscale.

If you want the Tailscale experience but with 100% self-hosting, Headscale is an open-source implementation of the Tailscale coordination server that works with official Tailscale clients.

Tailscale is a VPN product built on top of WireGuard that adds a coordination layer handling device discovery, key exchange, NAT traversal, and access control automatically. Tailscale clients connect to a coordination server — run by Tailscale Inc. or self-hosted via Headscale — to exchange public keys and network state, then establish direct WireGuard tunnels between devices.

For raw performance purists,

WireGuard is an extremely simple yet fast and modern VPN that utilises state-of-the-art cryptography, aiming to be faster and simpler than IPsec. Because it lives in the Linux kernel, it has almost zero overhead.

The key distinction between this approach and the others: Headscale/WireGuard creates a private mesh network between your devices rather than exposing a specific service to the public internet.

For organisations where Tailscale's trust boundary is unacceptable, Headscale plus the open-source Tailscale client recreates the architecture without the SaaS trust assumption — at the cost of running it yourself.

5. Chisel — The Firewall Bypasser

Best for: Corporate environments or networks where standard tunnelling ports are blocked.

Chisel (~12K GitHub stars) creates TCP tunnels over HTTP or HTTPS. Its superpower: it works through corporate HTTP proxies, making it useful when other tunnelling tools are blocked.

Chisel is a fast and modern tunnelling tool that leverages WebSockets for its connections — lightweight, easy to use, and suitable for both developers and system administrators.

Chisel is a fast TCP/UDP tunnel transported over HTTP and secured via SSH, with a single executable including both client and server, written in Go. It's mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network.

It also supports automatic TLS certificate acquisition from Let's Encrypt, making HTTPS setup frictionless.

Quick Comparison: Which Tool Should You Pick?

Here's a practical decision framework based on your primary use case:

And for those wanting the most Cloudflare-like experience:

if you want to remove third-party dependency and keep traffic, auth, and routing fully under your control, Pangolin is the most comparable self-hosted solution.

Practical Tips for Getting Started

Switching to a self-hosted tunnel takes more setup than cloudflared tunnel create, but these steps will save you headaches:

  1. Start with a cheap VPS.

A VPS with a public IP acts as your "Cloudflare" — an outbound-only tunnel from your local machine to the VPS.

Budget providers like Hetzner or DigitalOcean offer suitable plans for $4–$6/month.

  1. Lock down your VPS immediately. Disable password SSH authentication, use UFW to restrict open ports, and keep your server patched. Your VPS is now your security perimeter.

  2. Use Docker Compose for deployment. All five tools above have community-maintained Docker images. Containerising your tunnel server simplifies upgrades, rollbacks, and log management.

  3. Pair with a reverse proxy. For HTTP services, sit Caddy or Traefik in front of your tunnel server. Both handle automatic Let's Encrypt certificates, making HTTPS effortless.

  4. Test reconnection behaviour. Before going to production, simulate a network drop and verify your tunnel client auto-reconnects.

Rathole's reconnection behaviour is configurable, and its lower base resource usage means it is less likely to be starved of CPU or memory during a high-load event that might trigger a disconnect.

  1. Monitor your tunnel traffic. frp's built-in dashboard and Pangolin's web UI both provide visibility into active connections. Don't run a public-facing tunnel without observability.

  2. Don't abandon Cloudflare entirely if you benefit from it.

You can use Cloudflare Tunnels for some services and an open-source alternative for others

— keeping Cloudflare for workloads that benefit from their CDN and DDoS protection, and routing sensitive or high-bandwidth services through your own infrastructure.

Conclusion: Own Your Tunnel, Own Your Data

The open-source tunnelling landscape in 2025 has never been stronger. Whether you need frp's Swiss Army Knife flexibility, rathole's Rust-powered efficiency, Pangolin's polished homelab experience, or Chisel's ability to escape locked-down networks, there is a self-hosted solution that matches your requirements.

The best Cloudflare Tunnel alternative isn't about picking the "most famous" tool — it's about choosing the one that fits your exact workflow: simplicity, security, control, protocol support, and cost.

Ready to break free from third-party tunnelling dependencies? Start with Pangolin if you want the smoothest transition from Cloudflare Tunnel, or dive into frp if you need maximum configurability. Bookmark this guide, spin up a $5 VPS, and take back control of your infrastructure today. Have questions about which tool suits your stack? Drop them in the comments — we read every one.