Network Security (VPN, Firewall, WAF)

20 self-hosted open source alternatives in this category

Pi-hole

Network-wide ad blocking via DNS sinkhole

DNS sinkhole that blocks ads, trackers, and malicious domains network-wide with a web dashboard, per-client controls, and optional DHCP/DNS features.

Alternative to:

NextDNS+1

CyberChef

The Cyber Swiss Army Knife for data analysis and decoding

33.7k

3.8k

Last commit: 5mo ago

Browser-based tool for decoding, encoding, encryption, and data analysis using a drag-and-drop “recipe” workflow for security, DFIR, and engineering tasks.

Alternative to:

CrackStation (online hash cracking/lookup)+4

AdGuard Home

Network-wide ads and tracker blocking via DNS

31.9k

2.2k

Last commit: 14d ago

Self-hosted DNS server with ad/tracker blocking, custom filtering, parental controls, encrypted DNS, and per-client statistics for home networks.

Alternative to:

NextDNS+1

Nginx Proxy Manager

Web UI for Nginx reverse proxy with Let's Encrypt SSL

30.9k

3.5k

Last commit: 1mo ago

Web-based reverse proxy manager for Nginx with hosts, streams, access lists, and automatic Let's Encrypt certificates via an easy admin UI.

Alternative to:

NGINX Plus+5

SafeLine

Self-hosted WAF for protecting web apps and APIs

20k

1.3k

Last commit: 2mo ago

SafeLine is an open-source web application firewall (WAF) that protects web apps and APIs from common attacks using HTTP traffic inspection, rules, and management UI.

Alternative to:

Cloudflare WAF+4

Teleport

Identity-native infrastructure access for SSH, Kubernetes, RDP and DBs

19.6k

Last commit: 2d ago

Open-source platform that provides unified, audited, identity-based access to servers, Kubernetes clusters, databases, and desktops without static credentials.

Alternative to:

Okta Advanced Server Access+2

Pangolin

Self-hosted secure tunneling and access gateway

17.8k

526

Last commit: 4d ago

Pangolin provides a self-hosted access gateway for securely exposing internal apps via tunnels, with identity-aware access controls and a web UI.

Alternative to:

Cloudflare SSL/TLS and reverse proxy features+3

Stalwart Mail Server

All-in-one secure mail server with modern spam filtering

11.1k

598

Last commit: 3d ago

Stalwart is an all-in-one mail server (SMTP/IMAP/JMAP) with built-in anti-spam/DMARC, web admin UI, and flexible routing for running your own email infrastructure.

Alternative to:

Microsoft Exchange Online+9

SimpleX Chat

Private messaging without user IDs or phone numbers

10.2k

539

Last commit: 11d ago

Privacy-first messenger using SimpleX relays and end-to-end encryption, designed to avoid user identifiers, phone numbers, and centralized identity.

Alternative to:

Signal+5

BunkerWeb

Web application firewall and security reverse proxy

9.7k

554

Last commit: 1mo ago

Self-hosted WAF and reverse proxy built on NGINX, with a web UI, ModSecurity/OWASP rules, automatic HTTPS, and hardened defaults for securing web apps.

Alternative to:

Cloudflare WAF+5

Termix

Web-based SSH terminal and host management workspace

9.5k

385

Last commit: 7d ago

Self-hosted web app for managing SSH connections, organizing hosts, and accessing terminals from a browser with a focus on team-friendly workflows.

Alternative to:

BeyondTrust Privileged Remote Access+2

Technitium DNS Server

Authoritative, recursive DNS with web UI and ad blocking

7.2k

607

Last commit: 20d ago

Self-hosted DNS server with recursive resolver, authoritative zones, DoH/DoT, ad-blocking, DHCP, and a web UI with optional app-based extensibility.

Alternative to:

NextDNS+2

Warpgate

Smart SSH bastion with web UI, RBAC, and audit logs

6.3k

224

Last commit: 2d ago

Self-hosted SSH bastion and access gateway with web UI, RBAC, just-in-time access, session recording, and audit logging for servers and infrastructure.

Alternative to:

Okta Advanced Server Access+2

HAProxy

High-performance TCP/HTTP load balancer and reverse proxy

6.2k

893

Last commit: 3d ago

HAProxy is a fast, reliable load balancer and reverse proxy for TCP/HTTP(S), with TLS termination, health checks, advanced routing, and built-in observability features.

Alternative to:

NGINX Plus+4

Blocky

Fast DNS proxy with ad-blocking and safe browsing

5.9k

257

Last commit: 25d ago

Lightweight DNS proxy and local DNS server with blocklists, allowlists, custom DNS rules, caching, and optional DoH/DoT upstream for network-wide ad and tracker blocking.

Alternative to:

NextDNS+1

Zoraxy

Lightweight reverse proxy with a web UI and built-in tools

4.8k

269

Last commit: 6d ago

Self-hosted reverse proxy and HTTP(S) gateway with a web UI, TLS support, routing rules, and traffic/security utilities for homelabs and small servers.

Alternative to:

Cloudflare SSL/TLS and reverse proxy features+3

Apache Guacamole

Clientless remote desktop gateway for RDP, VNC, and SSH

3.6k

731

Last commit: 3d ago

Web-based remote access gateway that provides clientless RDP, VNC, and SSH sessions via a browser, with centralized authentication and connection management.

Alternative to:

TeamViewer+5

SWAG

Nginx reverse proxy with automated SSL certificates

3.5k

280

Last commit: 6d ago

Dockerized Nginx reverse proxy with automatic Let’s Encrypt SSL, security hardening, and a large set of ready-to-use proxy configurations.

Alternative to:

NGINX Plus+2

Sshwifty

Web-based SSH and Telnet client for your browser

391

Last commit: 1mo ago

A lightweight web SSH/Telnet client with a terminal UI, bookmarks, and optional authentication for securely accessing remote hosts from a browser.

Alternative to:

Web-based SSH gateways (commercial)+3

ShellHub

Centralized SSH access gateway for fleets of devices

1.9k

169

Last commit: 2d ago

ShellHub is a self-hosted SSH access gateway for managing and auditing remote access to servers and IoT devices with RBAC, device inventory, and session visibility.

Alternative to:

Okta Advanced Server Access+6