Self-hosted alternatives to Cloudflare Tunnel
Want exposing local services without opening ports without handing your data to Cloudflare Tunnel? These 4 self-hosted apps run on your own server. Cheapest estimated hosting starts at about $3.5/month.
About Cloudflare Tunnel: Cloudflare's outbound-only tunnel for exposing local services.
| App | Health | Stars | License | Docker | RAM (est.) | From |
|---|---|---|---|---|---|---|
| Pangolin direct | Active | 23.3k | AGPL-3.0 | ✓ | 1 GB | $5/mo |
| Firezone | Active | 9.2k | Apache-2.0 | ✓ | 1 GB | $5/mo |
| sish | Active | 4.8k | MIT | ✓ | 512 MB | $3.5/mo |
| HomeButler | Active | 314 | MIT | ✓ | 512 MB | $3.5/mo |
The options in detail
1. Pangolin
Identity-aware tunneled reverse proxy with dashboard UI, access control, and WireGuard-based tunnels (alternative to Cloudflare Tunnel, Tailscale).
Active Last commit 2026-11-04. 10+ releases in the past year. Latest release 1.26.0 (2026-11-04). Needs roughly 1 GB RAM. How to run it →
2. Firezone
Secure remote access gateway that supports the WireGuard protocol. It offers a Web GUI, 1-line install script, multi-factor auth (MFA), and SSO.
Active Last commit 2026-11-05. 10+ releases in the past year. Latest release headless-client-1.5.15 (2026-10-29). Needs roughly 1 GB RAM. How to run it →
3. sish
HTTP(S)/WS(S)/TCP tunnels to localhost using only SSH (serveo/ngrok alternative).
Active Last commit 2026-11-03. 10+ releases in the past year. Latest release v4.0.0 (2026-10-27). Needs roughly 512 MB RAM. How to run it →
4. HomeButler
Installs and manages a curated catalog of applications via Docker Compose, maps containers and exposed ports, verifies backups restore, and reports what changed since the last run with CLI, JSON, web and MCP interfaces.
Active Last commit 2026-11-01. Latest release v1.4.0 (2026-10-29). Needs roughly 512 MB RAM. How to run it →
Why self-host instead of Cloudflare Tunnel?
- Own your data — it lives on a server you control, with backups you decide on.
- Predictable cost — a small VPS often replaces per-seat pricing for a whole team or family.
- No lock-in — open-source licenses let you keep running the software even if a vendor disappears.
The trade-off: you are responsible for updates, backups and security. Pick an app marked Active (a commit in the last 90 days) and with Docker support for the easiest ride.
Browse related categories
Other alternatives guides
Cloudflare Tunnel is a trademark of its owner; this site is not affiliated with it. Listings come from the community-maintained awesome-selfhosted list.