Networking

frp109.5k★

Frp (Fast Reverse Proxy) creates a tunnel from your local machine to a public server. Think ngrok, but you run the server yourself and pay nothing. Apache 2.0 license, written in Go. You run frps (server) on a VPS with a public IP, and frpc (client) on your local machine. Configure which local ports to expose, and frp handles the tunneling. Supports TCP, UDP, HTTP, HTTPS, and STCP (secret TCP for peer-to-peer). Dashboard included for monitoring connections. Fully free. No paid tier, no hosted version. You bring your own VPS. Setup: get a cheap VPS ($3-5/mo), install frps, configure frpc on your local machine. Takes about 15 minutes. Ongoing ops: almost none. frp is a single binary that just runs. Solo developers: perfect for exposing local dev servers, home lab services, or self-hosted apps. Small teams: works well for sharing internal services. The catch: you need a VPS with a public IP, which means some cost and basic server knowledge. The config file format is straightforward but not as instant as `ngrok http 3000`. And there's no built-in auth or rate limiting on exposed endpoints; you handle security yourself.

Traefik64.9k★

Traefik is a reverse proxy that automatically routes traffic to the right service as you deploy containers. It discovers your services from Docker, Kubernetes, or config files and configures routing without you manually editing nginx configs. Go, MIT. The auto-discovery is the killer feature. Label your Docker containers with routing rules and Traefik picks them up. Add a new service, Traefik routes to it. Remove one, it's gone. No reload, no restart. Free automatic Let's Encrypt certificates built in. Traefik Proxy (the open source core) is free and handles most use cases: HTTP/TCP/UDP routing, load balancing, auto-discovery, Let's Encrypt, middleware (rate limiting, auth headers, redirects), and a basic dashboard. Traefik Enterprise adds: distributed configuration, RBAC, WAF, OpenID Connect auth, high availability clustering, and dedicated support. Pricing is custom and not published. Expect enterprise-level quotes. Solo: free Traefik Proxy with Docker is the easiest reverse proxy setup you'll find. Small teams: same. It handles multi-service deployments beautifully. Medium teams on Kubernetes: free Traefik IngressRoute works, but evaluate Traefik Enterprise or alternatives for advanced security. Large: Enterprise or evaluate cloud-native options. The catch: the configuration model has two flavors (file-based and dynamic) and mixing them gets confusing. The documentation is comprehensive but scattered. And the Enterprise licensing is opaque. No public pricing means you can't evaluate cost without a sales call.

Headscale43.9k★

Headscale is the self-hosted replacement for Tailscale's coordination server. Your devices still run the official Tailscale clients and still build direct WireGuard tunnels to each other; the difference is that the server telling them who's who is yours. BSD-3 licensed, completely free, community-driven, no paid tier. Running it is a single binary with SQLite, light enough for a Raspberry Pi, though it needs a publicly reachable endpoint. The 0.29 release closed a real chunk of the gap with Tailscale's SaaS: grants for application-level policy, SSH sessions that can require fresh OIDC approval, and policy tests that reject a bad ACL before it lands. One upgrade gotcha: wildcard ACLs no longer mean all IPs, and hostname collisions now renumber, which can change MagicDNS names. Solo and homelab: free, and one of the most popular self-hosted networking tools going. Small teams: real savings vs Tailscale's $6/user/mo once you pass a handful of users. Large orgs: Tailscale's managed offering buys support and compliance you'd otherwise staff yourself. The catch: you're the support team. No admin dashboard polish, no device posture checks, and DERP relays for hard NAT cases are extra setup or a dependency on Tailscale's public ones.

sing-box38.2k★

sing-box tunnels your internet traffic through encrypted proxies, and it speaks basically every protocol in the space: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and more. It replaced a pile of separate tools as the engine behind most modern proxy clients, and the whole thing is free under GPL v3, including the official iOS and Android apps. Self-hosting is light on resources and heavy on configuration. The single Go binary runs anywhere (Linux, macOS, Windows, routers) and sips memory, but everything is driven by a JSON config of inbounds, outbounds, and routing rules. The docs are reference-style: accurate, complete, and not gentle. Budget an evening for your first working setup. Solo: this is the standard for self-hosted proxy infrastructure, use it. Small teams running their own private network access: solid, paired with the official clients. Companies that want managed device access should look at a mesh VPN like juanfont/headscale instead; sing-box is a proxy platform, not a device management plane. The catch: the config format changes between major versions and migration is on you. And depending on your country and your network's policies, running proxy infrastructure can carry real legal risk. Know the rules before you deploy.

AdGuard Home37.0k★

AdGuard Home blocks ads, trackers, and malware across every device on your network by running as your DNS server, no per-device installs needed. Every DNS request goes through it, and it blocks the ones that resolve to ad servers or trackers. It's a bouncer for your network's internet traffic. Everything is free under GPL-3.0. No paid tier for AdGuard Home itself. (AdGuard the company sells a separate VPN/ad-blocking app; that's a different product.) The Home DNS server is fully featured: custom blocklists, per-client settings, encrypted DNS (DoH/DoT/DoQ), DHCP server, query logging, and a clean web dashboard. Self-hosting is the only option. Run it on a Raspberry Pi ($35-60), a spare computer, a Docker container, or a VPS. Initial setup takes 15-30 minutes: install the binary, point your router's DNS to it, pick your blocklists. Ongoing maintenance is minimal; update the binary occasionally, review your logs if you're curious. Solo: install it at home. The quality-of-life improvement is immediate: YouTube ads on smart TVs, tracking on every device, gone. Small teams: run it on your office network. Growing teams: it's a home/small-office tool, not enterprise DNS. The catch: DNS-level blocking can't stop everything. Ads served from the same domain as content (like some YouTube ads) slip through. And occasionally a legitimate service breaks because its domain is on a blocklist, and you'll be the family IT person debugging why a website doesn't load.

Tailscale36.6k★

Tailscale creates a private network that works everywhere without opening ports or configuring firewalls. It uses WireGuard (the fast, modern VPN protocol) underneath, but handles all the key exchange, NAT traversal, and device management that makes WireGuard hard to set up yourself. The free tier covers up to 100 devices and 3 users. That's generous. Most personal and small team use cases fit comfortably. You get encrypted connections, MagicDNS (access devices by name), subnet routing, and exit nodes. Paid plans start at $6/user/mo for the Starter tier (adds more users, ACL policies). Business is $18/user/mo with SSO, device posture checks, and custom DERP servers. The catch: the coordination server (the part that manages keys and device registration) is proprietary. Your actual traffic goes peer-to-peer and never touches Tailscale's servers, but device management depends on them. If Tailscale disappears, your network stops working. Headscale is the open source alternative coordination server if that dependency bothers you. Also, Tailscale is BSD-licensed, which is unusually permissive for a VC-funded company. Appreciate that while it lasts.

Envoy28.9k★

It's the data plane behind Istio, AWS App Mesh, and dozens of service meshes. Everything is free under Apache 2.0. No paid tier from the Envoy project itself. It's a CNCF graduated project, which means it's been vetted for production use by the Cloud Native Computing Foundation. Maintained by a large contributor base including engineers from Google, Lyft (where it was created), and Microsoft. Self-hosting is the only option, and the ops burden is significant. Envoy is powerful but complex. Configuration is verbose YAML. The learning curve is steep if you're not already in the service mesh world. Most teams don't run Envoy directly. They use it through Istio or a gateway controller. Solo developers: you don't need this. Use Nginx or Caddy. Small teams with a few services: still probably overkill. Use Traefik or Caddy. Growing teams with 10+ microservices: this is where Envoy starts making sense, especially through Istio or a gateway API. The catch: Envoy is infrastructure for infrastructure people. The configuration complexity is legendary. Unless you're building a service mesh or need advanced traffic management (circuit breaking, retries, observability), simpler proxies do the job with 10% of the config.

Nebula18.4k★

Nebula creates an encrypted overlay mesh that connects machines across different networks into one private network. It's a VPN that doesn't need a central server to route all traffic. Every node connects directly to every other node, peer-to-peer. MIT license, Go. Built by Slack's infrastructure team for their own use, then open sourced. Uses a lighthouse node for discovery (helps nodes find each other) but actual traffic flows directly between peers. WireGuard-style encryption, runs on Linux, macOS, Windows, iOS, and Android. Fully free. No paid tier, no managed service. Defined Networking (the company behind it) sells a managed control plane but Nebula itself is completely free to self-host. Solo: overkill unless you're connecting personal machines across locations. Small teams (2-10): solid for connecting dev environments to cloud resources without exposing ports. Medium to large: this is where Nebula shines: hundreds of nodes across cloud providers and offices on one flat network. The catch: you're building your own network infrastructure. Certificate management, firewall rules, lighthouse configuration, it's not hard but it's not "install and go" either. If you just need remote access to a few servers, Tailscale (which is built on WireGuard) is dramatically simpler. Nebula is for teams that want full control and are willing to manage it.

ZeroTier17.1k★

ZeroTier creates a virtual network between your devices, your office, and your cloud VMs. No port forwarding, no VPN server to maintain. Install the agent on each machine, join a network ID, and they can talk to each other directly, peer-to-peer. ZeroTier uses its own protocol (not WireGuard), handles NAT traversal, and supports both layer 2 and layer 3 networking. That layer 2 support is a genuine differentiator: you can bridge entire network segments across the internet, which Tailscale (layer 3 only) cannot do. The self-hosted controller option gives you full control over your network infrastructure with no dependency on a third party. The license is BSL 1.1 (converts to Apache 2.0 after 4 years), so it's source-available with eventual open source. The catch: Tailscale has gained significantly more developer traction in recent years. It's simpler to set up, uses WireGuard (which is audited and well-trusted), and has a larger integration ecosystem. If you don't need layer 2 networking or full self-hosting, Tailscale is the easier choice. But if either of those matters to you, ZeroTier is the tool that actually delivers them.

transmission15.2k★

Transmission moves files over BitTorrent without turning your machine into an ad billboard. BitTorrent is the protocol that downloads a file in pieces from many people at once instead of from one server, and Transmission is the client that drives it. Free and open source since 2005, with native apps for macOS, Windows, Linux, and BSD, plus a headless daemon and a web UI. The daemon is the interesting part if you run anything always-on. transmission-daemon sits on a NAS or a Raspberry Pi and you drive it from the web UI or a remote client. Setup is a config file and a systemd unit, nothing exotic. Memory footprint stays small enough that it disappears next to everything else on the box. Free at every tier, so the only real question is which client you prefer. qBittorrent gives you built-in search, Deluge gives you a plugin system. Transmission wins on being light and boring, which is what you want from something seeding for weeks unattended. The catch is that lightness costs features. No built-in search, no RSS auto-download without a third-party script, and the bandwidth scheduler is basic next to qBittorrent's. Separately, BitTorrent itself exposes your IP address to every peer in the swarm. That is a VPN problem, not something any client solves for you.

rathole14.2k★

Rathole punches a hole through without opening ports on your router. It's essentially a tunnel from your private network to a public endpoint. Written in Rust, so it's fast and lightweight. We're talking single-digit MB of RAM. Compared to frp (the other big player here), rathole uses less memory and handles more concurrent connections. Setup is straightforward: a config file on the server side, a config file on the client side, done. Everything is free. No paid tier, no cloud service, no catch on features. You self-host both ends. Docker image available, or grab the binary. The catch: you need a server with a public IP to act as the relay. If you don't already have a VPS, that's $5/mo minimum. And the docs are thin: the README covers the basics but you'll be reading config examples more than prose. Solo devs and home labbers, this is your tool. Teams needing managed tunnels with dashboards should look at Cloudflare Tunnel (free) or ngrok instead.

clash-nyanpasu13.2k★

Clash Nyanpasu is a free desktop app that turns a network proxy into a point-and-click dashboard. Instead of hand-editing config files, you load a subscription or profile, flip between servers, and route your traffic through them. People use it to control exactly how their internet traffic is routed, most often to get around network filtering or reach restricted resources. It runs on Windows, macOS, and Linux, it's built on Tauri so it's light, and it's open source under GPL-3.0. What sets it apart from simpler clients is the scripting layer. You can extend and transform configs with YAML, JavaScript, and Lua, swap between proxy cores (Mihomo, Clash Premium, a Rust core), and manage providers from a clean Material You interface. One thing to know: the app is only a client. It does nothing on its own. To get any value you have to bring your own proxy, either a subscription URL from a provider or a server you run yourself. Installing the app is easy; having somewhere to route traffic is the actual prerequisite. It sits in the Clash Verge lineage, one of several descendants of that GUI tradition, and it's actively developed, though worth knowing the maintainers have gone a long stretch without cutting a stamped stable release while shipping current dev builds. For a developer who already has a proxy setup and wants a polished, scriptable way to manage it, this is a strong pick. If you're after a turnkey commercial VPN that includes the servers, this isn't that, and it isn't trying to be. The catch is the bring-your-own-server reality. Nyanpasu is the steering wheel, not the car. It's also worth being clear-eyed that this is traffic-routing and circumvention tooling, so use it deliberately and within whatever rules apply to you.

firezone9.1k★

Firezone is a zero-trust remote access platform built on WireGuard. Group-based policies replace the all-or-nothing VPN model: each resource (host, subnet, service) has its own access rules, and users only see what they are allowed to reach. The current product is the second-generation Firezone, a full rewrite of the original self-hosted product. License is the part to read carefully. Elixir components ship under Elastic License 2.0, the rest is Apache 2.0. The team explicitly says self-hosting is permitted for educational and hobby use but is not officially supported for production, and that internal APIs change rapidly. That makes the cloud product the intended deployment, not a nice-to-have. Setup of the cloud version is genuinely fast: connect an identity provider, deploy gateways via Docker, define resources and policies. Solo developers and homelabs get the free cloud tier with up to 6 users, which is enough for most personal setups. Small teams scale to Team at $5 per user per month. Enterprises pay for directory sync, audit logs, and SLA support. The catch is the open source posture is closer to source-available than truly open. If you want a fully self-hostable zero-trust platform with no vendor commitment, look at Tailscale's open source Headscale implementation or Twingate's alternatives. Pick Firezone when you want a managed service backed by code you can audit, not a self-hosted product.

mullvadvpn-app7.6k★

Mullvad is that. No accounts, no profiles. You get a random number as your ID, pay your money, and connect. The client app is fully open source so you can verify it does what it claims. GPL v3, written in Rust. The app supports WireGuard and OpenVPN, has a kill switch, split tunneling, and DNS leak protection. Available on Windows, macOS, Linux, Android, and iOS. The Rust codebase means the app itself is fast and resource-light. This is NOT a free tool. Mullvad costs 5 EUR/mo (~$5.50 USD) with no discounts for longer commitments. Everyone pays the same. You can pay with cash mailed in an envelope, crypto, or card. No free tier. The open source part is the client app. You can build it yourself and connect to Mullvad's servers, or theoretically point it at your own WireGuard server. But the value is the server network, and that's paid. Solo users who care about privacy: this is the VPN to use. Teams needing business VPN features (centralized management, SSO): look elsewhere. The catch: no free tier means you're paying from day one. The server network is smaller than NordVPN or ExpressVPN. And 5 EUR/mo with no annual discount makes it pricier than competitors who offer $3/mo on 2-year plans. You're paying a premium for the privacy model.

blocky7.0k★

Blocky is a DNS proxy that filters requests before they reach your devices. Same concept as Pi-hole but written in Go, runs as a single binary, and needs zero dependencies. No database, no web server framework, no PHP. Point your router's DNS at Blocky, configure your blocklists, and every device on your network stops loading ads and trackers. It supports DNS-over-HTTPS, DNS-over-TLS, conditional forwarding, and client-specific rules. Apache 2.0. Fully free. No paid tier, no cloud version. Self-host only. The catch: Blocky has no web dashboard out of the box. Pi-hole gives you a slick admin panel with graphs and query logs. Blocky gives you a config file and an API. If you want a UI, you'll need to set up Grafana or a third-party frontend. For people comfortable with YAML config files, that's fine. For everyone else, Pi-hole's UI is hard to beat.

gobgp4.1k★

GoBGP is BGP without the hardware router. BGP is the protocol that decides how traffic moves between networks, and historically you ran it on a Cisco or Juniper box or a heavyweight legacy daemon. GoBGP is a clean, modern implementation written from scratch in Go that runs as a standalone daemon or, more interestingly, as a library you drive over a gRPC API. That makes it the go-to when you want to build BGP control into your own software: route injection, SDN controllers, anycast automation. The install is easy, a single Go binary and a config file. Operating it is not. BGP is unforgiving, and peering, route policy, and filtering still demand real networking knowledge no matter how clean the tool is. It supports the features that matter in production: route reflection, EVPN, flowspec, RPKI, and Zebra integration. It is Apache-2.0 and entirely free, with no paid tier. For a plain software router, FRRouting and BIRD are the usual alternatives and have broader feature sets for traditional routing. GoBGP wins when you want BGP as a programmable building block rather than a box you configure. Solo, small, or large team: the cost is your time and expertise, not a license. The catch is that a BGP mistake does not throw an error, it silently moves traffic. The tooling cannot save you from a bad policy, and the ecosystem around GoBGP is smaller than FRR's, so you will lean on the docs and the source more than on Stack Overflow.

octelium4.1k★

Octelium is a self-hosted zero trust platform that replaces your VPN, your reverse proxy, and your access gateway in one shot. Instead of "connect to the network and hope firewall rules hold," every request gets identity-checked at the application layer. WireGuard and QUIC tunnels for client access, plus clientless BeyondCorp-style browser access. A single-node cluster runs on 2GB RAM. Install script, point it at your identity provider, define access policies in CEL or OPA, and your internal services are accessible without ever exposing ports to the internet. Passwordless SSH, secretless database access, and full OpenTelemetry audit logs come standard. Solo developers with a homelab or a few VPS instances: this replaces Tailscale's self-hosted needs without the coordination server dependency. Teams running internal services: this is Cloudflare Access without the vendor lock-in or per-seat pricing. The catch: AGPLv3 on the cluster components. If you are building a commercial product that embeds Octelium, you will need the commercial license. For internal use, the AGPL is irrelevant.

sozu3.7k★

A reverse proxy that can reload its configuration without dropping a single connection. If you're running web services and need a load balancer in front of them, Sozu does what nginx and HAProxy do, but with true zero-downtime config changes: no reload signal, no worker restart, no connection reset. Written in Rust. Memory-safe, fast, lightweight. Handles HTTP/1.1, HTTP/2, WebSocket, and TLS. The config changes happen through a command socket: you send a message, the proxy updates instantly. No file edits, no restarts. Small but the project has been around since 2016, originally built by Clever Cloud (a French PaaS provider) for their own infrastructure. Completely free under AGPL-3.0. No paid tier. The catch: the ecosystem is tiny compared to nginx or Traefik. Documentation is sparse. Community support is limited; you're mostly on your own. If hot config reloading is your primary requirement, Envoy and HAProxy also handle this well with much larger communities. Sozu is interesting technology but unless you specifically need Rust-native proxy with zero-downtime reloads and don't mind being an early adopter, nginx or Traefik are safer choices.

HypoMux3.6k★

HypoMux aggregates multiple network connections on one Windows machine so a download can pull from Ethernet, Wi-Fi, and a phone hotspot at the same time. It assigns each new connection to an adapter rather than splitting a single TCP stream, so it speeds up anything that opens many connections at once: Steam, IDM, game launchers, big browser downloads. AGPL-3.0, free, no paid tier. Installation is a signed Windows installer, with Authenticode signing through SignPath, more supply chain hygiene than most single-maintainer Windows projects bother with. System Proxy mode takes over the Windows proxy setting and works with anything proxy-aware. Virtual NIC mode uses Wintun and sing-box to catch broader traffic, and because it owns routing, DNS, and WFP it cannot share the default route with another TUN, so it will fight your VPN client. The UI runs unelevated and hands privileged work to a separate service, which is the correct design. Solo on a mediocre connection with a second link available: this is the tool, and the price is zero. Anyone already saturating one pipe gets nothing, because HypoMux cannot make a single connection faster than that connection allows. Speedify is the commercial equivalent at $14.99 a month and bonds traffic through its own servers; HypoMux does the local half free and keeps your packets on your own links. Windows 10 and 11 only, and the README is upfront that this is for your own devices and connections, not for getting around anyone's access controls. One maintainer, who is also the sole approver on the signing key. The engineering is careful, but the bus factor is one.

easylist3.1k★

The filter lists that tell it what to block probably come from EasyList. It is the most widely used ad-blocking filter subscription, maintained by a community of contributors who track and block ad domains, trackers, and annoyances across the web. You do not use EasyList directly. It is a dependency of the tools you already use. When your ad blocker updates its filters, it is pulling from lists like these. The catch: this is a filter list, not software. You do not install it, build with it, or self-host it. It is useful to know about because it powers the ad-blocking ecosystem, but it is not a tool you evaluate the same way as a database or framework.

neqo2.2k★

neqo is Mozilla's implementation of QUIC and HTTP/3 written in Rust, the same code that powers networking inside Firefox. QUIC is a faster, more reliable replacement for TCP, the protocol most internet traffic still rides on, and HTTP/3 is the newest version of the web protocol built on top of it. neqo gives you QUIC transport, HTTP/3, and QPACK header compression as Rust libraries, dual-licensed under Apache 2.0 and MIT. This is not an app you install. It's library code you compile into your own networking software, plus a couple of command-line tools for testing HTTP/3 clients and servers. Using it means working at the protocol level in Rust, deep specialized engineering, not a weekend integration. Who is this for: teams building browsers, networking stacks, or protocol-level tooling who need a real QUIC implementation and want Mozilla's. Everyone else almost certainly wants a higher-level library like quinn instead. There is no paywall and no team-size split, since it's a building block, not a product. The catch: Mozilla flat out says the server side is experimental and warns against running it in production. The client and transport are battle-tested inside Firefox, but treat the server code as a lab tool, not something you put in front of real traffic.

Meshtastic-Android1.8k★

Meshtastic-Android is the phone app for a mesh network that runs on cheap LoRa radios and needs no cell service, no carrier and no internet. You pair a radio over Bluetooth and get encrypted text messaging, position sharing and telemetry across a mesh that relays through every other node in range, which is why it gets used for hiking, off-grid property, disaster response and events where the cell towers are saturated. GPL-3.0, and there is also a Compose Desktop build. The app is the easy part. Install from GitHub releases (pair with Obtainium for auto-updates) or from the store; the `fdroid` flavor drops the Google Crashlytics and Maps dependencies if you want nothing phoning home. The actual work is the hardware and the firmware, which lives in a separate repository. Recent additions include mesh network discovery, waypoint geofences that alert when nodes cross a zone, encrypted backup of device security keys, NFC contact sharing, XEdDSA packet signing indicators and air-quality telemetry. Free, no tiers, no accounts, backed by The Document Foundation model of an open collective rather than a company. The money goes to radios: a usable LoRa node runs roughly $25 to $60, and you need at least two. The catch is bandwidth. LoRa is measured in bytes per second, not megabits. Text and coordinates work. Anything resembling a photo, a voice note or a web page does not, and no amount of app polish changes the physics.

vpp1.6k★

VPP moves network packets through software at speeds people used to need custom hardware for. It runs a full router and switch on a standard x86 or ARM server: routing, switching, tunneling, ACLs, NAT, and more, processing packets in batches to stay fast. Apache 2.0, hosted by the FD.io project and originally built at Cisco. This is infrastructure plumbing, not an app. You get the best performance on bare metal with the network card bound to DPDK and CPU cores pinned to packet work. Pre-built packages exist, but tuning VPP for real throughput means understanding hugepages, core affinity, and your NIC. It is built for people who create network functions, not people who consume them. If you are building a software router, a load balancer, a 5G data plane, or a high-throughput gateway, VPP is one of the few open projects that performs at carrier scale. Solo developers and product teams almost never need this. Network engineering teams, telcos, and infrastructure vendors are the audience. For ordinary service-to-service networking, a service mesh or a cloud load balancer is the right tool. The catch is the learning curve. VPP is powerful and well documented, but the core concepts (graph nodes, vectors, plugins) are unfamiliar even to experienced network engineers. Expect a real ramp before you ship anything on it.

batfish1.5k★

Batfish finds network outages before you cause them. Feed it your device config files (Cisco, Juniper, Arista, Palo Alto, 20+ vendors) and it builds a model of your whole network, then answers questions like: is this ACL reachable, does this route black-hole, will tomorrow's change break the VPN? It works offline from the configs alone, no access to live devices, Apache-2.0 and free. Running it is one Docker container and about 8GB of RAM. You talk to it through pybatfish, a Python SDK, usually from Jupyter notebooks. There is no dashboard; if your network team doesn't touch Python, that's the adoption wall. Use it when config changes get reviewed by eyeball and deployed on hope. It's the closest thing to CI for network changes that doesn't cost enterprise money. Commercial tools like IP Fabric and Forward Networks do this with polish and support contracts; Batfish does the core analysis for free. The catch: the company behind it was acquired by AWS in 2022, and the open source project moves slower than it used to. It still ships, but watch the release cadence before betting your change pipeline on it.

docktail1.2k★

Docktail does it with labels. Add a label to your Docker container, and Docktail automatically registers it as a Tailscale service. No port forwarding, no VPN configs, no firewall rules. This solves a specific pain point: you have a dozen self-hosted services in Docker and you want them accessible from your phone, laptop, or remote machines over Tailscale, without opening ports to the internet. Docktail watches your Docker daemon and handles the Tailscale registration automatically. AGPL-3.0, fully free. You need a Tailscale account (free for personal use, up to 100 devices). The catch: AGPL-3.0 is aggressive copyleft. If you modify this and serve it, you owe the source code. The project is very early. Small community, limited documentation, and if the maintainer moves on, you're forking it yourself. Also, Tailscale itself has limits on the free tier (3 users).

dnsglobe1.2k★

dnsglobe answers the question every DNS change raises: has it propagated yet? Run it in your terminal and it queries 34 public resolvers around the world in parallel, draws a world map showing where each answer came from, and flags the resolvers still serving stale records. Free and MIT-licensed, written in Rust. There's nothing to host. Install it from Homebrew, Cargo, the AUR, Nix, or a prebuilt binary and run it like you'd run dig. Green means everyone agrees, magenta means someone is behind, red means a resolver errored. It replaces the whatsmydns.net tab you open during every domain move, with the advantage that it lives where you already work. Anyone who touches DNS during deploys, migrations, or cert changes should keep it installed. No pricing math here; it's a free CLI. The catch: the world map wants a 150-column terminal, and ISP resolvers that refuse outside queries can't be checked, so you're seeing the public resolver view, not every network on earth.

samba1.1k★

Samba is the open source SMB/CIFS server that lets Linux and Mac machines share files with Windows clients (and vice versa). It also runs as an Active Directory domain controller, which is the bigger story for anyone trying to host Windows infrastructure without paying for Windows Server. GPLv3, mature, and shipped in basically every Linux distribution. Self-hosting is well-trodden ground. Most distros have working defaults, and the community has documented every combination of share permissions, ACLs, and AD trust relationships you can dream up. The real work is the Active Directory side: joining domains, replicating users, and handling Group Policy takes Windows administration knowledge, not Linux know-how. Solo and small teams: free and the right answer for shared file storage on a home server or small office. Mid-sized teams with mixed Windows and Linux fleets: free for file sharing and a real cost saver if you replace a Windows Server domain controller. Large teams: most still pair Samba with one Microsoft AD instance, but the option to run pure Samba is there. The catch: SMB has a long history of CVEs. Patch promptly, lock down public exposure, and watch the security mailing list. Free does not mean set and forget.