Networking

frp110.5k★

frp puts a service running on your laptop or home server onto the public internet without opening ports on your router. It's the self-hosted answer to ngrok: the frps server runs on any machine with a public IP, the frpc client runs next to your app, and traffic rides the tunnel. Apache 2.0, free, no paid tier. Both halves are single Go binaries configured in TOML (YAML and JSON work too). It handles TCP, UDP, HTTP and HTTPS, plus STCP, where visitors need a preshared key, and XTCP for direct peer-to-peer transfers. DigitalOcean's cheapest droplet at $4 a month is plenty for the server. Upkeep is close to zero. Solo developers and homelabbers: free, and the cleanest way off ngrok. Small teams: free, since one frps serves many clients. Larger teams wanting managed identity and access policies should look at Cloudflare Tunnel or Tailscale instead. The catch is that you now run an internet-facing gateway. Exposed web services are public unless you turn on the built-in password, and 2026 brought an auth bypass in HTTP routing (fixed in 0.68.1) and an unauthenticated crash in the SSH tunnel gateway (fixed in 0.70.1). Stay current. The promised v2 rewrite is on hold.

Traefik65.5k★

Traefik is a reverse proxy that automatically routes traffic to the right service as you deploy containers. It discovers your services from Docker, Kubernetes, or config files and configures routing without you manually editing nginx configs. Go, MIT. The auto-discovery is the killer feature. Label your Docker containers with routing rules and Traefik picks them up. Add a new service, Traefik routes to it. Remove one, it's gone. No reload, no restart. Free automatic Let's Encrypt certificates built in. Traefik Proxy (the open source core) is free and handles most use cases: HTTP/TCP/UDP routing, load balancing, auto-discovery, Let's Encrypt, middleware (rate limiting, auth headers, redirects), and a basic dashboard. Traefik Enterprise adds: distributed configuration, RBAC, WAF, OpenID Connect auth, high availability clustering, and dedicated support. Pricing is custom and not published. Expect enterprise-level quotes. Solo: free Traefik Proxy with Docker is the easiest reverse proxy setup you'll find. Small teams: same. It handles multi-service deployments beautifully. Medium teams on Kubernetes: free Traefik IngressRoute works, but evaluate Traefik Enterprise or alternatives for advanced security. Large: Enterprise or evaluate cloud-native options. The catch: the configuration model has two flavors (file-based and dynamic) and mixing them gets confusing. The documentation is comprehensive but scattered. And the Enterprise licensing is opaque. No public pricing means you can't evaluate cost without a sales call.

Pi-hole61.7k★

Pi-hole blocks ads and trackers for your whole network by acting as its DNS server, so phones, smart TVs and IoT devices get filtered with nothing installed on them. It's free under the EUPL, volunteer-run and donation-funded, with no paid tier or cloud version. Install is one curl -sSL https://install.pi-hole.net | bash on a Raspberry Pi or supported Linux box, or the official Docker image, and the project says it takes under ten minutes. Version 6 built the web server into Pi-hole and added a full REST API, so there's no separate web stack. Updates are pihole -up. Encrypted DNS-over-HTTPS upstreams still need an add-on like cloudflared, which AdGuard Home has built in. Solo, small offices and medium teams: free. Large networks want managed DNS filtering. The catch: the v6 web server and API have had a rough 2026. Advisories this year include an unauthenticated session-hijack race, several admin-to-root code execution paths and a run of local privilege escalations, with a big batch fixed in the October 17 releases. Patch promptly, set a password, and keep the admin page off the internet. DNS blocking also can't stop ads served from the content's own domain, so YouTube still needs uBlock Origin.

Headscale45.4k★

Headscale replaces the closed server at the center of Tailscale: the coordination server that hands out keys, addresses and access rules. Your devices keep running the official Tailscale apps and direct WireGuard tunnels; the control plane is just yours. BSD-3 licensed, free, no paid tier. It's a single Go binary on SQLite. You need a public server with HTTPS on port 443, and the maintainers officially support the binary and DEB packages, not Docker or reverse proxies. The 0.29 line closed real gaps: grants, SSH check mode with OIDC or CLI approval, and policy tests that reject a bad ACL before it lands. Upgrade gotcha: * in ACLs now means tailnet addresses only. Solo and homelab: free. Small companies: this is where it pays, because Tailscale's free Personal plan is non-commercial only and Standard costs $8 per user per month. Larger orgs: its own docs say it isn't enterprise software and it runs a single tailnet, so pay Tailscale. The catch: you're the support and security team. No built-in web UI, no Funnel, no flow logs, and relays default to Tailscale's public DERP servers. October's 0.29.5 fixed SSH access surviving removal of its policy rules, so stay current.

sing-box39.7k★

sing-box tunnels your internet traffic through encrypted proxies, and it speaks basically every protocol in the space: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and more. It replaced a pile of separate tools as the engine behind most modern proxy clients, and the whole thing is free under GPL v3, including the official iOS and Android apps. Self-hosting is light on resources and heavy on configuration. The single Go binary runs anywhere (Linux, macOS, Windows, routers) and sips memory, but everything is driven by a JSON config of inbounds, outbounds, and routing rules. The docs are reference-style: accurate, complete, and not gentle. Budget an evening for your first working setup. Solo: this is the standard for self-hosted proxy infrastructure, use it. Small teams running their own private network access: solid, paired with the official clients. Companies that want managed device access should look at a mesh VPN like juanfont/headscale instead; sing-box is a proxy platform, not a device management plane. The catch: the config format changes between major versions and migration is on you. And depending on your country and your network's policies, running proxy infrastructure can carry real legal risk. Know the rules before you deploy.

Tailscale38.7k★

Tailscale puts all your devices on one private network that works through firewalls without opening a port. It runs on WireGuard and handles the key exchange, NAT traversal and device management that make raw WireGuard painful. The core client is BSD-3 open source; the coordination server is not. Personal is free for up to 6 users with unlimited personal devices. Setup is install the app and log in. Traffic goes device to device, or through Tailscale's DERP relays when a direct path fails. If the coordination server goes down, existing devices keep talking until their keys expire, but nobody new can join and keys can't be revoked. Headscale is the open source stand-in. The paywall is about who you are. Personal is non-commercial only, and SSO and ACLs are on every plan, which is fair. Business use means Standard at $8 per user per month, or Premium at $18 for flow logs, log streaming and just-in-time access. Solo: free. Small work teams: Standard. Larger teams: Premium or Enterprise. The catch: Tailscale SSH was the soft spot this year, with two separate bugs letting a user with limited SSH access open a root shell, fixed in 1.98.9. Keep clients on auto-update.

AdGuard Home38.2k★

AdGuard Home blocks ads, trackers and malware domains for every device on your network by acting as its DNS server, so smart TVs, phones and IoT gadgets get filtered with nothing installed on them. It's free under GPL-3.0 and it's the main rival to Pi-hole, with encrypted DNS, parental control, Safe Search and a DHCP server built in. Setup is a one-line install script, Docker or Snap, then you point your router's DNS at it. A Raspberry Pi or NAS is plenty, and unlike Pi-hole it runs without root. There's no paid tier for the self-hosted server. AdGuard's hosted AdGuard DNS is the paid cousin: free for 300,000 requests a month, Personal at $19.99 billed annually. Solo and small offices: free. Larger teams usually want managed DNS filtering with an SLA instead of one box. The catch: 2026 brought two critical authentication bypasses, one hitting every version before v0.107.73 and one in GL.iNet router mode fixed in v0.107.77. Update, and keep the admin panel off the internet. DNS blocking also can't touch YouTube or Twitch ads served from the video's own domain. And the v1.0 beta adopts versioning where minor releases may break compatibility, so read release notes first.

Envoy29.2k★

It's the data plane behind Istio, AWS App Mesh, and dozens of service meshes. Everything is free under Apache 2.0. No paid tier from the Envoy project itself. It's a CNCF graduated project, which means it's been vetted for production use by the Cloud Native Computing Foundation. Maintained by a large contributor base including engineers from Google, Lyft (where it was created), and Microsoft. Self-hosting is the only option, and the ops burden is significant. Envoy is powerful but complex. Configuration is verbose YAML. The learning curve is steep if you're not already in the service mesh world. Most teams don't run Envoy directly. They use it through Istio or a gateway controller. Solo developers: you don't need this. Use Nginx or Caddy. Small teams with a few services: still probably overkill. Use Traefik or Caddy. Growing teams with 10+ microservices: this is where Envoy starts making sense, especially through Istio or a gateway API. The catch: Envoy is infrastructure for infrastructure people. The configuration complexity is legendary. Unless you're building a service mesh or need advanced traffic management (circuit breaking, retries, observability), simpler proxies do the job with 10% of the config.

Nebula18.5k★

Nebula creates an encrypted overlay mesh that connects machines across different networks into one private network. It's a VPN that doesn't need a central server to route all traffic. Every node connects directly to every other node, peer-to-peer. MIT license, Go. Built by Slack's infrastructure team for their own use, then open sourced. Uses a lighthouse node for discovery (helps nodes find each other) but actual traffic flows directly between peers. WireGuard-style encryption, runs on Linux, macOS, Windows, iOS, and Android. Fully free. No paid tier, no managed service. Defined Networking (the company behind it) sells a managed control plane but Nebula itself is completely free to self-host. Solo: overkill unless you're connecting personal machines across locations. Small teams (2-10): solid for connecting dev environments to cloud resources without exposing ports. Medium to large: this is where Nebula shines: hundreds of nodes across cloud providers and offices on one flat network. The catch: you're building your own network infrastructure. Certificate management, firewall rules, lighthouse configuration, it's not hard but it's not "install and go" either. If you just need remote access to a few servers, Tailscale (which is built on WireGuard) is dramatically simpler. Nebula is for teams that want full control and are willing to manage it.

ZeroTier17.2k★

ZeroTier creates a virtual network between your devices, your office, and your cloud VMs. No port forwarding, no VPN server to maintain. Install the agent on each machine, join a network ID, and they can talk to each other directly, peer-to-peer. ZeroTier uses its own protocol (not WireGuard), handles NAT traversal, and supports both layer 2 and layer 3 networking. That layer 2 support is a genuine differentiator: you can bridge entire network segments across the internet, which Tailscale (layer 3 only) cannot do. The self-hosted controller option gives you full control over your network infrastructure with no dependency on a third party. The license is BSL 1.1 (converts to Apache 2.0 after 4 years), so it's source-available with eventual open source. The catch: Tailscale has gained significantly more developer traction in recent years. It's simpler to set up, uses WireGuard (which is audited and well-trusted), and has a larger integration ecosystem. If you don't need layer 2 networking or full self-hosting, Tailscale is the easier choice. But if either of those matters to you, ZeroTier is the tool that actually delivers them.

transmission15.4k★

Transmission moves files over BitTorrent without turning your machine into an ad billboard. BitTorrent is the protocol that downloads a file in pieces from many people at once instead of from one server, and Transmission is the client that drives it. Free and open source since 2005, with native apps for macOS, Windows, Linux, and BSD, plus a headless daemon and a web UI. The daemon is the interesting part if you run anything always-on. transmission-daemon sits on a NAS or a Raspberry Pi and you drive it from the web UI or a remote client. Setup is a config file and a systemd unit, nothing exotic. Memory footprint stays small enough that it disappears next to everything else on the box. Free at every tier, so the only real question is which client you prefer. qBittorrent gives you built-in search, Deluge gives you a plugin system. Transmission wins on being light and boring, which is what you want from something seeding for weeks unattended. The catch is that lightness costs features. No built-in search, no RSS auto-download without a third-party script, and the bandwidth scheduler is basic next to qBittorrent's. Separately, BitTorrent itself exposes your IP address to every peer in the swarm. That is a VPN problem, not something any client solves for you.

rathole14.4k★

Rathole punches a hole through without opening ports on your router. It's essentially a tunnel from your private network to a public endpoint. Written in Rust, so it's fast and lightweight. We're talking single-digit MB of RAM. Compared to frp (the other big player here), rathole uses less memory and handles more concurrent connections. Setup is straightforward: a config file on the server side, a config file on the client side, done. Everything is free. No paid tier, no cloud service, no catch on features. You self-host both ends. Docker image available, or grab the binary. The catch: you need a server with a public IP to act as the relay. If you don't already have a VPS, that's $5/mo minimum. And the docs are thin: the README covers the basics but you'll be reading config examples more than prose. Solo devs and home labbers, this is your tool. Teams needing managed tunnels with dashboards should look at Cloudflare Tunnel (free) or ngrok instead.

clash-nyanpasu13.3k★

Clash Nyanpasu is a free desktop app that turns a network proxy into a point-and-click dashboard. Instead of hand-editing config files, you load a subscription or profile, flip between servers, and route your traffic through them. People use it to control exactly how their internet traffic is routed, most often to get around network filtering or reach restricted resources. It runs on Windows, macOS, and Linux, it's built on Tauri so it's light, and it's open source under GPL-3.0. What sets it apart from simpler clients is the scripting layer. You can extend and transform configs with YAML, JavaScript, and Lua, swap between proxy cores (Mihomo, Clash Premium, a Rust core), and manage providers from a clean Material You interface. One thing to know: the app is only a client. It does nothing on its own. To get any value you have to bring your own proxy, either a subscription URL from a provider or a server you run yourself. Installing the app is easy; having somewhere to route traffic is the actual prerequisite. It sits in the Clash Verge lineage, one of several descendants of that GUI tradition, and it's actively developed, though worth knowing the maintainers have gone a long stretch without cutting a stamped stable release while shipping current dev builds. For a developer who already has a proxy setup and wants a polished, scriptable way to manage it, this is a strong pick. If you're after a turnkey commercial VPN that includes the servers, this isn't that, and it isn't trying to be. The catch is the bring-your-own-server reality. Nyanpasu is the steering wheel, not the car. It's also worth being clear-eyed that this is traffic-routing and circumvention tooling, so use it deliberately and within whatever rules apply to you.

firezone9.2k★

Firezone is a zero-trust remote access platform built on WireGuard. Group-based policies replace the all-or-nothing VPN model: each resource (host, subnet, service) has its own access rules, and users only see what they are allowed to reach. The current product is the second-generation Firezone, a full rewrite of the original self-hosted product. License is the part to read carefully. Elixir components ship under Elastic License 2.0, the rest is Apache 2.0. The team explicitly says self-hosting is permitted for educational and hobby use but is not officially supported for production, and that internal APIs change rapidly. That makes the cloud product the intended deployment, not a nice-to-have. Setup of the cloud version is genuinely fast: connect an identity provider, deploy gateways via Docker, define resources and policies. Solo developers and homelabs get the free cloud tier with up to 6 users, which is enough for most personal setups. Small teams scale to Team at $5 per user per month. Enterprises pay for directory sync, audit logs, and SLA support. The catch is the open source posture is closer to source-available than truly open. If you want a fully self-hostable zero-trust platform with no vendor commitment, look at Tailscale's open source Headscale implementation or Twingate's alternatives. Pick Firezone when you want a managed service backed by code you can audit, not a self-hosted product.

mullvadvpn-app7.7k★

Mullvad is a VPN that doesn't want to know who you are. No accounts, no profiles. You get a random number as your ID, pay your money, and connect. The client app is fully open source so you can verify it does what it claims. GPL v3, written in Rust. The app supports WireGuard and OpenVPN, has a kill switch, split tunneling, and DNS leak protection. Available on Windows, macOS, Linux, Android, and iOS. The Rust codebase means the app itself is fast and resource-light. This is NOT a free tool. Mullvad costs 5 EUR/mo (~$5.50 USD) with no discounts for longer commitments. Everyone pays the same. You can pay with cash mailed in an envelope, crypto, or card. No free tier. The open source part is the client app. You can build it yourself and connect to Mullvad's servers, or theoretically point it at your own WireGuard server. But the value is the server network, and that's paid. Solo users who care about privacy: this is the VPN to use. Teams needing business VPN features (centralized management, SSO): look elsewhere. The catch: no free tier means you're paying from day one. The server network is smaller than NordVPN or ExpressVPN. And 5 EUR/mo with no annual discount makes it pricier than competitors who offer $3/mo on 2-year plans. You're paying a premium for the privacy model.

blocky7.1k★

Blocky is a DNS proxy that filters requests before they reach your devices. Same concept as Pi-hole but written in Go, runs as a single binary, and needs zero dependencies. No database, no web server framework, no PHP. Point your router's DNS at Blocky, configure your blocklists, and every device on your network stops loading ads and trackers. It supports DNS-over-HTTPS, DNS-over-TLS, conditional forwarding, and client-specific rules. Apache 2.0. Fully free. No paid tier, no cloud version. Self-host only. The catch: Blocky has no web dashboard out of the box. Pi-hole gives you a slick admin panel with graphs and query logs. Blocky gives you a config file and an API. If you want a UI, you'll need to set up Grafana or a third-party frontend. For people comfortable with YAML config files, that's fine. For everyone else, Pi-hole's UI is hard to beat.

octelium4.2k★

Octelium is a self-hosted zero trust platform that replaces your VPN, your reverse proxy, and your access gateway in one shot. Instead of "connect to the network and hope firewall rules hold," every request gets identity-checked at the application layer. WireGuard and QUIC tunnels for client access, plus clientless BeyondCorp-style browser access. A single-node cluster runs on 2GB RAM. Install script, point it at your identity provider, define access policies in CEL or OPA, and your internal services are accessible without ever exposing ports to the internet. Passwordless SSH, secretless database access, and full OpenTelemetry audit logs come standard. Solo developers with a homelab or a few VPS instances: this replaces Tailscale's self-hosted needs without the coordination server dependency. Teams running internal services: this is Cloudflare Access without the vendor lock-in or per-seat pricing. The catch: AGPLv3 on the cluster components. If you are building a commercial product that embeds Octelium, you will need the commercial license. For internal use, the AGPL is irrelevant.

gobgp4.1k★

GoBGP is BGP without the hardware router. BGP is the protocol that decides how traffic moves between networks, and historically you ran it on a Cisco or Juniper box or a heavyweight legacy daemon. GoBGP is a clean, modern implementation written from scratch in Go that runs as a standalone daemon or, more interestingly, as a library you drive over a gRPC API. That makes it the go-to when you want to build BGP control into your own software: route injection, SDN controllers, anycast automation. The install is easy, a single Go binary and a config file. Operating it is not. BGP is unforgiving, and peering, route policy, and filtering still demand real networking knowledge no matter how clean the tool is. It supports the features that matter in production: route reflection, EVPN, flowspec, RPKI, and Zebra integration. It is Apache-2.0 and entirely free, with no paid tier. For a plain software router, FRRouting and BIRD are the usual alternatives and have broader feature sets for traditional routing. GoBGP wins when you want BGP as a programmable building block rather than a box you configure. Solo, small, or large team: the cost is your time and expertise, not a license. The catch is that a BGP mistake does not throw an error, it silently moves traffic. The tooling cannot save you from a bad policy, and the ecosystem around GoBGP is smaller than FRR's, so you will lean on the docs and the source more than on Stack Overflow.

HypoMux4.0k★

HypoMux aggregates multiple network connections on one Windows machine so a download can pull from Ethernet, Wi-Fi, and a phone hotspot at the same time. It assigns each new connection to an adapter rather than splitting a single TCP stream, so it speeds up anything that opens many connections at once: Steam, IDM, game launchers, big browser downloads. AGPL-3.0, free, no paid tier. Installation is a signed Windows installer, with Authenticode signing through SignPath, more supply chain hygiene than most single-maintainer Windows projects bother with. System Proxy mode takes over the Windows proxy setting and works with anything proxy-aware. Virtual NIC mode uses Wintun and sing-box to catch broader traffic, and because it owns routing, DNS, and WFP it cannot share the default route with another TUN, so it will fight your VPN client. The UI runs unelevated and hands privileged work to a separate service, which is the correct design. Solo on a mediocre connection with a second link available: this is the tool, and the price is zero. Anyone already saturating one pipe gets nothing, because HypoMux cannot make a single connection faster than that connection allows. Speedify is the commercial equivalent at $14.99 a month and bonds traffic through its own servers; HypoMux does the local half free and keeps your packets on your own links. Windows 10 and 11 only, and the README is upfront that this is for your own devices and connections, not for getting around anyone's access controls. One maintainer, who is also the sole approver on the signing key. The engineering is careful, but the bus factor is one.

sozu3.8k★

A reverse proxy that can reload its configuration without dropping a single connection. If you're running web services and need a load balancer in front of them, Sozu does what nginx and HAProxy do, but with true zero-downtime config changes: no reload signal, no worker restart, no connection reset. Written in Rust. Memory-safe, fast, lightweight. Handles HTTP/1.1, HTTP/2, WebSocket, and TLS. The config changes happen through a command socket: you send a message, the proxy updates instantly. No file edits, no restarts. Small but the project has been around since 2016, originally built by Clever Cloud (a French PaaS provider) for their own infrastructure. Completely free under AGPL-3.0. No paid tier. The catch: the ecosystem is tiny compared to nginx or Traefik. Documentation is sparse. Community support is limited; you're mostly on your own. If hot config reloading is your primary requirement, Envoy and HAProxy also handle this well with much larger communities. Sozu is interesting technology but unless you specifically need Rust-native proxy with zero-downtime reloads and don't mind being an early adopter, nginx or Traefik are safer choices.

omdrop-owl3.3k★

omdrop-owl gets AirDrop working between iPhones and Linux laptops with ordinary Intel, MediaTek or Realtek Wi-Fi. It builds a patched fork of OWL, the SEEMOO lab's open implementation of AWDL (the Apple Wi-Fi link AirDrop rides on), and packages it for Arch, Debian, Fedora and NixOS. The separate omdrop plugin does the sending and receiving. Both are free. Hardware decides everything. The MediaTek MT7925 in the Framework 13 stays on Wi-Fi while visible. Every tested Intel card uses exclusive mode, which drops your Wi-Fi while visible. The one Qualcomm card tested fails. It installs a root helper behind polkit, and shared mode needs your router on channel 6, 44 or 149. Intel is slow: a 2.4 MB photo takes 10 to 17 seconds on an AX201. Solo Linux users with an iPhone: free and worth a try if your card is on the green list. Teams: use LocalSend, which works on any hardware once the app is on every device. The catch: there's no license file. The packaging lists GPL and ISC for the upstream code it builds, but this repo's own scripts and patches carry no grant, so they're all rights reserved. It's also a week old.

easylist3.2k★

The filter lists that tell it what to block probably come from EasyList. It is the most widely used ad-blocking filter subscription, maintained by a community of contributors who track and block ad domains, trackers, and annoyances across the web. You do not use EasyList directly. It is a dependency of the tools you already use. When your ad blocker updates its filters, it is pulling from lists like these. The catch: this is a filter list, not software. You do not install it, build with it, or self-host it. It is useful to know about because it powers the ad-blocking ecosystem, but it is not a tool you evaluate the same way as a database or framework.

kube-ovn2.4k★

Kube-OVN is a Kubernetes network plugin (a CNI, the piece that gives every pod an IP address and moves its traffic) built on Open vSwitch and OVN. It does what most CNIs skip: per-tenant VPCs with overlapping address ranges, static pod IPs, VLAN underlay, and KubeVirt virtual machines that live-migrate without dropping their network. CNCF Sandbox, Apache 2.0, fully free. Install is a root install.sh script or a Helm chart, but swapping the network layer of a cluster is never a weekend job. It needs Kubernetes 1.29 or newer, the geneve and openvswitch kernel modules, and IPv6 left on in the kernel. The docs list specific kernel versions with known bugs. There's no paid tier: Alauda, the company that created it, sells an enterprise distribution with support, price on request. Solo: overkill unless you run KubeVirt at home. Small teams: only for VM or multi-tenant needs. Larger teams running VMs on Kubernetes: evaluate this first. The catch: the maintainers tell you when not to use it. Want eBPF? Cilium or Calico. On OpenShift? ovn-kubernetes. On EKS, AKS or GKE? Keep your provider's CNI. That honesty is refreshing, and it makes Kube-OVN a specialist, not a default.

neqo2.3k★

neqo is Mozilla's implementation of QUIC and HTTP/3 written in Rust, the same code that powers networking inside Firefox. QUIC is a faster, more reliable replacement for TCP, the protocol most internet traffic still rides on, and HTTP/3 is the newest version of the web protocol built on top of it. neqo gives you QUIC transport, HTTP/3, and QPACK header compression as Rust libraries, dual-licensed under Apache 2.0 and MIT. This is not an app you install. It's library code you compile into your own networking software, plus a couple of command-line tools for testing HTTP/3 clients and servers. Using it means working at the protocol level in Rust, deep specialized engineering, not a weekend integration. Who is this for: teams building browsers, networking stacks, or protocol-level tooling who need a real QUIC implementation and want Mozilla's. Everyone else almost certainly wants a higher-level library like quinn instead. There is no paywall and no team-size split, since it's a building block, not a product. The catch: Mozilla flat out says the server side is experimental and warns against running it in production. The client and transport are battle-tested inside Firefox, but treat the server code as a lab tool, not something you put in front of real traffic.

Meshtastic-Android1.9k★

Meshtastic-Android is the phone app for a mesh network that runs on cheap LoRa radios and needs no cell service, no carrier and no internet. You pair a radio over Bluetooth and get encrypted text messaging, position sharing and telemetry across a mesh that relays through every other node in range, which is why it gets used for hiking, off-grid property, disaster response and events where the cell towers are saturated. GPL-3.0, and there is also a Compose Desktop build. The app is the easy part. Install from GitHub releases (pair with Obtainium for auto-updates) or from the store; the fdroid flavor drops the Google Crashlytics and Maps dependencies if you want nothing phoning home. The actual work is the hardware and the firmware, which lives in a separate repository. Recent additions include mesh network discovery, waypoint geofences that alert when nodes cross a zone, encrypted backup of device security keys, NFC contact sharing, XEdDSA packet signing indicators and air-quality telemetry. Free, no tiers, no accounts, backed by The Document Foundation model of an open collective rather than a company. The money goes to radios: a usable LoRa node runs roughly $25 to $60, and you need at least two. The catch is bandwidth. LoRa is measured in bytes per second, not megabits. Text and coordinates work. Anything resembling a photo, a voice note or a web page does not, and no amount of app polish changes the physics.

vpp1.6k★

VPP moves network packets through software at speeds people used to need custom hardware for. It runs a full router and switch on a standard x86 or ARM server: routing, switching, tunneling, ACLs, NAT, and more, processing packets in batches to stay fast. Apache 2.0, hosted by the FD.io project and originally built at Cisco. This is infrastructure plumbing, not an app. You get the best performance on bare metal with the network card bound to DPDK and CPU cores pinned to packet work. Pre-built packages exist, but tuning VPP for real throughput means understanding hugepages, core affinity, and your NIC. It is built for people who create network functions, not people who consume them. If you are building a software router, a load balancer, a 5G data plane, or a high-throughput gateway, VPP is one of the few open projects that performs at carrier scale. Solo developers and product teams almost never need this. Network engineering teams, telcos, and infrastructure vendors are the audience. For ordinary service-to-service networking, a service mesh or a cloud load balancer is the right tool. The catch is the learning curve. VPP is powerful and well documented, but the core concepts (graph nodes, vectors, plugins) are unfamiliar even to experienced network engineers. Expect a real ramp before you ship anything on it.

batfish1.5k★

Batfish finds network outages before you cause them. Feed it your device config files (Cisco, Juniper, Arista, Palo Alto, 20+ vendors) and it builds a model of your whole network, then answers questions like: is this ACL reachable, does this route black-hole, will tomorrow's change break the VPN? It works offline from the configs alone, no access to live devices, Apache-2.0 and free. Running it is one Docker container and about 8GB of RAM. You talk to it through pybatfish, a Python SDK, usually from Jupyter notebooks. There is no dashboard; if your network team doesn't touch Python, that's the adoption wall. Use it when config changes get reviewed by eyeball and deployed on hope. It's the closest thing to CI for network changes that doesn't cost enterprise money. Commercial tools like IP Fabric and Forward Networks do this with polish and support contracts; Batfish does the core analysis for free. The catch: the company behind it was acquired by AWS in 2022, and the open source project moves slower than it used to. It still ships, but watch the release cadence before betting your change pipeline on it.

docktail1.4k★

Docktail does it with labels. Add a label to your Docker container, and Docktail automatically registers it as a Tailscale service. No port forwarding, no VPN configs, no firewall rules. This solves a specific pain point: you have a dozen self-hosted services in Docker and you want them accessible from your phone, laptop, or remote machines over Tailscale, without opening ports to the internet. Docktail watches your Docker daemon and handles the Tailscale registration automatically. AGPL-3.0, fully free. You need a Tailscale account (free for personal use, up to 100 devices). The catch: AGPL-3.0 is aggressive copyleft. If you modify this and serve it, you owe the source code. The project is very early. Small community, limited documentation, and if the maintainer moves on, you're forking it yourself. Also, Tailscale itself has limits on the free tier (3 users).

dnsglobe1.4k★

dnsglobe answers the question every DNS change raises: has it propagated yet? Run it in your terminal and it queries 34 public resolvers around the world in parallel, draws a world map showing where each answer came from, and flags the resolvers still serving stale records. Free and MIT-licensed, written in Rust. There's nothing to host. Install it from Homebrew, Cargo, the AUR, Nix, or a prebuilt binary and run it like you'd run dig. Green means everyone agrees, magenta means someone is behind, red means a resolver errored. It replaces the whatsmydns.net tab you open during every domain move, with the advantage that it lives where you already work. Anyone who touches DNS during deploys, migrations, or cert changes should keep it installed. No pricing math here; it's a free CLI. The catch: the world map wants a 150-column terminal, and ISP resolvers that refuse outside queries can't be checked, so you're seeing the public resolver view, not every network on earth.

samba1.1k★

Samba is the open source SMB/CIFS server that lets Linux and Mac machines share files with Windows clients (and vice versa). It also runs as an Active Directory domain controller, which is the bigger story for anyone trying to host Windows infrastructure without paying for Windows Server. GPLv3, mature, and shipped in basically every Linux distribution. Self-hosting is well-trodden ground. Most distros have working defaults, and the community has documented every combination of share permissions, ACLs, and AD trust relationships you can dream up. The real work is the Active Directory side: joining domains, replicating users, and handling Group Policy takes Windows administration knowledge, not Linux know-how. Solo and small teams: free and the right answer for shared file storage on a home server or small office. Mid-sized teams with mixed Windows and Linux fleets: free for file sharing and a real cost saver if you replace a Windows Server domain controller. Large teams: most still pair Samba with one Microsoft AD instance, but the option to run pure Samba is there. The catch: SMB has a long history of CVEs. Patch promptly, lock down public exposure, and watch the security mailing list. Free does not mean set and forget.