Numa is a DNS resolver you run yourself that gives every service on your network a real name, blocks ads and trackers before they load, and keeps your queries private with encrypted DNS. Register a frontend on port 5173 once, and https://frontend.numa opens in your browser with a valid certificate and WebSocket passthrough, no mkcert, no nginx, no editing hosts files. Path-based rules send app.numa/api to a backend on another port, so multi-service projects get one clean address instead of a spreadsheet of port numbers. Tracker and ad domains die at resolution time through the Hagezi Pro blocklist, refreshed daily, and every device that points its DNS at your instance inherits the filtering. Temporary overrides redirect any hostname for testing or debugging and revert on their own, and scripts can create them through the REST API. You choose how answers are found: forward to your existing DNS, resolve recursively from the root servers, or seal queries with Oblivious DNS over HTTPS so no single party sees both your address and your question. Phones and laptops connect over DNS-over-TLS on port 853, a QR-code flow points an iPhone at your resolver in minutes, and mDNS discovery lets one machine reach services registered on another. The dashboard on port 5380 manages services, overrides, and diagnostics, with token sign-in away from loopback. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

A blocklist working silently in the background is hard to appreciate, so PH Intercept turns your DNS traffic into a live arcade battle: every allowed query flies by as a friendly ship, and every blocked query spawns as an invader your interceptor shoots down. It streams query events live from the API of your existing Pi-hole v6, AdGuard Home, or Technitium server, so the battle on screen is your network's real traffic the moment it happens. Repeat domains level up on screen: friendly shuttles grow into heavy transports and gold capital ships, while blocked domains mutate from crab invaders into orange drones and purple bosses. The interceptor hunts by itself, launching a support drone at five on-screen threats and a second at ten, and it swaps among seven selectable ships, from the Falcon and the Enterprise to the Normandy. The bottom HUD doubles as a control panel: pause blocking for ten seconds, thirty seconds, or five minutes with a synced countdown, watch totals climb, and trigger a gravity list update in place. Client and domain labels can ride beneath each entity, noisy domains disappear through regex ignore patterns, a second DNS server can join in split-screen two-player mode, and viewer settings persist per browser. The backdrop ranges from a starfield plotted from about 12,200 real stars to nebula, synthwave, and custom image modes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Resolvr gives your Technitium DNS server the clean, readable dashboard it deserves, turning raw query traffic into an overview you can understand at a glance. Four tabs divide the picture: Traffic charts queries over time with allowed and blocked stacked together and a seven-day heatmap of when your network is busy; Resolution shows where answers come from, cache, upstream, blocked, or authoritative, with response times and a flow diagram of each lookup; Top lists rank your chattiest clients and most-requested domains; and Infrastructure tracks DHCP scope usage, zones, and cache growth. Every chart is a doorway: click one and you land in Query Logs already filtered to what you clicked. Pick any device on the Clients page to see its queries, block rate, DHCP lease, and favourite domains. Query Logs themselves filter by client, name, protocol, response code, and time window, export to CSV, and can live-tail as new lookups arrive. Blocked Zones manages your feeds, your own blocked domains, and a checker that tells you whether a name is blocked and which feed caught it. Run a Technitium cluster and each panel gains a scope chip, comparing nodes side by side or merging their logs into one timeline. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Spreadsheets and sticky notes stop scaling the day your network grows past a rack or two, so JT-IPAM keeps every address, subnet, and device in one searchable system of record. Track subnets and individual IPs with their hostnames, MAC addresses, and owners, then reconcile what you documented against what scan agents actually find through ICMP, ARP, reverse DNS, and SNMP collection from routers and switches. Connect the DNS servers you already run, from PowerDNS and BIND 9 to Windows DNS and Technitium, and flag records that have no matching address in IPAM. Pull devices and virtual machines in from LibreNMS, Zabbix, Proxmox VE, ESXi, Hyper-V, and OpenStack so monitoring and address records stop drifting apart. Draw floor plans and rack elevations, trace a cable across multiple hops, and open an SSH terminal, SFTP browser, or RDP desktop to a device straight from its address page. Route new address requests through configurable multi-stage approval workflows, distribute certificates to web servers and firewalls from central encrypted storage, and keep a full audit trail of every change and console session. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

SpatiumDDI is the open alternative to commercial DDI platforms that charge by the IP, by the appliance, and by the feature, then lock every zone and subnet you own inside a renewal cycle. It does not just render configuration for servers somebody else runs, but deploys and operates BIND9, PowerDNS, Technitium, and Kea itself. Manage zones and records with per-server sync state, hand out DHCP scopes, pools, and static reservations per server group, and watch live leases reported back by the Kea agents. The IPAM side keeps spaces, blocks, and subnets in a tree with per-address DNS and DHCP sync, while the dashboard shows utilization, capacity, and platform health at a glance. Bring an existing estate with you through importers for BIND, Windows, PowerDNS, Technitium, Kea, ISC, and NetBox, and manage Windows DNS and DHCP agentlessly over WinRM when a full cutover is not on the table. Delegate safely with group-based roles over LDAP, OIDC, SAML, RADIUS, or TACACS+, search every object globally, and keep an append-only audit log of who changed what. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Raw zone files and API calls become something a whole team can operate safely once PowerDNS-Admin puts its web interface in front of a PowerDNS authoritative server. It's a Python/Flask application covering full forward and reverse zone management, with the touches that matter in daily DNS work: zone templates for stamping out consistent new domains, easy IPv6 PTR record editing (reverse zones by hand are misery), full IDN/Punycode support for internationalized domains, and DynDNS 2 protocol support so routers and scripts can update records the way they would against a commercial dynamic-DNS service. Access control is enterprise-grade: local users, LDAP against OpenLDAP or Active Directory, SAML, and OAuth via Google, GitHub, Azure, or OpenID Connect, hardened with TOTP two-factor authentication. Role-based permissions extend to zone-specific access control - hand a developer their project's zone without exposing the rest of your namespace - and activity logging records who changed which record when, the audit trail bare PowerDNS never gives you. The dashboard monitors PDNS service configuration and statistics, and its own API exposes zone and record management for automation on top of the UI. Runs against MySQL/MariaDB or PostgreSQL, talking to PowerDNS through its REST API. MIT-licensed.

PowerDNS answers the queries; Poweradmin gives you a browser-based control panel for its zones, records, DNSSEC keys, and users, with a REST API for automation. Create master, native, and slave zones, and let zone templates stamp predefined record sets onto new ones. Edit records inline with filters, or open the optional Record Wizard for DMARC, SPF, DKIM, CAA, TLSA, and SRV. Reverse zones link to their forward zones. The batch PTR tool fills whole network ranges, bulk add takes one CSV line per record, and secondary zones can be imported over AXFR. For DNSSEC, manage keys and copy DS and DNSKEY records for your registrar; changes are applied or rectified through the PowerDNS API so signed zones stay consistent. Every record and zone edit is logged with before and after snapshots, and the logs can be filtered and exported. The panel is translated into 43 languages, including right-to-left ones. Permission templates, users, and groups control who touches which zones, sign-in works through LDAP, OIDC, or SAML, and administrators can switch on authenticator-app or email two-factor codes. API keys can be read-only, limited to chosen operations, or restricted to specific zones, and companion projects link Terraform, ExternalDNS, cert-manager, and Certbot. Dynamic DNS clients such as ddclient and inadyn update records through a dyndns2-compatible endpoint. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Self-hosted and account-free, LAN Sheriff watches where your devices send their traffic, plots each destination on a live world map, and flags anything that looks suspicious. Click a destination on the Watchtower for its country and city, owning organization, reverse DNS, protocol, port, byte counts, duration, and responsible app or device; filter by device, app, country, organization, or protocol, or scrub back through history. Radio Chatter streams the DNS lookups it can see, surfaces first-seen domains, and labels tracker, ad, telemetry, and malware domains without ever blocking them. The Precinct Map diagrams observed traffic, while the Roster inventories every device by IP, MAC, manufacturer, hostname, inferred type, and services, and alerts you when an unrecognized one joins. The Wanted List applies eight rules, including beaconing, machine-generated domains, port scans, plaintext credentials, and volume anomalies, and explains each finding in a plain sentence rather than a mystery score. Deputy Mode needs no privileges and names the application behind each connection, while Patrol Mode adds packet capture for DNS lookups and traffic volumes. Pair installations with a code to widen your view, export any view as CSV or JSON, and send alerts to webhook, ntfy, Discord, or Slack. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Netronome is a self-hosted network monitoring platform that runs scheduled internet speed tests, watches packet loss and DNS resolvers, and reports bandwidth and health data from every server you point it at. Run tests against Speedtest.net, your own iperf3 servers, or public and custom LibreSpeed servers, choosing the exact endpoint from a list sorted with the nearest first. Put tests on a recurring schedule and read the history charts to catch an ISP that sags every evening or a connection that never delivers the speed on the invoice. Install the companion agent on each machine and watch live upload and download rates, traffic by hour, day, and month, processor and memory load, disk space, and temperatures in one place. Trace routes hop by hop, keep packet loss percentages in view, and confirm your DNS resolvers answer fast and return the records you expect. Set thresholds for download and upload speed, ping, packet loss, disk space, CPU, memory, and temperature, and route alerts to Discord, Telegram, Slack, email, ntfy, Gotify, Pushover, or a webhook. The server, the web interface, and the agent ship as one program, and agents connect over HTTP with an optional API key or inside a Tailscale network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

Your router calls it "Unknown device" at 192.168.1.23; Vedetta calls it the kitchen light and shows its work. Vedetta is a Home Assistant app that scans your local network, identifies what each device actually is, and explains every identification. One scan lists every device it can find with presence and latency history, in tile or list view, light or dark, on a computer or a phone. Behind each name sits the recognition engine: it weighs many weak clues together, counts a repeated fact once, groups devices by family, and shows certainty honestly, keeping anything doubtful in Other rather than inventing a label. Tap the info marker beside a name, brand, or type and a pop-up lists every clue, its weight, and the hypotheses that were rejected. Names or rooms you set by hand are never overwritten by later scans, and sleeping phones are remembered instead of flickering in and out. Choose from three search levels depending on how hard you want it to probe, let the nightly deep search refresh the picture, and use the network doctor to spot duplicate addresses, repeated restarts, devices that drop together, or a slowing gateway. It can also publish what you choose to Home Assistant and MQTT, display devices from other networks your Home Assistant already sees, and mask exports before they leave the machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Subnet math, DNS lookups, DHCP options, and certificate checks share one browser tab in Networking Toolbox, a free toolkit for sysadmins and network engineers. Need to carve a /24 into departments? The VLSM planner fits named subnet requirements into a parent block, reports each subnet's efficiency and the leftover space, and exports the plan as CSV or JSON. Merging address lists? CIDR utilities summarize, split, compare, and deaggregate prefixes, with set operations for difference, overlap, and containment. Writing configs? Generators build DHCPv4 and DHCPv6 options, PXE profiles, Kea or ISC snippets, and SPF, DKIM, DMARC, CAA, TLSA, and SRV records, and DNSSEC helpers calculate key tags and DS records. Something broken? Diagnostics query DNS through Cloudflare, Google, Quad9, OpenDNS, or a resolver of your choice, read TLS certificate chains, grade HTTP security headers, trace redirects, check TCP ports, look up BGP routes and RDAP records, and test mail servers. Need a refresher? Reference guides explain private ranges, CGNAT, IPv6 address types, and common ports. A keyboard search palette puts any tool a few keystrokes away, and bookmarked tools stay available offline. Eighteen themes, four languages, custom branding, and accessibility switches make it feel like your own, and a keyless JSON API serves the subnet, CIDR, IP, and DNS utilities to scripts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Network traffic stops being a mystery once ntopng names the hosts, applications, and protocols behind every flow, live in your browser. To find the host saturating an uplink, open the dashboard, which ranks top talkers, countries, autonomous systems, and protocols beside historical charts. To see what a suspicious host is contacting, open its page for traffic, ports, DNS queries, TLS details, and visited sites, plus a map of its conversations. Deep packet inspection recognizes applications such as Facebook, YouTube, and BitTorrent, so charts name the app behind the bytes instead of relying on port numbers alone. The console reads packets from a SPAN port or TAP and NetFlow, sFlow, or IPFIX records from routers and switches through nProbe, so it can cover a single switch or many remote sites. Behavioural checks raise alerts for flows, hosts, and interfaces and send them to email, Discord, Telegram, or webhooks. Active monitoring probes remote hosts over ICMP and HTTP/S, and network discovery lists the devices on your local network. A REST API and Lua scripting pull statistics into your own tools and add custom checks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.