A self-hosted front door for apps that live on home labs, office LANs, and private clusters, Wiredoor publishes them to the internet without opening a single inbound port on the private side. The Wiredoor CLI on each remote machine dials out to the server over an encrypted WireGuard tunnel. Web apps and APIs are routed by domain and path, WebSocket traffic included, while TCP and UDP services such as SSH or Redis get a public port of their own. Public domains receive Let's Encrypt certificates, internal names fall back to self-signed ones, and Cloudflare or GoDaddy credentials let the server create DNS records itself. Any web route can demand OAuth2 sign-in with an email allow list and a few open paths, and every protocol accepts IP allow lists. Gateway nodes stretch one tunnel across a Docker network, Kubernetes cluster, or private subnet, so a single link serves many backends. Services can be switched off or given an expiry such as 30 minutes, 2 hours, or 1 day. The dashboard shows which nodes are connected and whether their services are enabled, while the CLI creates, enables, and disables services from a terminal. Optional Prometheus and Grafana views chart traffic and tunnel peers, and CrowdSec can block abusive addresses. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Gately keeps your domain names current, forwards ports, terminates HTTPS, and blocks hostile traffic from one admin console, so a server or home network needs no pile of separate gateway tools. Dynamic DNS updates records at Cloudflare, Alibaba Cloud, Tencent Cloud, DNSPod, Huawei Cloud, Route 53, OVHcloud, Gandi, Namecheap, DuckDNS, and other providers, finding the public address over IPv4 or IPv6 by URL, network interface, or command. Port forwarding relays TCP and UDP with port ranges, failover targets, connection limits, traffic statistics, and PROXY protocol, while SNI routing lets several services share port 443. Certificates are issued and renewed through ACME with DNS-01 wildcards or HTTP-01, then pushed to other hosts over SSH. Web services add per-domain reverse proxies, redirects, and static sites with HTTP/3, WebSocket, load balancing, health checks, rate limiting, caching, and sign-in through OIDC, GitHub, Google, or TOTP-protected shared users. A WAF running the OWASP Core Rule Set and fail2ban-style jails with trap ports and nftables bans guard the edge. Manage Docker containers and Compose projects with one-click upgrades and rollback, open SSH sessions with an SFTP file manager, run ping, traceroute, and speed tests, and receive alerts in Telegram, Discord, Slack, ntfy, or email. An audit log, config history with diff and rollback, encrypted backups, scoped API tokens, and Prometheus metrics round it out. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Created to eliminate the configuration fragmentation plaguing multi-device Homelab setups and small-team infrastructures, NetsGo merges what typically requires three separate tools — a tunnel daemon, a management panel, and a monitoring stack — into a single Go binary that starts with one command and listens on one port. The server exposes HTTP, TCP, and UDP tunnels, a built-in Web console for node management, a REST API for automation, and real-time traffic statistics with per-client bandwidth limiting, all sharing default port 9527 so firewalls and reverse proxies need only a single rule. Version 0.1.11 introduced Client-to-Client P2P tunnels via WebRTC DataChannel with three selectable transport strategies — Server relay, Prefer P2P with automatic fallback, and P2P only — reducing latency for direct connections while maintaining the centralized control plane. The management console displays every connected client's online status, authentication tokens, tunnel configuration, active transport mode, P2P candidate gathering progress, and cumulative byte-level traffic counters updated every second. Unlike frp or rathole which delegate management to external plugins or configuration files, NetsGo provides built-in client key generation, tunnel target migration between nodes, SOCKS5 proxying, IP-whitelist console access, and one-command server upgrades. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

zrok puts services that live behind NAT and firewalls onto the public internet with a shareable URL, without opening a single inbound port. The machine being shared dials out to an OpenZiti overlay network, so a web app on your desk, a Raspberry Pi at home, or a staging box inside a corporate network becomes reachable through your instance while its firewall stays closed. One command shares an HTTP service publicly; add a name from one of your namespaces and the URL stays stable even when you move the backend to a different machine, and an ephemeral name can be promoted to a reserved one when a quick demo turns into a keeper. Private shares skip the public internet entirely and reach only the users you grant, including raw TCP and UDP services, while web and drive backend modes publish static sites or whole folders, with OAuth, password auth, and an interstitial warning page available on public shares. The long-running agent keeps every share and access under one process, restarts the named ones after a reboot, and offers a localhost console for point-and-click sharing; the account-wide web console maps your environments, shares, and accesses as a navigable graph or a sortable table with live activity. Operators get invite-based accounts, InfluxDB-backed usage metrics, and configurable limits that warn or cut off accounts that exceed their quotas. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

TLSPROXY puts automatic Let's Encrypt TLS in front of every service on your server, so many names can share one port while each backend gets exactly the encryption treatment it needs. Terminate TLS and hand plain text to a local service. Pass raw TLS straight through when the proxy should see nothing. Or terminate and re-encrypt towards a TLS backend, with client certificates checked on the way in. QUIC and HTTP/3 connections terminate here too, and Encrypted Client Hello keeps even the handshake private. Certificates arrive and renew by themselves through http-01 and tls-alpn-01 challenges, PROXY protocol headers preserve real client addresses, and SNI routing with round-robin balancing spreads names across backends. People get in with OpenID Connect, SAML, or passkeys; the same sign-in can mint short-lived SSH user certificates, and built-in certificate authorities manage client and backend credentials for you. Static sites can be served straight from disk, TPM-backed keys keep private material in hardware, and a built-in console shows what the proxy is doing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Combining Docker container labels with a live web control plane, DockFlare automates Cloudflare Tunnel ingress routing, multi-zone DNS records, and Zero Trust Access policies across self-hosted infrastructure. DevOps engineers and homelab operators can attach simple container labels to expose HTTP, HTTPS, TCP, SSH, and RDP services publicly in seconds without clicking through external cloud dashboards. For non-containerized workloads such as bare-metal hypervisors or network appliances, administrators can define manual ingress rules, path-based routes, custom TLS SNI headers, and origin certificate bypass flags directly in the web interface. Security teams use reusable Access Groups and wildcard zone policies to enforce Google, GitHub, Azure AD, or custom OIDC authentication across every subdomain from a single policy definition. Distributed deployments connect lightweight remote agents back to the primary controller using Zero Trust service tokens so multi-host clusters share one unified routing view. When containers stop or restart, configurable grace-period timers prevent accidental route churn before cleaning up stale DNS entries, while encrypted state backups protect your entire ingress configuration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Rustunnel turns a service running on your laptop or private network into a public HTTPS, TCP, or UDP endpoint without opening inbound ports on the machine where it lives. Point the client at a local port and share the public address for webhook testing, a quick demo, an AI agent tool, SSH access, a game server, or an IoT device that cannot accept inbound connections. Give tunnels custom subdomains on your own wildcard domain, terminate HTTPS with automatic Let's Encrypt certificates, and keep client traffic encrypted from edge to local service. Put several backends behind one subdomain or TCP port and let TCP or HTTP health probes remove sick members before visitors hit them. When two peers can reach each other directly, start a P2P tunnel with NAT hole punching and QUIC, with relay fallback when the direct path fails. Watch sessions, tunnel health, traffic, and request logs from the live dashboard, inspect headers and bodies in the local request inspector, and replay a captured call while debugging a webhook. Manage tunnels, tokens, groups, captured requests, and history through the REST API, scrape Prometheus metrics, review audit logs, or let an MCP-compatible coding assistant create and close tunnels in plain language. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 34,000 GitHub stars and backing from a well-funded engineering team, Tailscale has fundamentally simplified how developers and system administrators think about secure networking. The client daemon establishes WireGuard tunnels directly between devices using sophisticated NAT traversal techniques, achieving direct peer-to-peer connections in the vast majority of network configurations without requiring port forwarding, firewall rules, or VPN concentrators. When direct connections prove impossible due to restrictive network environments, DERP relay servers provide encrypted fallback paths. MagicDNS assigns human-readable hostnames to every device on the network, eliminating the need to remember IP addresses across a tailnet. Subnet routing allows nodes to advertise access to entire local networks, enabling remote access to office resources, home labs, or cloud VPCs through a single gateway node. Exit node functionality routes all internet traffic through a designated device for privacy protection or geographic flexibility. Access control lists define granular policies for which devices and users can communicate with which services, enforced cryptographically at the network layer. The authentication layer integrates with identity providers including Google, Microsoft, GitHub, Apple, and OIDC-compliant systems for single sign-on access. Taildrop enables direct encrypted file transfers between devices without cloud intermediaries. The tailscale CLI provides complete network management from the terminal including status monitoring, route advertisement, and node configuration. Running Tailscale on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console provides a permanent, always-on node in your mesh network. BSD-3-Clause licensed with an active open-source community.

Give every laptop, server, and cloud VM you own one private address that works from anywhere, and that is exactly the overlay network Nebula builds. Each machine runs a single small binary, presents a certificate signed by your own certificate authority, and joins a peer-to-peer layer-3 mesh where tunnels form on demand between hosts that need to talk. Lighthouse nodes, the piece you park on a VPS, keep track of where every peer can be reached and introduce hosts to each other, so machines find each other without any central VPN concentrator carrying their traffic. UDP hole punching and keepalive packets open direct tunnels through home routers and office NAT, and when two hard NATs refuse to cooperate, a relay host forwards the encrypted traffic until a better path appears. Every host enforces its own firewall, default deny on all overlay traffic, with rules keyed to certificate groups, so laptops in the user-endpoint group can reach a server's web port while other groups cannot. Ordinary hosts need no inbound ports at all, and the same binary runs on Linux, macOS, Windows, phones, and FreeBSD, making the mesh feel identical at home, in a datacenter, or across three clouds. Unsafe routes can even pull an existing office subnet into the overlay, giving legacy hardware that will never run Nebula an address on the private network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

ZTNET provides a polished web dashboard for running your own ZeroTier network controller, covering network creation, member authorization, IP assignment, flow rule editing, and real-time node monitoring entirely from the browser. The organization system supports multi-tenant deployments where teams manage separate network pools with role-based permissions and customizable email notification templates for events like member joins, departures, IP changes, and authorization updates. Each network view displays connected members with their ZeroTier addresses, assigned IPs, last-seen timestamps, physical endpoints, and protocol versions in a clean tabular layout. The admin panel provides platform-wide user management, SMTP configuration for transactional emails, and system-level settings. Built on the T3 stack with Next.js, Prisma ORM, tRPC, TypeScript, and Tailwind CSS with DaisyUI components, the application supports both PostgreSQL and SQLite for persistence and communicates directly with the ZeroTier controller daemon through its native API. Dark and light themes adapt to user preference, and responsive layouts make network management practical from any device. Docker Compose bundles the web application alongside the ZeroTier controller service. Over 100,000 Docker pulls confirm steady community adoption. GPL-3.0 licensed.

Neko Master watches every connection flowing through your Clash, Mihomo, or Surge gateway and turns the stream into a live map of devices, domains, countries, and proxy nodes, so questions that once needed packet captures get answered at a glance. The dashboard refreshes over WebSocket as traffic moves, charting upload and download trends across thirty minutes, one hour, or a full day. Domain views rank every host your network contacts by traffic and connection count, and IP views add ASN and geographic detail, so an unfamiliar endpoint explains itself instead of raising an alarm. Proxy statistics break traffic down per node and per rule, which makes a saturated exit, a misrouted application, or an underused subscription obvious in seconds. One panel watches several gateways at once: add OpenClash backends directly, or install the one-command agent on OpenWrt, Linux, or macOS machines beside remote gateways and let each agent report home. Because agents open the connection outward, gateways behind NAT still report in, and the panel never reaches into your network uninvited. History persists in SQLite by default, and busy networks can dual-write traffic statistics to ClickHouse for larger histories while configuration stays in SQLite. Token-based access control protects the dashboard, dark mode and an installable PWA keep it comfortable on a phone, and the interface switches between English and Chinese. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

VyManager puts every VyOS router you run, across every site, into one web control plane with live dashboards and per-site permissions. Organize instances into logical sites, from the datacenter core to the smallest branch office, and add or remove routers without touching a command line. Live dashboards stream interface counters, system information, network graphs, and WireGuard peer status, so a saturated link announces itself before your users do. Configuration adapts to each router's VyOS version, with 1.4, 1.5, and rolling releases supported side by side during the longest upgrade cycle. Access is granted per site with OWNER, ADMIN, and VIEWER roles, API keys authenticate the machines, and SSH credentials stay encrypted at rest. A setup wizard walks a fresh deployment to its first managed router, and light, dark, and custom themes keep the night shift comfortable. For automation, AI assistants can be connected through the companion MCP integration, and the whole stack arrives as Docker Compose services you can redeploy in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Mapping every physical server, virtual machine, container, and network link across a sprawling homelab into a live interactive canvas, Circuit Breaker gives infrastructure operators real-time topology visualization, IP address management, and rack elevation modeling on a single screen. Operators can switch between hierarchical, concentric, cortex ring, radial, and force-directed graph layouts where animated edges reflect link speeds and color-coded status rings display live hardware health. Automated discovery scans local subnets using nmap, SNMP, and ARP while querying Proxmox VE clusters, TrueNAS storage pools, and UniFi controllers, staging newly detected nodes in a review queue before adding them to the map. For multi-site labs or isolated VLANs, lightweight remote agents connect outbound over Noise-encrypted links after fingerprint approval to report host telemetry and run scoped network scans without opening inbound firewall ports. Rack diagrams let administrators drag servers into U slots with cabling overlays using a built-in catalog covering Dell, HPE, Supermicro, Ubiquiti, MikroTik, Synology, and APC gear alongside live iDRAC, iLO, and UPS metrics. Role-based access control, OIDC single sign-on, TOTP multi-factor authentication, encrypted full-state snapshots, and a SHA-256 hash-chained audit log keep multi-user operations accountable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

NetMap answers the four questions every homelab owner asks in four different tools: what is on my network, what address did it get, is it still up, and why is the firewall shouting about it. Devices you add appear automatically on a visual canvas where you can drag them into place, draw the links between them, and group them into VLANs or separate sites, and the layout is still there when you come back. Behind the map, every device is watched continuously: ping times graphed over history, service checks on the ports you care about, a heartbeat strip that betrays intermittent dropouts, and an uptime percentage that settles arguments. Address management stops being a spreadsheet: define subnets, import the leases your router already handed out, see used and free addresses as a grid, and get warned before a duplicate assignment causes a mysterious outage. Firewall logs stream in live and each entry links to the device it concerns, ready to search by address, port, or protocol. When something new appears, a network scan discovers hosts with their names, hardware addresses, and open ports for review before they join the inventory. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Point your routers at Akvorado and every NetFlow, IPFIX, and sFlow record crossing your network becomes a chart you can interrogate. The web console opens on a live summary of flows per second, exporter count, and traffic split by autonomous system, port, protocol, country, and address family. From there, the visualize page turns stored flows into stacked, line, grid, and heatmap time series, plus Sankey diagrams that show how traffic moves between networks, interfaces, and countries. Filters use a simple SQL-like syntax, so a question like which customers pulled traffic over a transit link last night becomes a query, not a support ticket to your future self. Because the outlet polls each exporter with SNMP or gNMI, flows arrive wearing real interface names, descriptions, and speeds instead of raw ifIndex numbers nobody can read. GeoIP lookups attach country and city to addresses, classification rules tag providers, peers, and connectivity types, and optional BMP sessions add AS paths and BGP communities to every flow. Retention is tiered: raw flows keep full detail for recent days while one-minute, five-minute, and hourly rollups stretch summaries across a year of history. A Grafana plugin is available too, so the same flow data can sit on the dashboards your team already watches. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Network traffic stops being a mystery once ntopng names the hosts, applications, and protocols behind every flow, live in your browser. To find the host saturating an uplink, open the dashboard, which ranks top talkers, countries, autonomous systems, and protocols beside historical charts. To see what a suspicious host is contacting, open its page for traffic, ports, DNS queries, TLS details, and visited sites, plus a map of its conversations. Deep packet inspection recognizes applications such as Facebook, YouTube, and BitTorrent, so charts name the app behind the bytes instead of relying on port numbers alone. The console reads packets from a SPAN port or TAP and NetFlow, sFlow, or IPFIX records from routers and switches through nProbe, so it can cover a single switch or many remote sites. Behavioural checks raise alerts for flows, hosts, and interfaces and send them to email, Discord, Telegram, or webhooks. Active monitoring probes remote hosts over ICMP and HTTP/S, and network discovery lists the devices on your local network. A REST API and Lua scripting pull statistics into your own tools and add custom checks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Subnet math, DNS lookups, DHCP options, and certificate checks share one browser tab in Networking Toolbox, a free toolkit for sysadmins and network engineers. Need to carve a /24 into departments? The VLSM planner fits named subnet requirements into a parent block, reports each subnet's efficiency and the leftover space, and exports the plan as CSV or JSON. Merging address lists? CIDR utilities summarize, split, compare, and deaggregate prefixes, with set operations for difference, overlap, and containment. Writing configs? Generators build DHCPv4 and DHCPv6 options, PXE profiles, Kea or ISC snippets, and SPF, DKIM, DMARC, CAA, TLSA, and SRV records, and DNSSEC helpers calculate key tags and DS records. Something broken? Diagnostics query DNS through Cloudflare, Google, Quad9, OpenDNS, or a resolver of your choice, read TLS certificate chains, grade HTTP security headers, trace redirects, check TCP ports, look up BGP routes and RDAP records, and test mail servers. Need a refresher? Reference guides explain private ranges, CGNAT, IPv6 address types, and common ports. A keyboard search palette puts any tool a few keystrokes away, and bookmarked tools stay available offline. Eighteen themes, four languages, custom branding, and accessibility switches make it feel like your own, and a keyless JSON API serves the subnet, CIDR, IP, and DNS utilities to scripts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.