CELERITY Panel puts every Hysteria 2 and Xray VLESS node you run behind one clean web panel, so a fleet of proxy servers behaves like a single service. Add a node and the panel connects over SSH to install the software, certificates, and port hopping for you. Server groups map users to the nodes they may use, and load balancing spreads them by real server load. Cascade topology chains servers together, so clients connect to one node while traffic exits through another, drawn on a visual network map. Traffic rules block advertising domains and unwanted destinations or route selected traffic through custom proxies. Each user receives a subscription link that formats itself for Clash, Sing-box, Shadowrocket, and Hiddify. The dashboard watches online users, traffic volume, and node health in real time, and an in-browser SSH terminal reaches any node without leaving the panel. Programmatic control comes through scoped API keys with IP allowlists and rate limits, signed webhooks announce events as they happen, automatic backups land on S3-compatible storage, and AI assistants can operate the panel through its MCP interface. Two-factor authentication protects the admin login. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

3X-UI is the most popular open-source Xray management panel, providing a full-featured web interface for deploying and monitoring proxy and VPN protocols on Linux servers. The Go backend manages Xray-core instances supporting VLESS, VMess, Trojan, Shadowsocks, WireGuard, Hysteria2, HTTP, SOCKS, Dokodemo-door, and TUN inbounds across TCP, mKCP, WebSocket, gRPC, HTTPUpgrade, and XHTTP transports secured with TLS, XTLS Vision, and REALITY. The Clients page tracks each user with individual traffic quotas, expiration dates, concurrent connection limits, and live online status indicators, while one-click share links, QR codes, and a built-in subscription server distribute configurations in multiple output formats. The multi-node architecture manages and scales deployments across multiple servers from a single panel instance. The Panel Settings page configures listen address, port, URI path, session duration, trusted proxy CIDRs, authentication, and Telegram bot integration for remote monitoring and management alerts. Outbound routing supports WARP, NordVPN, custom rules, load balancers, and proxy chaining. Xray Configs provides template-level control over the core configuration, while the API Docs page exposes a complete RESTful API with in-panel Swagger documentation. Data persists in SQLite by default or PostgreSQL for larger deployments, with database export and import from the panel. Fail2ban integration enforces per-client IP limits. On RepoCloud, deploy 3X-UI on a dedicated VPS with Docker, root SSH access, and complete control over your proxy infrastructure, all under the GPL-3.0 license.

Running a VPN for family, friends, or a small team usually means babysitting servers one SSH session at a time, and Mistgate replaces that with one panel that keeps the whole fleet configured. Add a server from the browser by typing its address and root password: the panel pins the host key, checks the host, opens the ports, and installs the signed node agent for you. Each person gets one subscription link that their app turns into the server list, or a personal AmneziaVPN key per device, so a lost phone can be revoked without touching anyone else. Groups decide which protocol profiles a person receives, while per-user traffic quotas, expiry dates, device limits, and per-device speed limits keep sharing fair. Hysteria2 brings QUIC-based speed with port hopping, obfuscation, and certificate options; VLESS REALITY and AmneziaWG 2.0 and 3.1 cover networks where one protocol gets blocked, and Cloudflare WARP can serve as the exit for all three. Every five minutes the panel connects to each server the way a real client app would, a doctor on every node runs host checks with safe fixes, and alerts reach you on Telegram before your users notice. The public address shows strangers a decoy site while the admin hides behind a secret path, and encrypted backups go to your Cloudflare R2 bucket on a schedule. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

One encrypted network for every machine you run: Tunnet links laptops, home servers, cloud instances, and CI runners into a private mesh that behaves like a single LAN. Each enrolled machine gets an overlay IP and a hostname, so ordinary tools like ping, curl, SSH, and the browser just work across home servers, cloud instances, and laptops. Publish an internal app to your peers with Serve, or expose a local service to the public internet with an HTTPS tunnel when you need a shareable link. Send files directly between machines without detouring through cloud drives, email attachments, or fragile copy commands. SSH access follows identity instead of scattered key files, with session recording and no bastion host to maintain. Device posture checks gate which machines may join, and subnet routes, exit nodes, and high-availability gateways extend the fabric to whole networks. Write your ACLs, groups, tags, and SSH rules as Policy as Code in Git, simulate changes offline, review semantic diffs on pull requests, and roll back revisions when a change misbehaves. The Kubernetes operator advertises cluster networks, publishes services to peers, and exposes public HTTPS endpoints through custom resources. Run the full stack yourself, control plane, dashboard, management API, relays, and audit logs included, or skip the server entirely with Direct mode for a zero-server peer-to-peer mesh. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 and MPL-2.0 licensed.

Give every laptop, server, and cloud VM you own one private address that works from anywhere, and that is exactly the overlay network Nebula builds. Each machine runs a single small binary, presents a certificate signed by your own certificate authority, and joins a peer-to-peer layer-3 mesh where tunnels form on demand between hosts that need to talk. Lighthouse nodes, the piece you park on a VPS, keep track of where every peer can be reached and introduce hosts to each other, so machines find each other without any central VPN concentrator carrying their traffic. UDP hole punching and keepalive packets open direct tunnels through home routers and office NAT, and when two hard NATs refuse to cooperate, a relay host forwards the encrypted traffic until a better path appears. Every host enforces its own firewall, default deny on all overlay traffic, with rules keyed to certificate groups, so laptops in the user-endpoint group can reach a server's web port while other groups cannot. Ordinary hosts need no inbound ports at all, and the same binary runs on Linux, macOS, Windows, phones, and FreeBSD, making the mesh feel identical at home, in a datacenter, or across three clouds. Unsafe routes can even pull an existing office subnet into the overlay, giving legacy hardware that will never run Nebula an address on the private network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Meshlan turns your own Linux server into the control plane for a private virtual LAN that connects remote Windows devices as if they sat on the same router. Devices pair through your server, receive their certificates, and then talk directly to each other over encrypted tunnels whenever NAT allows, using dual-stack hole punching, UPnP, and STUN diagnostics to find a path. When a direct connection is impossible, traffic falls back to relays, and multiple relay nodes are chosen automatically by latency, jitter, packet loss, and health. You can publish a service that only listens on localhost, a local API, a web panel, a database, a game server, to the mesh on a custom port, with direct access or manual approval by its creator. Names stay stable while addresses change: devices answer to names like alice.mesh and services to api.alice.mesh, and an HTTPS gateway serves mesh websites without port numbers. Files move directly between devices over the encrypted link while the server only distributes metadata. The console shows the live topology with P2P and relay paths, latency, and service health, and local history keeps traffic and events for replay with a time slider. Optional AI automation keeps model keys on the server, encrypts context end to end, and asks for your confirmation before changing anything. Signed updates verify and roll back automatically when a health check fails. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Open your laptop in a Lisbon cafe and your files at home answer as if the laptop never left the desk: AnywhereLAN stitches your own machines into one private mesh network with stable names like work-laptop.awl, no port forwarding and nothing exposed to internet scanners. There is no coordination server to trust. Peers announce themselves in the libp2p DHT, identify with ed25519 keys and connect directly over QUIC or TCP with TLS 1.3, hole-punching through NAT and borrowing a community relay only when both ends sit behind hostile firewalls. Send a browser out through the house connection with the built-in SOCKS5 proxy on 127.0.0.1:1066, handy on regional blocks and hostile hotel Wi-Fi. Prefer the full tunnel: the VPN gateway routes every IPv4 byte through a chosen peer, so the whole machine presents the exit node's address to the world. Devices join through invite links or QR codes. Every peer approves its friends and grants exit rights individually, and identity is a keypair you hold, so no account recovery email can betray the network. Manage it from the bundled web UI at admin.awl, script it from the awl CLI, watch it through Prometheus metrics on port 8639, and run it on Windows, macOS, Linux servers and Android phones. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

ZTNET provides a polished web dashboard for running your own ZeroTier network controller, covering network creation, member authorization, IP assignment, flow rule editing, and real-time node monitoring entirely from the browser. The organization system supports multi-tenant deployments where teams manage separate network pools with role-based permissions and customizable email notification templates for events like member joins, departures, IP changes, and authorization updates. Each network view displays connected members with their ZeroTier addresses, assigned IPs, last-seen timestamps, physical endpoints, and protocol versions in a clean tabular layout. The admin panel provides platform-wide user management, SMTP configuration for transactional emails, and system-level settings. Built on the T3 stack with Next.js, Prisma ORM, tRPC, TypeScript, and Tailwind CSS with DaisyUI components, the application supports both PostgreSQL and SQLite for persistence and communicates directly with the ZeroTier controller daemon through its native API. Dark and light themes adapt to user preference, and responsive layouts make network management practical from any device. Docker Compose bundles the web application alongside the ZeroTier controller service. Over 100,000 Docker pulls confirm steady community adoption. GPL-3.0 licensed.

Instead of wrestling with raw command-line flags and YAML configuration files for every device on your self-hosted Headscale mesh VPN, Headplane gives you a Tailscale-style web administration console to manage machines, users, DNS records, and access policies from any browser. From the machines overview, network administrators can inspect connected nodes, view Tailnet IPv4 and IPv6 addresses, rename devices, reassign ownership across users, toggle key expiration, and approve advertised subnet routes or exit nodes in a couple of clicks. Built-in Access Control List (ACL) management lets you edit security policies, define user groups, assign node tags, and configure auto-approvers without manually SSHing into your control server. When someone needs immediate shell access to a remote Linux host on the mesh, the integrated WebSSH console opens an interactive terminal session right inside the browser tab over Tailscale SSH. You can also manage MagicDNS settings, configure split DNS nameservers, and add custom DNS records that automatically reload your Headscale instance. Multi-user administration supports OpenID Connect (OIDC) single sign-on with identity providers like Okta, Authentik, Authelia, and Google Workspace, alongside granular role assignments and pre-authentication key generation for unattended server enrollment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Wag is an authentication gateway for WireGuard that lets each device reach only the routes it should, and asks for a second factor before the sensitive ones open. Admins write access policies for everyone, groups, or single users, marking subnets, hosts, ports, and protocols as MFA-required, always allowed, or denied, and the most specific prefix wins, so one allowed address can sit inside a protected range. Devices join with a registration token, and the public endpoint answers with a finished WireGuard profile. Users then confirm a TOTP code, a WebAuthn security key, an OIDC single sign-on login that maps identity provider groups into Wag groups, or a PAM prompt, and repeated failures lock the account. Session lifetime and idle timeouts decide when they must prove themselves again. The browser portal lists users, devices, rules, registration tokens, and webhooks with real-time notifications, while a command line locks devices, resets MFA, and manages administrators. Webhooks turn JSON from an HR or identity system into new tokens or removed users and devices, and clients can fetch the list of guarded routes from a small API. Remote staff, contractors limited to one host, and homelabs are typical uses. When a server fails, the VPN remains reachable through clustering with witness nodes or an external etcd, and certificates arrive through ACME with HTTP-01 or Cloudflare DNS-01. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

Behind one admin panel, DefGuard runs a WireGuard VPN, an identity provider, and multi-factor authentication, so every person and device proves who they are before reaching your private network. Administrators define VPN locations, assign which users and groups may enter each one, and enforce firewall rules that allow or deny traffic per location, with changes applied to gateways in real time. People enroll remotely through a guided self-service flow, register their own laptops and phones, and connect with desktop and mobile clients that show live connection statistics. Sign-in goes well beyond passwords, because the built-in OpenID Connect provider gives internal tools single sign-on, while TOTP codes, WebAuthn and FIDO2 keys, email tokens, and mobile biometrics gate each connection. Directory teams sync accounts from LDAP and Active Directory, or federate sign-in through Google, Microsoft, and custom OpenID providers, instead of maintaining a separate user list. Every authentication, enrollment, and policy change lands in a searchable activity log, and webhooks plus a REST API let surrounding systems react to access events automatically. Gateways keep enforcing access from a local cache when the control plane is unreachable, and several gateways can front the same location for failover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Qeli is a self-hosted VPN built for networks where ordinary VPN protocols get recognized and blocked, disguising its traffic as ordinary web traffic while keeping the classic full-tunnel experience. Where WireGuard, OpenVPN, and IKEv2 carry fingerprints that deep packet inspection has learned to spot, Qeli answers with five wire modes: plain, TLS mimicry, ChaCha20 obfuscation behind WebSocket fronting, REALITY, and a flagship mode that carries the private stream inside a genuine HTTP/2 request within a real TLS 1.3 exchange. A probe without a valid token never learns the difference, because the server bridges it to the configured public target site. The handshake is hybrid post-quantum, X25519 plus ML-KEM-768, with a ChaCha20-Poly1305 data plane, and the tunnel itself behaves like the VPNs people already know: full-tunnel or split routing, OS-level DNS, and per-app include or exclude rules on Windows, macOS, and Android. A one-command installer on a clean Debian or Ubuntu server asks for a profile and a port, writes the NAT configuration, creates the first users, and prints ready-to-paste connection links. The web panel then issues qeli:// links and QR codes per person behind an Argon2id login, so onboarding a phone is a camera scan instead of a config file. Clients cover Linux, Windows, macOS, Android, and Keenetic and OpenWrt routers, and published lab benchmarks average around 1220 Mbit/s across all twelve profiles. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Most proxies ask the operating system nicely for a socket; paqet skips the conversation, building its own TCP packets byte by byte to tunnel traffic between your machine and your server. The server end listens on a port you choose and speaks only in raw packets it crafts and captures itself through pcap, before the kernel's connection tracking ever sees them. On your machine, the client presents an ordinary SOCKS5 proxy on localhost plus optional port forwards, so browsers and command-line tools connect exactly as they would to any proxy. Between the two ends, KCP with smux multiplexing turns a stream of self-contained packets into fast, reliable, encrypted sessions, with AES or lighter modes selected per deployment. TCP flag cycling varies how packets present themselves on the wire, giving operators control over the traffic pattern the tunnel produces. Built-in utilities generate the shared secret, ping the server with a single test packet, and dump live traffic decoded, so a silent tunnel gets diagnosed in minutes rather than by packet-capture archaeology. One YAML file per side declares the role, network interface, gateway MAC, and keys, and the same binary runs both ends. It suits security research, hostile networks, and anyone whose ordinary proxies keep getting reset. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

A self-hosted front door for apps that live on home labs, office LANs, and private clusters, Wiredoor publishes them to the internet without opening a single inbound port on the private side. The Wiredoor CLI on each remote machine dials out to the server over an encrypted WireGuard tunnel. Web apps and APIs are routed by domain and path, WebSocket traffic included, while TCP and UDP services such as SSH or Redis get a public port of their own. Public domains receive Let's Encrypt certificates, internal names fall back to self-signed ones, and Cloudflare or GoDaddy credentials let the server create DNS records itself. Any web route can demand OAuth2 sign-in with an email allow list and a few open paths, and every protocol accepts IP allow lists. Gateway nodes stretch one tunnel across a Docker network, Kubernetes cluster, or private subnet, so a single link serves many backends. Services can be switched off or given an expiry such as 30 minutes, 2 hours, or 1 day. The dashboard shows which nodes are connected and whether their services are enabled, while the CLI creates, enables, and disables services from a terminal. Optional Prometheus and Grafana views chart traffic and tunnel peers, and CrowdSec can block abusive addresses. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Created to eliminate the configuration fragmentation plaguing multi-device Homelab setups and small-team infrastructures, NetsGo merges what typically requires three separate tools — a tunnel daemon, a management panel, and a monitoring stack — into a single Go binary that starts with one command and listens on one port. The server exposes HTTP, TCP, and UDP tunnels, a built-in Web console for node management, a REST API for automation, and real-time traffic statistics with per-client bandwidth limiting, all sharing default port 9527 so firewalls and reverse proxies need only a single rule. Version 0.1.11 introduced Client-to-Client P2P tunnels via WebRTC DataChannel with three selectable transport strategies — Server relay, Prefer P2P with automatic fallback, and P2P only — reducing latency for direct connections while maintaining the centralized control plane. The management console displays every connected client's online status, authentication tokens, tunnel configuration, active transport mode, P2P candidate gathering progress, and cumulative byte-level traffic counters updated every second. Unlike frp or rathole which delegate management to external plugins or configuration files, NetsGo provides built-in client key generation, tunnel target migration between nodes, SOCKS5 proxying, IP-whitelist console access, and one-command server upgrades. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

zrok puts services that live behind NAT and firewalls onto the public internet with a shareable URL, without opening a single inbound port. The machine being shared dials out to an OpenZiti overlay network, so a web app on your desk, a Raspberry Pi at home, or a staging box inside a corporate network becomes reachable through your instance while its firewall stays closed. One command shares an HTTP service publicly; add a name from one of your namespaces and the URL stays stable even when you move the backend to a different machine, and an ephemeral name can be promoted to a reserved one when a quick demo turns into a keeper. Private shares skip the public internet entirely and reach only the users you grant, including raw TCP and UDP services, while web and drive backend modes publish static sites or whole folders, with OAuth, password auth, and an interstitial warning page available on public shares. The long-running agent keeps every share and access under one process, restarts the named ones after a reboot, and offers a localhost console for point-and-click sharing; the account-wide web console maps your environments, shares, and accesses as a navigable graph or a sortable table with live activity. Operators get invite-based accounts, InfluxDB-backed usage metrics, and configurable limits that warn or cut off accounts that exceed their quotas. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Pomerium puts every internal application behind a single identity-aware proxy, so engineers reach dashboards, admin panels, and databases through their browser with no VPN client and no network-level trust. Sign-in flows through your existing identity provider, including Google, Okta, Azure AD, GitHub, GitLab, and any OpenID Connect service, with sessions verified continuously rather than once at login. Each route carries its own policy: restrict the finance tool to the finance group, require a specific email domain for the admin console, or allow read-only paths more broadly. Authorized requests pass identity headers the application can trust, and every access decision is logged for audit. TCP routes extend the same sign-in and policy checks to SSH, PostgreSQL, MySQL, and RDP connections through a small client or a browser-based terminal. In Kubernetes, Pomerium doubles as an ingress controller, applying the same policies to services as annotations on ingress resources. Mutual TLS between the proxy and backends, encrypted sessions, and short-lived credentials replace shared passwords and flat networks. Teams roll it out as one all-in-one binary or split the proxy, authorize, authenticate, and cache services across machines as traffic grows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 34,000 GitHub stars and backing from a well-funded engineering team, Tailscale has fundamentally simplified how developers and system administrators think about secure networking. The client daemon establishes WireGuard tunnels directly between devices using sophisticated NAT traversal techniques, achieving direct peer-to-peer connections in the vast majority of network configurations without requiring port forwarding, firewall rules, or VPN concentrators. When direct connections prove impossible due to restrictive network environments, DERP relay servers provide encrypted fallback paths. MagicDNS assigns human-readable hostnames to every device on the network, eliminating the need to remember IP addresses across a tailnet. Subnet routing allows nodes to advertise access to entire local networks, enabling remote access to office resources, home labs, or cloud VPCs through a single gateway node. Exit node functionality routes all internet traffic through a designated device for privacy protection or geographic flexibility. Access control lists define granular policies for which devices and users can communicate with which services, enforced cryptographically at the network layer. The authentication layer integrates with identity providers including Google, Microsoft, GitHub, Apple, and OIDC-compliant systems for single sign-on access. Taildrop enables direct encrypted file transfers between devices without cloud intermediaries. The tailscale CLI provides complete network management from the terminal including status monitoring, route advertisement, and node configuration. Running Tailscale on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console provides a permanent, always-on node in your mesh network. BSD-3-Clause licensed with an active open-source community.