Open-Source & Self-Hosted Alternatives to Ngrok & LocalXpose
Commercial reverse proxy tunnels with bandwidth limits, ephemeral random URLs, and $8–$20/mo per-user pricing.
Why Migrate Away from Ngrok & LocalXpose?
Development teams rely on tunnels to test webhooks (Stripe, GitHub, Shopify), demo local websites to clients, and debug mobile APIs against local environments. Commercial tunneling SaaS like Ngrok charges steep per-seat monthly fees, imposes strict monthly bandwidth quotas (e.g., 5GB–10GB caps), assigns ephemeral random subdomains on lower tiers that break webhook URLs on restart, and passes all your sensitive unencrypted payload data through third-party infrastructure. Self-hosting frp (Fast Reverse Proxy) or Rathole on a €3.29/mo VPS gives you unlimited persistent custom subdomains (`webhook.yourdomain.com`), uncapped gigabit bandwidth, end-to-end Noise protocol encryption, multi-client support for your entire team, and zero third-party data inspection.
Technical Architecture & Migration Analysis
Commercial tunneling tools route your localhost traffic through centralized US/EU cloud proxy clusters, inspecting HTTP headers and enforcing per-gigabyte bandwidth metering. Self-hosted tunnels invert this paradigm: you deploy a lightweight server daemon (`frps` or `rathole`) on your own VPS. When you start your local client daemon, it opens a persistent multiplexed TCP connection to your server. Public traffic hitting your VPS domain is instantly forwarded across the private tunnel to your localhost port at full line speed with zero telemetry.
When NOT to Migrate (When Staying on Ngrok & LocalXpose Makes Sense)
Self-hosting is not universally the right move. Keep paying for SaaS if your team hits any of these constraints:
- ▸You require Ngrok's web GUI request inspection and 1-click webhook replay UI without configuring local packet logging.
- ▸You need ephemeral 10-second throwaway tunnels on machines where you have no permissions to manage DNS records.
- ▸Your developers do not have access to run a binary or configure a shared team VPS.
Real-World Cost Comparison: Ngrok & LocalXpose vs Self-Hosted
Comparing vendor cloud billings against standard Hetzner / DigitalOcean infrastructure costs at scale.
| Tier / Scale | Ngrok & LocalXpose Cost | Self-Hosted VPS Cost | Estimated Annual Savings | Technical Breakdown |
|---|---|---|---|---|
Solo Developer (Stripe/GitHub Webhook Testing) 1 developer, 3 persistent tunnel endpoints, 50GB traffic/mo | $8.00–$20.00/month ($96–$240/year on Ngrok Pro) | €3.29/month (Hetzner CX11) | $55–$200/year | Unlimited persistent custom subdomains on a flat budget VPS. |
Engineering Team (10 developers) 10 devs, 25 persistent subdomains, mobile API QA, 500GB traffic/mo | $80.00–$200.00/month ($960–$2,400/year) | €3.79/month (Hetzner CX22 with 20TB bandwidth) | $915–$2,350/year | One frps relay handles the entire company dev team simultaneously. |
Agency / Production Webhook Relays (30 devs + QA) 30 team members, client preview links, staging microservices | $300.00–$750.00/month ($3,600–$9,000/year on Ngrok Enterprise) | €14.28/month (Hetzner CPX31 4 vCPU, 8GB RAM) | $3,430–$8,830/year | Zero bandwidth overage fees and full privacy over sensitive payload inspection. |
Top 2 Recommended Open-Source Replacements
Tested, self-contained, and production-ready. Click any tool to inspect verified docker-compose configurations, hardware sizing, and deployment guides.
frp (Fast Reverse Proxy)
Apache-2.0⭐ 86.2k+A fast, production-grade reverse proxy to expose local servers behind NATs and firewalls to the Internet.
✅ Advantages
- Massive community (86.2k+ stars) and proven battle-tested reliability over 8+ years
- Zero bandwidth throttling — limited only by your VPS gigabit network port
- Supports static custom subdomains with wildcard SSL certificates automatically
⚠️ Trade-offs / Limitations
- Requires editing `frpc.toml` config file on developer machines rather than 1-click GUI client
- Admin must configure VPS firewall ports (e.g. 7000 for control port, 80/443 for HTTP vhosts)
- No built-in request replay UI like Ngrok web inspector (pair with Wireshark/mitmproxy if needed)
Core Features
version: '3.8'
services:
frps:
image: snowdreamtech/frps:latest
container_name: frps
restart: always
ports:
- "7000:7000" # FRP control port
- "7500:7500" # FRP Web Dashboard
- "8080:80" # HTTP tunnel port (forward via Caddy/Nginx)
- "8443:443" # HTTPS tunnel port
volumes:
- ./frps.toml:/etc/frp/frps.toml
networks:
- selfhost_net🚀 5-Minute Deployment Guide
- 1Provision a $3.50/mo VPS with a public IPv4 address and point a wildcard DNS record (`*.tunnel.yourdomain.com`) to it.
- 2Install Docker: `curl -fsSL https://get.docker.com | sh`.
- 3Create directory: `mkdir -p /opt/frps && cd /opt/frps`.
- 4Create `frps.toml` configuration: ```toml bindPort = 7000 auth.token = "your_strong_secret_token_2026" vhostHTTPPort = 80 webServer.port = 7500 webServer.user = "admin" webServer.password = "dashboard_password" ```
- 5Launch frps container: `docker compose up -d`.
- 6On your local developer laptop, install frp client (`brew install frpc` or download binary) and run with `frpc http -s vps_ip:7000 -t your_strong_secret_token_2026 -l 3000 --sd myapp` to expose localhost:3000 at `myapp.tunnel.yourdomain.com`.
Recommended Cloud VPS for frp (Fast Reverse Proxy)
Compare all VPS hosts →CX22 (2 vCPU, 4GB RAM, 20TB Traffic)
Includes 20TB monthly traffic at gigabit speeds for team tunneling.
Deploy on Hetzner →CX11 (1 vCPU, 2GB RAM, 20TB Traffic)
Ultra-affordable for individual developer webhook testing.
Deploy on Hetzner →Rathole
Apache-2.0⭐ 8.5k+A lightweight, secure, and high-performance NAT traversal reverse proxy written in Rust.
✅ Advantages
- Extremely lightweight — runs in <15MB RAM, ideal for co-locating on any existing VPS
- Noise Protocol encryption guarantees enterprise zero-knowledge transit security
- Minimal resource footprint with maximum throughput performance
⚠️ Trade-offs / Limitations
- No web dashboard UI (monitored via CLI logs / Prometheus metrics)
- Configuration is TOML-only without dynamic HTTP subdomain auto-creation
- Smaller ecosystem compared to frp
Core Features
version: '3.8'
services:
rathole:
image: rapiz1/rathole:latest
container_name: rathole-server
restart: always
ports:
- "2333:2333" # Rathole control port
- "8080:8080" # Exposed application port
volumes:
- ./server.toml:/app/server.toml
command: ["--server", "/app/server.toml"]
networks:
- selfhost_net🚀 5-Minute Deployment Guide
- 1Provision a $3.50/mo VPS.
- 2Install Docker: `curl -fsSL https://get.docker.com | sh`.
- 3Create directory: `mkdir -p /opt/rathole && cd /opt/rathole`.
- 4Create `server.toml` with your listening port and service token definitions.
- 5Launch container: `docker compose up -d`.
- 6Run client daemon on your local workstation pointing to your VPS IP to establish the encrypted tunnel.
Recommended Cloud VPS for Rathole
Compare all VPS hosts →CX11 (1 vCPU, 2GB RAM, 20GB NVMe)
Perfect low-overhead host consuming negligible server RAM.
Deploy on Hetzner →Basic Droplet (1 vCPU, 1GB RAM, 25GB SSD)
Quick provisioning with low ping times.
Claim $200 DO Credit →Quick Specification Matrix
| Tool | License | Min RAM | Min CPU | GitHub Repo | Primary Advantage |
|---|---|---|---|---|---|
| Ngrok & LocalXpose (Proprietary) | Proprietary Closed | Managed Cloud | Managed Cloud | N/A | Turnkey onboarding with vendor lock-in & paywalls |
| frp (Fast Reverse Proxy) | Apache-2.0 | 128 MB | 1 vCPU | fatedier/frp | Massive community (86.2k+ stars) and proven battle-tested reliability over 8+ years |
| Rathole | Apache-2.0 | 64 MB | 1 vCPU | rapiz1/rathole | Extremely lightweight — runs in <15MB RAM, ideal for co-locating on any existing VPS |
Performance Benchmarks & Hard Operational Limits
Real-world operational trade-offs, resource consumption limits, and measured throughput.
| Benchmark Metric | Ngrok & LocalXpose Baseline | Self-Hosted Alternative Metric | Operational Bottleneck / Limit | Source |
|---|---|---|---|---|
| Tunnel Network Throughput (Gigabit VPS) | 15MB/s–35MB/s (Throttled by free/standard SaaS relay limits) | 95MB/s–120MB/s (Saturates full 1Gbps VPS network connection) | Local developer internet upload speed. | Production Test |
| Static Custom Subdomain Retention | Requires $8+/mo paid plan (ephemeral on free tier) | Permanent custom wildcard DNS domains at zero extra charge | DNS configuration. | Production Test |
| Monthly Bandwidth Allowance | 5GB–10GB/mo free quota, then steep overage fees | 20TB/mo included with Hetzner VPS | None for standard dev team operations. | Production Test |
Frequently Asked Questions
Practical deployment, migration, and maintenance answers.
Can I use custom domain names like `dev.mycompany.com` with self-hosted FRP?▾
Yes. Point a wildcard DNS A record (`*.tunnel.yourdomain.com`) to your VPS IP address. In your local `frpc.toml` config, specify `customDomains = ["dev.mycompany.com"]` or `subdomain = "dev"` to immediately route traffic to your local port.
How does end-to-end encrypted tunneling work in FRP?▾
FRP includes an STCP (Secret TCP) mode. In STCP mode, traffic between the visitor client and your local service is encrypted using a shared secret key, preventing the VPS server itself from decrypting the payload.
Can multiple developers share one self-hosted FRP server?▾
Yes. FRP supports multi-user tokens and distinct subdomains. Each developer can configure their own subdomain prefix (e.g. `alice-app.tunnel.com` and `bob-app.tunnel.com`) without conflicting.
Does Rathole or FRP forward non-HTTP traffic like SSH or Postgres databases?▾
Yes. Both FRP and Rathole support raw TCP and UDP port forwarding, allowing you to expose local SSH daemons, Postgres/MySQL database instances, or game servers through your VPS.
Can I secure my exposed development tunnels with basic authentication?▾
Yes. FRP supports built-in HTTP basic authentication (`httpUser` and `httpPassword` parameters), preventing unauthorized web crawlers from accessing your local development endpoints.
Skip the setup: get the production-ready stack
Don't stitch together configs from five different READMEs. Get all 5 production-hardened Docker Compose stacks — Postgres, Redis, SSL auto-renewal, and backup scripts — ready to deploy in minutes.
One-time purchase · Instant download · Production-ready