OSI-licensed only · self-hostable
Cloudflare bundles several jobs into one dashboard: a CDN and caching layer, a reverse proxy with a web application firewall, authoritative DNS, and tunnels that expose private services. No single open-source project does all of that, and none gives you Cloudflare's global network, but each job has a solid self-hosted option you can run on your own servers.
Every tool below is under an OSI-approved licence (Apache-2.0, MIT, AGPL-3.0 or GPL-2.0), checked against its repository. Be realistic about one thing: self-hosting replaces the software, not the anycast network, so DDoS absorption at Cloudflare's scale is not something these tools reproduce on a single VPS.
Licences checked against each repository on November 7, 2026.
| Tool | Best for | Licence | Runs as |
|---|---|---|---|
| Caddy | Simple reverse proxy with automatic HTTPS | Apache-2.0 | Server |
| Traefik | Reverse proxy for containers and microservices | MIT | Docker |
| Apache Traffic Server | Edge caching proxy you operate yourself | Apache-2.0 | Server |
| BunkerWeb | All-in-one WAF in front of web apps | AGPL-3.0 | Docker |
| Coraza | WAF engine to embed in your own proxy | Apache-2.0 | Server |
| CoreDNS | Flexible DNS server with plugins | Apache-2.0 | Server |
| PowerDNS | Authoritative and recursive DNS at scale | GPL-2.0 | Server |
| frp | Exposing a local service behind NAT | Apache-2.0 | Server |
| Pangolin | Self-hosted tunnelled access built on WireGuard | AGPL-3.0 | Docker |
Best for: Simple reverse proxy with automatic HTTPS
An extensible server platform that uses TLS by default. Works well as a reverse proxy in front of your apps with minimal configuration.
Best for: Reverse proxy for containers and microservices
A modern HTTP reverse proxy and load balancer built to make deploying microservices easy. Fits Docker-based setups where routes change often.
Best for: Edge caching proxy you operate yourself
A fast, scalable and extensible HTTP/1.1 and HTTP/2 compliant caching proxy server, and the closest building block here to Cloudflare's caching role.
Best for: All-in-one WAF in front of web apps
Describes itself as a next-generation, open-source Web Application Firewall. Sits in front of your services as a reverse proxy with security features enabled.
Best for: WAF engine to embed in your own proxy
An open-source, high-performance Web Application Firewall library that can protect applications from within your existing server stack.
Best for: Flexible DNS server with plugins
A DNS server and forwarder written in Go that chains plugins, so you enable only the features you need.
Best for: Authoritative and recursive DNS at scale
The repository contains the PowerDNS Recursor, the Authoritative Server and dnsdist, a DNS load balancer.
Best for: Exposing a local service behind NAT
A fast reverse proxy that lets you expose a server behind a NAT or firewall to the internet, similar in purpose to Cloudflare Tunnel.
Best for: Self-hosted tunnelled access built on WireGuard
An open-source SASE platform built on WireGuard. The Community Edition is AGPL-3; the repository is dual licensed with a separate Fossorial Commercial License for the Enterprise Edition.
One email a week with the open-source projects, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| Automatic HTTPS reverse proxy for a few apps | Caddy |
| Container-heavy setup with changing routes | Traefik |
| Caching proxy for your origin | Apache Traffic Server |
| A self-hosted WAF | BunkerWeb or Coraza |
| Running your own DNS | CoreDNS or PowerDNS |
| Exposing a home or private service | frp or Pangolin |
Quick answers to common questions
There is no single one. Cloudflare is proprietary, and its services (CDN, WAF, DNS, tunnels) map to separate projects such as Traffic Server, BunkerWeb or Coraza, CoreDNS or PowerDNS, and frp.
You can run a caching proxy such as Apache Traffic Server, but a single server does not give you a global edge network. For that you would need to deploy several servers in different regions yourself.
frp and Pangolin both let you expose services that sit behind a NAT or firewall. frp is a reverse proxy; Pangolin is a WireGuard-based platform whose Community Edition is AGPL-3.
BunkerWeb and Coraza are real WAFs you can run yourself, but you maintain rules and updates. They do not come with a managed threat-intelligence service.
Most picks here are Apache-2.0 or MIT. BunkerWeb and Pangolin's Community Edition are AGPL-3.0, and PowerDNS is GPL-2.0, which matters mainly if you modify and redistribute the code.
List it on TechLogHub and we'll review it for this page.
