Back to catalog
BoringProxy
MITBoringProxy is a self-hosted alternative to Pinggy that combines SSH tunneling, automated HTTPS, and a web admin UI in a single Go binary.
Open-source alternative to — compare it against:
Overview
BoringProxy is an open-source tunneling reverse proxy that exposes internal web services through a self-hosted relay. Instead of routing through third-party relays or configuring Nginx alongside custom SSH tunnels, it packages automated Let's Encrypt certificates, reverse SSH tunneling, and a web admin UI into one Go binary. Clients dial outbound to publish local ports without router port forwarding.
Why BoringProxy instead of Pinggy
Pinggy targets instant, ephemeral port sharing. A developer runs a single SSH command to generate a public URL in seconds without configuring credentials, using a terminal UI to inspect requests during local debugging. That model fits quick demos or webhook testing, but it introduces friction for long-running services. Free Pinggy URLs re-randomize upon reconnect, and persistent domains require recurring subscription plans on shared multi-tenant infrastructure.
BoringProxy targets persistent self-hosted routing. You deploy the server on an inexpensive VPS, map a domain to the public IP, and generate long-lived client tokens. Client daemons run as systemd services or Docker containers on internal hardware, maintaining persistent reverse SSH tunnels that reconnect across network interruptions. The trade-off is operational responsibility: Pinggy eliminates server maintenance entirely, while BoringProxy requires managing a Linux host, DNS records, and open ports.
What it does well
- Automated HTTPS provisioning: uses Caddy's CertMagic to request and renew Let's Encrypt certificates on the public server without external cron jobs or certbot scripts.
- Browser-based management: provides a web UI to monitor active tunnels, assign subdomains, and generate client authentication tokens without editing server config files.
- Outbound SSH tunnels: establishes reverse SSH connections from internal machines, traversing firewalls, NAT, and CGNAT without inbound port forwarding.
- Flexible TLS termination: supports terminating encryption at the relay server, forwarding raw TCP tunnels, or terminating TLS on the client machine.
- Headless REST API: includes HTTP endpoints for programmatic tunnel provisioning, allowing deployment scripts and CI pipelines to automate ingress.
- Standalone Go binary: embeds client-server routing logic and a lightweight JSON database into a single executable requiring no PostgreSQL or Redis daemons.
