Back to catalog
Rathole
Apache-2.0Rathole is an open-source Rust reverse proxy providing high-throughput, self-hosted NAT traversal as an alternative to commercial ngrok tunnels.
Open-source alternative to — compare it against:
Overview
Developer rapiz1 created Rathole as a high-throughput NAT traversal reverse proxy in Rust to eliminate the memory overhead of Go-based tools like frp. Maintained under the rathole-org organization, the daemon punches TCP and UDP tunnels through carrier-grade NATs to a public relay server. By removing third-party hosted dependencies, it gives teams full control over edge ingress without recurring subscription costs.
Why Rathole instead of ngrok
Commercial ingress services like ngrok charge subscriptions based on active user seats, metered bandwidth, and reserved domains. Teams running persistent staging environments or devices behind carrier-grade NAT quickly face compounding monthly bills. Rathole replaces ngrok's core tunneling function—forwarding TCP and UDP traffic through private firewalls to a public IP—by running as a self-hosted client-server pair. DevOps engineers deploy the server daemon to an inexpensive VPS and route unmetered traffic across arbitrary ports for only the base compute cost.
The trade-off is operational ownership. While ngrok provides instant public URLs, managed TLS certificates, and a web-based traffic inspector, Rathole intentionally omits application-layer features. It does not inspect HTTP payloads or manage hostnames; production setups pair Rathole with an upstream reverse proxy like Caddy or Nginx on the relay host for TLS termination and domain routing. For teams willing to manage a VPS, migrating from ngrok removes SaaS billing and keeps payload traffic private.
What it does well
- High-throughput stream forwarding: Implemented in async Rust with Tokio, delivering higher connection concurrency than Go alternatives while holding idle memory to a few megabytes.
- Minimal binary footprint: Compiles to a static binary under 1 MiB, allowing deployment directly onto resource-constrained routers, embedded hardware, and small containers.
- Noise protocol encryption: Supports Noise_NK and Noise_KK handshakes with X25519 and ChaCha20-Poly1305, securing client-server transit without managing X.509 certificates.
- Hot configuration reloading: Detects runtime edits to TOML files, letting operators add or remove services without daemon restarts or dropping active traffic.
- Native TCP and UDP forwarding: Tunnels arbitrary transport-layer protocols, allowing teams to expose WireGuard VPNs, game servers, SSH, and databases.
