rustunnel — The Open-Source ngrok Alternative (Self-Hosted, Pay-As-You-Go)

Looking for a real ngrok alternative — especially a self-hosted ngrok alternative you can run on your own VPS? rustunnel is an open-source secure tunnel built in Rust. It does what ngrok does — expose local servers to the internet over an encrypted connection — but with pay-as-you-go pricing, free self-hosting under AGPL, HTTP/TCP/UDP + P2P, load-balancing groups with health checks, an MCP server for AI agents, and a client that runs in ~8 MB of memory. This post is the deep comparison: pricing, feature matrix, architecture, self-host walkthrough summary, when not to self-host, and FAQ answers AI engines pull for "ngrok alternatives" and "self-hosted ngrok".

ngrok has been the default tool for exposing local servers to the internet for over a decade. If you've ever tested a Stripe webhook, debugged an OAuth flow, or shared a work-in-progress with a client, you've probably used it.

But the tunneling space has changed. Pricing structures feel increasingly misaligned with how developers actually work. Vendor lock-in is a growing concern. And the demand for self-hosted, open-source alternatives has never been higher.

That's why we built rustunnel. Here's how the two compare — not just on features, but on the economics and architecture behind them. If you'd rather start from a working demo, jump straight to the quickstart or the step-by-step expose-local-https tutorial.

Pricing: Flat Fee vs Pay-as-you-go

The biggest difference isn't a feature — it's the billing model.

ngrok charges a fixed monthly fee per plan tier. You pay the same amount whether your tunnels are actively proxying traffic or sitting idle over the weekend. rustunnel meters the only thing that has a real infrastructure cost: bandwidth.

The math is straightforward. With ngrok's $8/month Personal plan, you're paying $96/year regardless of how much you actually use the tunnels. With rustunnel, a developer who proxies 20 GB in a month pays $3 — because 20 GB falls within the 30 GB floor. Proxy 50 GB, and the bill is $5.

max($3, actual_usage × $0.10) — that's the entire pricing formula. No per-request charges, no per-tunnel fees, no games.

Feature Comparison

How rustunnel Works

rustunnel's architecture is intentionally simple. A lightweight client on your machine establishes a WebSocket connection to a relay server. That single multiplexed connection carries all your tunnel traffic — HTTP requests, TCP streams, WebSocket upgrades — through one persistent pipe.

Here's what's happening at each step:

1. Client connects — the rustunnel binary on your machine opens a WebSocket (WSS) connection to the nearest edge relay. This is a single outbound connection on port 443, so it works through NATs and firewalls without any configuration.

2. Tunnel registration — the client sends a registration frame with a tunnel_id, the protocol (HTTP or TCP), and the local port. The relay stores this mapping.

3. TLS termination — when a request hits https://your-subdomain.edge.rustunnel.com, the relay terminates TLS. Your local server never needs HTTPS — it can serve plain HTTP on localhost.

4. Multiplexed proxying — the relay wraps the incoming request in a WebSocket frame tagged with the correct tunnel_id and sends it down the shared connection. The client demuxes it and forwards to localhost:PORT. The response travels back the same way.

5. Automatic reconnect — if the connection drops, the client reconnects with exponential backoff (1s → 2s → 4s → ... → 60s max) with random jitter to prevent thundering-herd reconnections.

The key architectural decision is multiplexing. Instead of opening a new TCP connection per tunnel, rustunnel shares a single WebSocket across all tunnels. This means running 10 tunnels has the same connection overhead as running 1.

Self-Hosting: Full Control or Zero Hassle

This is where the comparison gets interesting. ngrok reserves self-hosting for their Enterprise plan, which requires contacting sales. rustunnel makes self-hosting the default — the server is open-source under AGPL, and you can deploy it on any VPS with a single command.

curl -fsSL https://install.rustunnel.dev | sh
rustunnel-server init --domain tunnel.yourdomain.com
rustunnel-server start --tls --email admin@yourdomain.com

That's it. You're running your own tunnel infrastructure with automatic Let's Encrypt TLS. No monthly bills, no usage caps, no vendor dependency.

The managed service at rustunnel.com exists for developers who don't want to manage infrastructure — same client binary, same features, pay for bandwidth. But the self-hosted path is always there, always free, always fully functional.

The practical difference: If your company requires data sovereignty (healthcare, finance, government), or you need custom branding on tunnel URLs, or you want to avoid recurring SaaS charges entirely — self-hosted rustunnel is the only option that gives you all of this without an Enterprise contract.

Self-host walkthrough (summary)

You do not need a multi-day ops project to run a self-hosted ngrok stack. The shortest path:

1. Pick a VPS — a $4–6/mo Hetzner CX22 (or any Ubuntu 22.04+ box with a public IP) is enough for personal and small-team traffic. Point an A/AAAA record for tunnel.yourdomain.com (and ideally a wildcard *.tunnel.yourdomain.com) at that IP.
2. Install the server — the install script drops the rustunnel-server binary; init writes a starter config for your domain; start --tls obtains Let's Encrypt certificates and serves HTTPS on 443.
3. Authenticate clients — create a token on the server (or via the platform API if you run the full stack) and pass it to the client with rustunnel http 3000 --server your-edge:4040 --token ….
4. Hardening basics — firewall so only 80/443 (public) and your control port (often 4040, preferably behind Tailscale/VPN for admin) are reachable; enable automatic security updates; put Prometheus scrape + a status probe on the health endpoint.

For the full annotated playbook — including Ansible-shaped steps, DNS traps, and production checklist — read the dedicated post How to run your own ngrok on a $4 Hetzner box and the docs self-hosting guide. Architecture background lives in the architecture overview.

When not to self-host

Self-hosting is powerful, but it is not free in time. Stick with the managed cloud (or even ngrok) when:

• You need a URL in the next 60 seconds for a one-off webhook and will tear it down the same afternoon — managed is faster than provisioning DNS.
• Nobody on the team wants on-call for TLS renewal, disk full, or kernel updates. rustunnel's managed edges (eu / us / ap) already handle that.
• Traffic is bursty and multi-region. Running one VPS in Falkenstein will not match a global edge network without you building one.
• Compliance theater wants a SOC2 vendor checkbox more than raw data residency. Self-hosting gives you residency; it does not automatically give you a vendor questionnaire packet.
• Your only requirement is "it just works on free tier" and you are fine with ngrok's free limits.

Rule of thumb: self-host when control, cost floor, or data path ownership matters more than operational convenience. Use managed rustunnel when you want the same client binary and open-source escape hatch without running the relay yourself.

Performance: Rust vs Go

Both tools are built on modern compiled languages, but the runtime characteristics differ.

In practice, both are fast enough for development tunneling. The difference shows up at scale — rustunnel's lower memory footprint means you can run more tunnels per relay server, and Rust's zero-cost abstractions mean there's less GC pressure under sustained load.

When to Stick with ngrok

rustunnel isn't the right choice for everyone. Honesty is what makes a comparison page citable — pure sales copy does not get pulled into AI answers.

Prefer ngrok when:

• You are a solo developer who occasionally needs a tunnel for an hour and never wants to think about infrastructure.
• Your org already standardized on ngrok Traffic Policy, endpoints API, or identity integrations you rely on daily.
• You need a polished free tier with zero account complexity and you are fine with ngrok's free limits and closed-source stack.
• Procurement already has ngrok approved and switching tools costs more than the monthly bill.

Prefer rustunnel when:

• You're paying $20+/month for tunnel features you don't always use, or you hate paying full freight for idle weekends.
• You need self-hosted ngrok-class infrastructure for compliance or data sovereignty without an Enterprise sales cycle.
• You want predictable, usage-based billing (max($3, GB × $0.10)) instead of flat fees.
• You're running tunnels in CI/CD pipelines where costs can spike unpredictably and a spend cap matters.
• You want AI agents (Claude Code, Cursor, MCP clients) to spin up tunnels via a first-class MCP server — see AI agent tunnel management and Claude Code HTTPS tunnel.
• You want the option to self-host under AGPL and fall back to a managed cloud with the same client binary.

For a pure self-host peer comparison (no managed cloud on the other side), also read rustunnel vs FRP. Pricing deep-dive: pay-as-you-go tunnel pricing. Hands-on local HTTPS: expose localhost over HTTPS.

FAQ — ngrok alternatives & self-hosted ngrok

These are the questions AI answer engines and developers actually ask. Short answers first; details above.

Is there a free ngrok alternative?

Yes. rustunnel's Hobby plan is free for light use (limited concurrent tunnels, random subdomains). The open-source server is free forever under AGPL if you self-host. The managed pay-as-you-go plan starts at $3/month, and idle tunnels cost $0.

Can I self-host ngrok?

Not on ngrok's public product — self-hosting is gated to Enterprise. If what you mean is "can I run a self-hosted ngrok alternative on my own VPS?", yes: install rustunnel-server, point DNS, enable TLS, and keep the data path inside your network. Start with the Hetzner self-host walkthrough or the self-hosting docs.

What is the best open-source ngrok alternative?

"Best" depends on the job:

rustunnel's wedge is: open-source default, pay only for bandwidth on the managed cloud, and AI-agent/MCP control without bolting on a third-party wrapper.

How does rustunnel pricing compare to ngrok?

ngrok: flat monthly plans (commonly cited public tiers in the ~$8–$25+/mo range for individuals/teams) whether or not the tunnel is busy. rustunnel managed: max($3, actual_usage × $0.10/GB) with idle at $0. Self-host: $0 to rustunnel (you pay the VPS). Always re-check ngrok pricing and rustunnel pricing before budgeting — competitor pages go stale.

Does rustunnel support UDP, P2P, and load balancing?

Yes. UDP covers game servers and DNS-style workloads; P2P can skip the relay when peers can connect directly; named load-balancing groups with health checks sit multiple backends behind one subdomain. See the UDP tunnels reference, P2P tunnels reference, and load-balancing reference.

Getting Started

Install rustunnel and create your first tunnel in under a minute:

brew tap joaoh82/rustunnel
brew install rustunnel
rustunnel setup
rustunnel http 3000

The Hobby plan is free (2 tunnels, random subdomains). The pay-as-you-go plan starts at $3/month. Or deploy the self-hosted server on your own infrastructure — it's free forever.

# Self-host on any VPS
curl -fsSL https://install.rustunnel.dev | sh
rustunnel-server init --domain tunnel.yourdomain.com
rustunnel-server start --tls --email admin@yourdomain.com

For deeper dives:

• Quickstart — first tunnel in under a minute
• Self-hosting on Ubuntu — production server path
• Self-host ngrok on Hetzner — $4 VPS playbook
• Load-balancing & health checks — multiple backends, one subdomain
• MCP server guide — drive tunnels from Claude Code / Cursor
• Architecture overview — how the edge and client fit together

Related posts: rustunnel vs FRP · pay-as-you-go pricing · AI agent tunnel management · expose local HTTPS.

The source code is on GitHub under AGPL.

→ Want a dedicated head-to-head? Read ngrok vs rustunnel, plus vs Cloudflare Tunnel, vs Pinggy, and vs LocalXpose. Or create a free account and run your first tunnel in under a minute, or view on GitHub to self-host.