Open-Source

LAN Orangutan: Self-Hosted Network Scanner for Homelabs Anyone running a homelab knows the feeling. Half a dozen devices on the network, and you’re not sure which is which. MAC addresses blur together, IPs shuffle, and remembering “the little box in the closet is the PiHole” takes real detective work. LAN Orangutan is a self-hosted network scanner built for exactly that problem — it discovers devices on your LAN via nmap, labels them, and tracks them across scans. Network discovery is a solved problem in theory, but the usual tools live on a command line and forget everything between runs. That said, LAN Orangutan goes further: it ships as a single Go binary under MIT, sits at 494 stars on GitHub, and runs from a web UI or a JSON-output CLI. ...

Most WireGuard clients are written for the person who set up the server. WireGuide is the rare one built for the person who just got handed a .conf file and told to get online. That positioning is the whole pitch. A cross-platform WireGuard VPN client running on macOS 15+ and Windows 11, it’s a Go 1.25+ app wrapped in Wails v3 with a Svelte frontend. Young at 75 stars with an MIT license, it’s still actively shipped — v0.4.2 dropped on July 27, 2026. ...

Most breaches start with a config mistake, not a clever attacker. An ACL rule one line out of order, a firewall permit a few subnets wider than intended, a route that silently changes paths during a maintenance window — none of these produce an alert. And they just quietly widen the surface until someone’s data walks out. Batfish is the pre-deployment check that finds those bugs before traffic ever moves. ...

What if you could encrypt a file and the ciphertext looked like a cat had a keyboard tantrum — but with actual secp256k1 elliptic curve math underneath? That’s exactly what PurrCrypt does. After testing it on two operating systems, we found it surprisingly usable for a project that takes itself this unseriously. What Is PurrCrypt? PurrCrypt (622 stars on GitHub, MIT license) is a Rust CLI tool that encrypts files using elliptic curve cryptography — the same secp256k1 curve behind Bitcoin. It then encodes the output as sequences of cat or dog vocalizations. So it’s steganography meets public-key encryption: the ciphertext looks like pet-sound spam to anyone who intercepts it. But only the intended recipient can decrypt it back to the original file. This approach is a different angle on privacy — similar to how multi-hop VPN tunnels add layers of protection to network traffic, PurrCrypt adds them to stored data. ...

Your Raspberry Pi has been sitting in a drawer. Ragnar gives it a second life as an autonomous network security tool that scans WiFi, hunts vulnerabilities, and even wardrives — all from a headless box with a tiny e-Paper screen. Now, Ragnar is an open-source fork of the Bjorn project by PierreGode, built for the Pi Zero 2W, Pi 4, and Pi 5 as well as headless Debian servers. Plus, it combines network scanning, vulnerability assessment, WiFi analysis, and wardriving into one self-contained package. The project sits at 759 stars on GitHub and is MIT-licensed. ...

A hands-on look at Sniffnet, the 40K-star open-source network traffic monitor built in Rust. Real-time charts, 6,000+ protocol detection, completely free.

Look, zero trust access is what every security team talks about. Yet self-hosting a proper ZTNA stack means Kubernetes, CEL policies, and identity brokers — infrastructure stuff most people don’t want to touch. Octelium, an AGPL-3.0 project with 3,922 stars on GitHub, wraps all that into a single deployable stack that runs on a $6 VPS (affiliate link). Our quick take: Octelium is a standout open-source ZTNA option for teams who need self-hosted secure access without per-user licensing fees. The CLI-based installer handles everything from cluster bootstrap to TLS certificates in one script. And the policy engine supports CEL expressions and OPA-style rules for fine-grained access control — the kind of flexibility you’d expect from Cloudflare Access, but fully self-hosted. ...

What Is Wireproxy? Wireproxy is an open-source Go application that connects to a WireGuard peer and exposes the connection as a SOCKS5 or HTTP proxy. Unlike a standard WireGuard client — which creates a new network interface and needs root or administrator privileges — wireproxy runs entirely in userspace. You keep WireGuard’s encryption without touching your system’s network stack. The project sits at 5,700+ stars on GitHub, maintained by windtf under the ISC license. It ships as a single static binary for Linux, macOS, and Windows. ...

Two weeks ago, PrivacyGuard published a full Firezone review covering the open-source zero-trust WireGuard platform — architecture, pricing, deployment walkthrough, and a comparison table against Tailscale and Netbird. Since then, the project pushed a significant connlib refactor (PR #13908), shipped two new client releases, and kept daily commits flowing. So here’s the natural follow-up question: has anything meaningful changed for someone evaluating Firezone? Short answer: the connlib refactor makes the internals cleaner, but your deployment decision from two weeks ago still holds. ...

Your VPN encrypts your traffic and hides your IP. Good. But that encryption doesn’t stop your apps from phoning home to ad servers, tracking domains, and analytics endpoints — those requests still go out, just through a tunnel. So this is where Blokada enters the picture. Bottom line upfront: Blokada is not a VPN replacement. But it’s a DNS-level ad blocker and privacy filter that runs alongside your VPN. So if you already use ProtonVPN, NordVPN, or any other provider, Blokada adds a second privacy layer your tunnel alone can’t provide. For Android users especially, it’s one of the most practical privacy upgrades you can install in five minutes. ...