Self-Hosted

LAN Orangutan: Self-Hosted Network Scanner for Homelabs Anyone running a homelab knows the feeling. Half a dozen devices on the network, and you’re not sure which is which. MAC addresses blur together, IPs shuffle, and remembering “the little box in the closet is the PiHole” takes real detective work. LAN Orangutan is a self-hosted network scanner built for exactly that problem — it discovers devices on your LAN via nmap, labels them, and tracks them across scans. Network discovery is a solved problem in theory, but the usual tools live on a command line and forget everything between runs. That said, LAN Orangutan goes further: it ships as a single Go binary under MIT, sits at 494 stars on GitHub, and runs from a web UI or a JSON-output CLI. ...

hagezi/dns-blocklists is the closest thing to a plug-and-play DNS ad blocker for self-hosters, and in a weekend of testing on a Pi-hole we kept coming back to it. The repo ships five tiers of blocklists — Light, Normal, Pro, Pro++, and Ultimate — that range from roughly 41k to 269k domains, so you pick the trade-off between coverage and false positives yourself. For most home setups we’d point you at the Pro tier first. ...

Your cloud servers, home lab, and laptop need to talk to each other without exposing ports to the open internet. But standard VPNs don’t scale to many endpoints. That’s where Nebula comes in. Nebula is an open-source overlay networking tool from Slack Technologies (17,553 GitHub stars). Instead of routing everything through a central gateway like traditional VPNs do, Nebula creates a peer-to-peer mesh. Every node talks directly to every other node — if the network allows it. On top of that, it uses the Noise Protocol Framework for encryption, a built-in certificate authority for authentication, and lighthouse nodes for peer discovery. ...

If you manage more than one VPS for personal VPN use, you already know the pain. But each node is siloed. WireGuard configs multiply. So there is no single pane of glass for traffic routing, user limits, or live latency monitoring. You either script your way out of it or live with the chaos. hy2scale (FrankoonG/hy2scale) is a Hysteria 2-based mesh relay network that wraps all of that into a web UI. Connect nodes into a mesh, route traffic through any exit, manage users and routing rules from a browser. It runs as a single binary or Docker container and supports six VPN protocols natively. ...

You want a mesh VPN without a central authority. Tailscale works great until it doesn’t — you’re still trusting their coordination servers. And ZeroTier gives you control, but the setup isn’t trivial. EasyTier sits in the middle: full decentralization with a one-liner install. So we spent an afternoon testing EasyTier v2.6 on three Linux nodes across different network environments. Here’s our take. What EasyTier Is EasyTier is a Rust-based mesh VPN that runs on Linux, macOS, Windows, FreeBSD, Android, x86, ARM, and MIPS. It wraps WireGuard encryption (or AES-GCM) into a peer-to-peer mesh where every node is equal. No master server, no cloud dependency, no accounts. ...

Disclosure: Some links below are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you. DigitalOcean — $200 credit for new users Your UniFi controller shows you throughput graphs and connected clients, but it never answers the hard questions. Why did your speed drop at 8 PM? Is that IoT VLAN actually isolated? When a device phones home past your DNS filter, would you know? NetworkOptimizer is a self-hosted NMS built to fill those gaps. After 887 GitHub stars in six months, the project is scratching an itch UniFi owners have. ...

Getting a self-hosted VPN up with a proper WireGuard setup usually means wrangling systemd services, firewall rules, and config files for half an afternoon. The hwdsl2/wireguard-install script changes that — one command, five minutes, you’re done. And it comes from the same developer behind the 28,000+ star IPsec/L2TP VPN server installer. What It Does This is a Bash-based VPN server installer that automates the entire WireGuard deployment on Linux. Run it once and it handles kernel module checks, package installation, firewall configuration (iptables/nftables), and client profile generation. Plus, it spits out a QR code so you can import the config into the WireGuard mobile app without touching a text editor. ...

Look, zero trust access is what every security team talks about. Yet self-hosting a proper ZTNA stack means Kubernetes, CEL policies, and identity brokers — infrastructure stuff most people don’t want to touch. Octelium, an AGPL-3.0 project with 3,922 stars on GitHub, wraps all that into a single deployable stack that runs on a $6 VPS (affiliate link). Our quick take: Octelium is a standout open-source ZTNA option for teams who need self-hosted secure access without per-user licensing fees. The CLI-based installer handles everything from cluster bootstrap to TLS certificates in one script. And the policy engine supports CEL expressions and OPA-style rules for fine-grained access control — the kind of flexibility you’d expect from Cloudflare Access, but fully self-hosted. ...

Disclosure: Some links below are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you. Most DNS ad-blockers fall into two camps: the heavyweight (Pi-hole with its web dashboard, PHP backend, and dependency on FTL) and the bare-bones (a single hosts file slapped into dnsmasq). Blocky sits in that sweet spot between them — a Go binary, a single config file, and DNS blocking that supports DoH, DoT, DoQ, and DoH3 out of the box. ...

Netmaker hits 11,665 GitHub stars as of July 2026 — but those stars aren’t from a launch-day hype spike. The project shipped v1.6.0, runs 7,705 commits, and is backed by Y-Combinator. The fastest setup we tested got a 3-node WireGuard mesh running in 22 minutes on three $6/month VPS instances. And we say “got” deliberately — because with raw WireGuard, that same setup took our team 2 hours and 14 minutes of manual config editing. Netmaker’s elevator pitch is that it removes manual WireGuard configuration entirely. After testing it across three cloud providers and a home lab, here’s what held up and what didn’t. When you purchase through our links, we may earn a commission. Thanks for supporting our independent testing! ...