A lightweight, high-performance reverse proxy written in Rust for secure NAT traversal and exposing local services to the internet.
rathole is a secure, stable, and high-performance reverse proxy written in Rust, designed for NAT traversal. It enables users to expose services from devices behind a NAT (like a home NAS) to the internet via a server with a public IP, providing a reliable alternative to tools like frp and ngrok.
Developers, system administrators, and hobbyists who need to securely expose local services (e.g., SSH, web servers, game servers) from behind a NAT or firewall to the internet, particularly those working with embedded devices or resource-constrained environments.
Developers choose rathole for its combination of high throughput, low memory consumption (binaries as small as ~500KiB), and built-in security features like mandatory service tokens and optional Noise Protocol or TLS encryption without self-signed certificates. It offers hot reloading for dynamic service management and is optimized for stability under high connection volumes.
A lightweight and high-performance reverse proxy for NAT traversal, written in Rust. An alternative to frp and ngrok.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Benchmarks show rathole achieves higher throughput and handles more connections stably than frp, with graphs in the README demonstrating superior bandwidth under load.
Binaries can be optimized to ~500KiB with low memory consumption, making it suitable for embedded devices like routers, as emphasized in the features section.
Mandatory service tokens and optional Noise Protocol or TLS encryption provide secure communications without requiring self-signed certificates, enhancing out-of-the-box security.
Hot reloading allows adding or removing services by updating the configuration file, enabling adjustments without downtime, as highlighted in the key features.
The README notes that HTTP API is 'WIP', so users must rely on file-based configuration and manual reloads, limiting automation and real-time control.
Only TCP and UDP forwarding is supported natively, lacking built-in HTTP/HTTPS-specific features such as virtual hosting or header manipulation, which may require additional tools.
Using the Noise Protocol requires generating and managing base64-encoded keys manually, adding complexity compared to tools with automatic certificate issuance or cloud integration.