Self-host D-NET
v3.1.0DDNS, CDN, port forwarding, reverse proxy, SSL management
docker run -d --name dnet --net=host -v /opt/dnet:/root --restart=always cxbdasheng/dnet:latest- Stars
- 191
- Port
- 9877 (Web management interface)
cxbdasheng/dnetWhat is D-NET?
D-NET (dnet) is a lightweight, self-hosted network management system written in Go. It targets users with dynamic public IPs — such as home NAS operators, VPS owners, and embedded device maintainers — who need to keep DNS records and CDN origins in sync, expose internal services via port forwarding or reverse proxy, and manage TLS certificates automatically. The software bundles five modules: DCDN updates CDN origin addresses across providers like Alibaba Cloud, Tencent Cloud, Cloudflare, and UpYun; DDNS manages A/AAAA/CNAME/TXT records on a wide range of DNS services; DPF forwards TCP and UDP traffic with IP allow-lists and connection limits; DWS serves as a reverse proxy with URL redirects, WebSocket pass-through, per-domain authentication, and built-in speed-test endpoints; DSSL handles certificate uploads, local files, and ACME issuance (Let's Encrypt, ZeroSSL) with HTTP, TLS-ALPN, and DNS validation. All configuration is done through a web interface that listens on port 9877 by default. Deployment options include a single binary installed as a system service (Linux/macOS/Windows), a Docker image (cxbdasheng/dnet) with host-network mode recommended for IPv6 detection, or building from source. The project is MIT-licensed, has no external database dependencies, and stores its configuration in a YAML file under the user's home directory. Webhook notifications for IP changes integrate with DingTalk, Feishu, Server酱, PushPlus, Discord, and WeChat.
Should you self-host D-NET?
D-NET scores 47/100 on selfhost.directory (how scoring works) and ranks #20 of 31 in Networking. It has 191 GitHub stars.
It shipped 10 stable releases in the past year. The latest, v3.1.0, came out on 16 September 2026. New versions land roughly every 6 days.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is headscale (82/100, 45 140 stars). It scores higher overall, so compare the two before you pick. See D-NET vs headscale side by side.
Features
- ACME Automatic Certificate Renewal
- Certificate Hot Reload
- Dynamic CDN (DCDN)
- Dynamic DNS (DDNS)
- IPv4/IPv6 dual-stack
- Online Speed Test
- Per-Domain Authentication
- Port Forwarding (DPF)
- Reverse Proxy & Web Services (DWS)
- SSL Certificate Management (DSSL)
- System Service Installation
- Webhook Notifications
- Web management interface
D-NET README
FAQ
UDP 转发已监听，但收不到响应？
Confirm the rule uses UDP, firewall and Docker mapping allow UDP, and test with the actual application (e.g., dig for DNS). Only upload traffic increasing doesn't mean the target responded.
记录更新频率太高，想减少 API 调用？
Increase the sync interval with -f (e.g., 300 seconds) and increase -ddnsCacheTimes to reduce forced sync frequency. Dynamic records skip updates when IP is unchanged, but periodic forced comparisons still occur.
CNAME 记录配置后其他记录消失了？
This is expected. CNAME records conflict with A/AAAA/TXT at the same subdomain; D-NET automatically removes conflicting records when adding a CNAME, and vice versa.
获取不到公网 IPv4 地址？
Home broadband typically has the router dialing, so the server sees a private IP. Use URL-based detection (e.g., https://4.ipw.cn) and verify the URL is reachable with curl.
获取不到 IPv6 地址？
Verify the system has a public IPv6 assigned (ip -6 addr). On Linux, use Docker host network mode to read host interfaces; bridge mode only sees container interfaces. URL-based detection requires the container to have IPv6 egress.
开启 Webhook 后会通知证书到期或代理故障吗？
No. Webhook notifications only trigger from DDNS/DCDN sync events. They do not cover DSSL renewal or DWS/DPF runtime failures. Check module status and logs for those.
证书申请或续期失败怎么办？
Check DSSL list errors and logs. For HTTP/TLS-ALPN validation, verify public ports 80/443 are reachable. For DNS validation, check API credentials, zone permissions, and TXT record propagation. Failed attempts retain the old certificate; retry after fixing.
DSSL 已申请证书，为什么管理界面仍是 HTTP？
DSSL certificates are for DWS to reference. The management UI and DWS entry points are separate; you must enable HTTPS in DWS configuration and select the certificate.
DWS 和 DPF 如何选择？
Use DWS for HTTP/HTTPS proxy, redirects, or speed testing by domain name. Use DPF for generic TCP/UDP forwarding. DWS can terminate TLS using DSSL certificates; DPF passes HTTPS through to the target.
DPF 能代替内网穿透吗？
No. DPF only forwards TCP/UDP ports when the client can reach the entry point and D-NET can reach the target. It does not provide NAT traversal or relay servers.
同步间隔设置多少合适？
For typical home broadband, 120-300 seconds is recommended; if IP changes are infrequent, 600 seconds can be used. See Best Practices for cache parameter tuning.
配置文件在哪里？
Default is ~/.dnet_config.yaml in the running user's home directory (e.g., /root/.dnet_config.yaml for root). Docker mounts at /opt/dnet:/root map to /opt/dnet/.dnet_config.yaml on the host. Use -c to specify a custom path.
如何查看运行日志？
On macOS use `log show --predicate 'process == "dnet"' --last 1h`; on Linux systemd use `journalctl -u dnet -f`; on Docker use `docker logs -f dnet`.
Web 界面无法访问怎么办？
Check if the service is running (systemctl, sc.exe, or docker ps), verify the address and port (default http://localhost:9877), check firewall rules, and review logs for errors.
忘记 Web 界面密码怎么办？
Run `./dnet -resetPassword 'newpassword'` for binary installs, or `docker exec dnet /app/dnet -resetPassword 'newpassword' && docker restart dnet` for Docker. Must use the same config file path if customized.
More in Reverse Proxy
docker-flow-proxyDocker Flow Proxy is a self-hosted, open-source reverse proxy built on HAProxy that automatically reconfigures when services are deployed or scaled in Docker Swarm.
docker-traefik-cloudflare-companionSelf-hosted Docker companion that automatically creates and updates Cloudflare CNAME records for containers managed by Traefik reverse proxy.
DockFlareOpen-source, self-hosted control plane turning Docker labels into Cloudflare Tunnel routes, DNS entries and Zero Trust policies, with an optional sovereign email suite.
dockserverDockServer is a self-hosted, open-source Docker management system that automates Traefik, Authelia, and 100+ apps via a menu-driven CLI on Ubuntu with Cloudflare.
DockTailOpen-source, self-hosted Go agent that watches Docker labels and publishes containers as native Tailscale Services, with HTTPS, TCP, PROXY protocol and Funnel support.
FerronOpen-source, self-hosted Rust web server for static sites, PHP and reverse-proxied apps, with automatic TLS, Prometheus/OTLP metrics, and trace IDs in every log line.
fn-knockSelf-hosted gateway that combines reverse proxy, authentication, WAF, SSL certificates, DDNS, and tunneling for home servers and NAS devices.
frpfrp is a self-hosted, open-source fast reverse proxy that exposes local servers behind NAT or firewalls to the internet via TCP, UDP, HTTP, and HTTPS with P2P support.
fxtun.devfxTunnel is an open-source Go reverse tunnel for HTTP, TCP, UDP with custom subdomains, inspector, and desktop GUI. An ngrok alternative with servers in Russia.
geoblockSelf-hosted forward auth that allows or denies requests by country, ASN, IP range, domain, and HTTP method. Works with Traefik, NGINX, Caddy.
godoxyHigh-performance reverse proxy and container orchestrator for self-hosters
HAProxyHAProxy is a free, very fast and reliable reverse-proxy offering high availability, load balancing, and proxying for TCP and HTTP-based applications.
0 comments