Self-host NPS Enhanced
v0.34.10NAT traversal and reverse proxy with web management
- Stars
- 1 094
- Ports
- 8081 (Web management interface), 80 (HTTP reverse proxy), 443 (HTTPS reverse proxy), 8024 (Client bridge (TCP/KCP)), 8025 (Client bridge (TLS/QUIC)), 8026 (Client bridge (WebSocket)), 8027 (Client bridge (WebSocket Secure)), 6000 (P2P communication)
duan2001/nps
What is NPS Enhanced?
NPS Enhanced is a fork of the original NPS project providing intranet penetration and reverse proxy capabilities. It lets users expose services behind NAT or firewalls through a self-hosted server. The system has server (NPS) and client (NPC) components supporting TCP, UDP, HTTP/HTTPS reverse proxy, HTTP proxy, SOCKS5 proxy, and P2P direct connections. A web dashboard shows tunnel status, traffic stats, and client health. Deployment options include Docker images, Linux/Windows binaries, and install scripts. Client-server links can use TCP, KCP, TLS, QUIC, WebSocket, or WSS.
Should you self-host NPS Enhanced?
NPS Enhanced scores 56/100 on selfhost.directory (how scoring works) and ranks #10 of 31 in Networking. It has 1 094 GitHub stars.
It shipped 10 stable releases in the past year. The latest, v0.34.10, came out on 20 October 2026. New versions land roughly every 2 days.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is GPL-3.0-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is headscale (82/100, 45 140 stars). It scores higher overall, so compare the two before you pick. See NPS Enhanced vs headscale side by side.
Features
- Access Expiration Controls
- Certificate Management
- Cross-platform deployment
- Encrypted Transmission
- HTTP/3 Support
- HTTP/HTTPS reverse proxy
- HTTP/SOCKS5 Proxy
- Multiple Connection Protocols
- Multi-user support
- P2P Direct Connection
- Private Proxy Mode
- TCP/UDP Port Forwarding
- Traffic Limiting
- Web management interface
NPS Enhanced README
More in Reverse Proxy
OAuth2 ProxyOpen-source, self-hosted auth proxy that puts OAuth2/OIDC sign-in in front of web apps, with email/domain/group checks and Redis sessions.
openresty-managerOpenResty Manager is a self-hosted web control panel for OpenResty with reverse proxy, free SSL, host terminal, file manager, Docker app store, and multi-node CDN.
PangolinSelf-hosted, open-source SASE stack combining a WireGuard zero-trust VPN, identity-aware reverse proxy, PAM and an AI gateway; the AGPL Community Edition is free.
PomeriumOpen-source self-hosted identity-aware reverse proxy that gates private web apps, SSH and TCP services through OIDC sign-in and per-request access policy.
public-websites-dockerA Docker Compose guide for self-hosting static sites with Traefik, Matomo analytics, and remark42 comments — all with automatic Let's Encrypt TLS.
rustunnelrustunnel is a self-hosted, open-source tunnel server in Rust exposing local services via encrypted WebSocket. Free managed cloud with pay-as-you-go billing and MCP.
SafeLineSafeLine is an open-source, self-hosted WAF protecting web apps from SQL injection, XSS, and DDoS via intelligent semantic analysis. Runs as a Docker reverse proxy.
Self-Hosted GatewayOpen-source alternative to Cloudflare Tunnels using WireGuard, NGINX, and Caddy to expose local Docker containers without port forwarding.
sishSelf-hosted, open-source SSH server for ngrok-style HTTP, WebSocket and TCP tunnels to localhost, shipped as a Docker image or binaries.
SWAG (Secure Web Application Gateway)Self-hosted Nginx reverse proxy with automatic SSL certificates from Let's Encrypt or ZeroSSL. Includes Fail2ban intrusion prevention and reverse proxy configurations.
tetherTether is a self-hosted hub that aggregates routing from Tetherd agents into one Traefik config for multi-server deployments behind a single IP.
tlsproxySelf-hosted TLS termination proxy with auto Let's Encrypt, SSO (OIDC/SAML/Passkeys), and reverse proxy for multiple services on one port.
0 comments