Alternatives to Pomerium

An identity-aware reverse proxy that gives secure access to internal applications without a VPN. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Pomerium.

  • Twingate

    An identity-based network access service meant to replace a traditional VPN for teams.

    FreemiumProprietaryWeb

    Twingate is a hosted identity-based network access service replacing a VPN, so there is no proxy to self-host, but it is proprietary and its free tier covers small teams.

  • Apache Guacamole

    A self-hosted remote desktop gateway that gives browser access to machines over VNC, RDP and SSH.

    FreeOpen sourceWebSelf-hosted

    Apache Guacamole is an Apache-licensed self-hosted gateway giving browser access over VNC, RDP and SSH, focused on remote desktops rather than identity-aware web application access.

Also worth comparing

These listings name Pomerium as their own alternative, so the relationship runs both ways.

  • Authelia

    Self-hosted single sign-on and two-factor portal for reverse proxies.

    FreeOpen sourceLinuxWebSelf-hosted

    Pomerium is an identity-aware reverse proxy with policy as code in YAML and audit logging, but it requires an existing OIDC identity provider and has paid features.

  • Cloudflare Tunnel

    Exposes a service on your machine to the internet through Cloudflare without opening a single port in your firewall.

    FreemiumOpen sourceWindowsmacOSLinuxCommand line

    Pomerium is a self-hosted identity-aware reverse proxy for internal apps with any OIDC provider, but it does not tunnel through NAT for you.

  • Nginx Proxy Manager

    Browser interface for Nginx reverse proxy hosts with automatic Let's Encrypt certificates.

    FreeOpen sourceWebSelf-hosted

    Pomerium is an identity-aware reverse proxy with OIDC login and per-request policy in YAML, requiring an existing identity provider rather than simple access lists.

  • Traefik

    Reverse proxy that discovers services automatically from Docker, Kubernetes and more.

    FreeOpen sourceWindowsmacOSLinuxSelf-hosted

    Pomerium is an identity-aware reverse proxy that adds per-request authorization through any OIDC provider, but it requires an existing identity provider and is self-hosted only.

Similar software

Related functionality, not a direct replacement.