If you've ever wanted to expose a home server, a NAS, or a self-hosted app to the internet without paying for ngrok or handing traffic to a third-party cloud, you end up looking at self-hosted tunnel tools instead. Rathole and Chisel both do the same basic job — punch a hole through NAT so a server sitting behind your home router becomes reachable from the outside — but they're built differently, and picking the wrong one just means a slightly more annoying setup, not a wasted subscription.
What each one actually is
Rathole is a reverse proxy for NAT traversal written in Rust, aimed specifically at exposing home servers and NAS devices to the internet. It supports several transport protocols (TLS, Noise, WebSocket), can reload its configuration without restarting, and leans on Rust's memory safety for a tool that's meant to sit on the edge of your network 24/7.
Chisel is older and simpler: a fast TCP/UDP tunnel that runs over plain HTTP and is secured via SSH, shipped as a single Go binary that acts as both client and server. Its main trick is tunneling over HTTP, which lets it slip through restrictive firewalls that block raw TCP tunnels outright.
Setup & requirements
Both tools are completely free and open source, and both need something on the outside — a cheap VPS works for either. Rathole's setup is a bit more involved: you configure the transport protocol and connection details in a config file, and hot-reload lets you tweak it without dropping the tunnel. Chisel is closer to plug-and-play: run the binary in server mode on your VPS, run it in client mode on your home machine, and you have a tunnel with no separate config file needed.
Where each one wins
Pick Rathole if you want a modern, actively developed tool with flexibility on transport (TLS, Noise, WebSocket) and you're comfortable with a bit more upfront configuration in exchange for a tunnel built for long-term, always-on use.
Pick Chisel if you want the simplest possible setup — one binary, no config file, works over HTTP so it gets through firewalls that block other tunnel traffic — and you don't need multiple transport options.
Where each one is weaker
Rathole requires you to run and maintain your own relay server, has no hosted option, and its initial setup is more technical than something like ngrok — you're trading convenience for control and cost. Chisel has the same "no hosted option" limitation, its configuration is CLI-only with no config file to fall back on for complex setups, and it's written in Go rather than Rust, which matters less for most home use but is a factor if you care about memory safety on an internet-facing binary.
| Rathole | Chisel | |
|---|---|---|
| Language | Rust | Go |
| Transport options | TLS, Noise, WebSocket | HTTP (SSH-secured) |
| Config | Config file, hot-reload | CLI flags only |
| Extra features | — | SOCKS5 proxy, reverse port forwarding |
| Hosted option | None — needs your own VPS | None — needs your own VPS |
| Price | Free, open source | Free, open source |
The short version: Chisel is the tool to reach for when you want a tunnel running in five minutes with nothing to configure, and its HTTP-based transport is genuinely useful if you're behind a firewall that blocks other tunneling methods. Rathole is the better long-term pick if you're setting up something meant to stay up permanently and you want the flexibility to change transport protocols or reload config without downtime. Both beat paying for ngrok if you already have a cheap VPS sitting around to act as the relay.