Stop Overpaying for Cloudflare! NetGoat Gives Premium Features Free

Stop Overpaying for Cloudflare! NetGoat Gives Premium Features Free

Your CDN bill just became optional.

Every month, thousands of developers and small teams shell out hundreds—sometimes thousands—of dollars for Cloudflare's paid tiers. DDoS protection? That's Enterprise. Advanced rate limiting? Pro plan minimum. Zero Trust networking? Better break out the corporate credit card. But what if you could self-host every single one of these premium features without spending a dime?

Enter NetGoat, the blazing-fast, self-hostable reverse proxy engine that's making waves across GitHub and developer communities. Built by a passionate open-source team and backed by early supporters like Cozy Critters Society, NetGoat isn't just another nginx wrapper or Traefik clone. It's a complete Cloudflare alternative designed for developers who refuse to choose between security and their budget.

The secret's out: top homelabbers and infrastructure engineers are already migrating. The question isn't whether NetGoat can replace your expensive edge stack—it's why you're still waiting to try it.

What is NetGoat?

NetGoat is a self-hostable reverse proxy and traffic manager that replicates Cloudflare's core functionality—DDoS protection, SSL termination, rate limiting, WebSocket support, and Zero Trust networking—without requiring a paid subscription or surrendering control to a third-party SaaS platform.

Created by the netgoat-xyz organization and currently in active alpha, NetGoat represents a fundamental shift in how developers think about edge infrastructure. Rather than renting capabilities from a centralized provider, you own your stack entirely. Run it on a cheap VPS, your homelab, or even layer it on top of Cloudflare itself to unlock paid features for free.

⚠️ Alpha Status: NetGoat is actively refining its core proxy engine and self-hosting scripts. Follow progress on their Discord server for real-time updates.

The project has already attracted significant community attention, with a growing star history and vocal early adopters. Its architecture is deliberately modern: the high-concurrency proxy engine is written in Go, while the control plane leverages Next.js^{↗ Bright Coding Blog} 15, Fastify, Bun, and TailwindCSS for a polished developer experience. Storage is flexible—choose SQLite for local-first deployments or MongoDB for distributed setups.

What makes NetGoat genuinely disruptive isn't feature parity alone. It's the philosophy: infrastructure as code, control as default, and zero vendor lock-in. In an era where cloud costs spiral unpredictably, that message resonates deeply.

Key Features That Crush Cloudflare's Paywall

NetGoat ships with a formidable feature set that rivals—and in some cases exceeds—commercial alternatives:

🔒 Zero Trust Networking

Implement modern security posture without enterprise contracts. NetGoat secures service-to-service communication with identity-aware access controls, eliminating the traditional perimeter-based security model.

🛡️ Anti-DDoS & WAF

Built-in Web Application Firewall filters malicious requests, bot traffic, and common exploit patterns. No more praying your provider notices an attack before your bill explodes.

📜 Auto SSL & TLS Termination

Free SSL certificates with automatic renewal. Let's Encrypt integration handles the certificate lifecycle transparently—set it and forget it.

⏱️ Rate Limiting & Request Queuing

Protect your APIs from abuse with configurable rate limits. Request queuing prevents thundering herd problems during traffic spikes.

⚖️ Load Balancing & Failover

Multinode routing with zero-downtime failover. Distribute traffic across backends intelligently and recover automatically from node failures.

📊 Real-Time Metrics Dashboard

Monitor traffic patterns, bandwidth consumption, error rates, and cache hit ratios through a sleek Next.js-based interface. No external observability stack required.

🧩 Dynamic Rules Engine

Write custom routing, caching, and filtering logic in JavaScript^{↗ Bright Coding Blog}/TypeScript. This isn't configuration-file spaghetti—it's programmable infrastructure.

🔌 WebSocket & HTTP/2 Support

Full protocol support for real-time applications. Your WebSocket servers, gRPC services, and modern HTTP/2 APIs work flawlessly behind NetGoat.

🎯 Per-Domain Configurations

Define granular behavior per site with regex and wildcard support. Different rules for different subdomains? Trivial.

🔧 Plugin System

Extend core functionality with custom plugins and middleware. Build integrations specific to your stack without forking the project.

☁️ Cloudflare Integration

Paradoxically, NetGoat enhances Cloudflare when needed—manage tunnels, extract paid features, and maintain Cloudflare Zero Trust compatibility as an upstream.

Real-World Use Cases Where NetGoat Dominates

1. The Bootstrapped SaaS Founder

You're pre-revenue with ten thousand users hitting your API. Cloudflare's Pro plan ($20/month) covers basics, but rate limiting rules, advanced DDoS protection, and custom firewall rules push you toward Enterprise ($200+/month). NetGoat runs on a $5/month VPS with zero feature restrictions. Redirect that budget toward customer acquisition, not edge fees.

2. The Privacy-Focused Homelab Enthusiast

You've built a gorgeous self-hosted stack: Nextcloud, Jellyfin, Home Assistant, maybe a personal blog. Every request currently flows through Cloudflare's infrastructure—your data, their logs. NetGoat keeps everything on hardware you control. Your DNS queries, your TLS keys, your access patterns. Fully sovereign infrastructure.

3. The Agency Managing Client Sites

Managing twenty client websites means twenty Cloudflare zones. At Pro pricing, that's $400/month minimum. Deploy NetGoat on a single beefy server, configure per-domain rules for each client, and deliver identical protection levels. Your margin thanks you.

4. The Compliance-Bound Enterprise

GDPR, HIPAA, SOC 2—regulations demanding data residency and audit trails. Commercial CDNs process your traffic through global anycast networks you don't control. NetGoat runs exactly where you specify, with logs staying in your infrastructure. Compliance becomes achievable rather than aspirational.

5. The Developer Layering Cloudflare Strategically

Use Cloudflare for DNS and basic caching, then place NetGoat as your origin. Suddenly you have custom rate limiting, programmable rules, and advanced WAF without upgrading your Cloudflare plan. It's not either/or—it's intelligent hybrid architecture.

Step-by-Step Installation & Setup Guide

Ready to escape the paywall? Here's your complete deployment path.

Prerequisites

NetGoat recommends Datalix VPS for affordable, reliable hosting. Any modern Linux distribution works:

• Ubuntu 22.04+ / Debian 12+ / Fedora 39+
• Minimum 2 CPU cores, 4GB RAM, 20GB SSD
• Public IPv4 address (IPv6 supported)
• Domain with DNS A/AAAA records pointed to your server

Installation

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install Bun runtime (NetGoat's preferred JavaScript runtime)
curl -fsSL https://bun.sh/install | bash
source ~/.bashrc

# Verify Bun installation
bun --version  # Should output 1.x.x or higher

# Clone the NetGoat repository
git clone https://github.com/netgoat-xyz/netgoat.git
cd netgoat

# Install dependencies using Bun
bun install

# Build the control plane (Next.js frontend + Fastify API)
bun run build

# Configure environment variables
cp .env.example .env
nano .env  # Edit database, SSL, and domain settings

Configuration

Edit your .env file with these critical variables:

# Core server configuration
NG_PORT=443                    # Primary HTTPS port
NG_HTTP_PORT=80                # HTTP redirect port
NG_DOMAIN=proxy.yourdomain.com # NetGoat dashboard domain

# Database selection
DATABASE_URL=sqlite:./data/netgoat.db  # SQLite for single-node
# DATABASE_URL=mongodb://localhost:27017/netgoat  # MongoDB for clusters

# SSL/TLS configuration
SSL_AUTO=true                  # Enable Let's Encrypt automation
SSL_EMAIL=admin@yourdomain.com # Certificate notification email

# Security hardening
NG_SECRET=$(openssl rand -hex 32)  # Generate strong JWT secret

Launch NetGoat

# Start with process manager (recommended for production)
bun run pm2:start

# Or start directly for testing
bun run start

# Verify health endpoint
curl -f http://localhost:3000/api/health || echo "Check logs: bun run logs"

DNS Integration

NetGoat's killer feature: automatic DNS scanning. Point your domain's NS records to your server, and NetGoat discovers existing records to auto-generate proxy configurations. No manual YAML wrangling required.

# Example: Delegate subdomain to NetGoat
# In your DNS provider:
# proxy.yourdomain.com  A  YOUR_SERVER_IP
# *.yourdomain.com      A  YOUR_SERVER_IP  (wildcard for auto-discovery)

Access your dashboard at https://proxy.yourdomain.com and begin adding upstream services.

REAL Code Examples from NetGoat

Let's examine actual implementation patterns from the NetGoat ecosystem, demonstrating its programmable infrastructure approach.

Example 1: Dynamic Rules Engine—Custom Rate Limiting

The rules engine lets you write JavaScript/TypeScript for traffic manipulation. Here's how to implement tiered API rate limiting:

// rules/api-tiered-limits.js
// Applied per-domain in the NetGoat dashboard

export default async function(request, context) {
  // Extract API key from header or query parameter
  const apiKey = request.headers.get('x-api-key') || 
                 new URL(request.url).searchParams.get('api_key');
  
  // Define tier configurations
  const tiers = {
    'free':    { requests: 100,  window: 3600 },    // 100/hour
    'pro':     { requests: 1000, window: 3600 },    // 1000/hour
    'enterprise': { requests: 10000, window: 3600 } // 10000/hour
  };
  
  // Lookup tier from NetGoat's built-in key-value store
  const tier = await context.kv.get(`tier:${apiKey}`) || 'free';
  const config = tiers[tier];
  
  // Check rate limit using NetGoat's distributed counter
  const key = `ratelimit:${apiKey}:${Math.floor(Date.now() / 1000 / config.window)}`;
  const current = await context.kv.incr(key, { ttl: config.window });
  
  if (current > config.requests) {
    // Return 429 with retry-after header
    return new Response(JSON.stringify({
      error: 'Rate limit exceeded',
      tier: tier,
      retry_after: config.window
    }), {
      status: 429,
      headers: {
        'Content-Type': 'application/json',
        'X-RateLimit-Limit': String(config.requests),
        'X-RateLimit-Remaining': '0',
        'X-RateLimit-Reset': String(Math.ceil(Date.now() / 1000) + config.window)
      }
    });
  }
  
  // Allow request to proceed to upstream
  return context.pass();
}

What's happening here? This rule intercepts API requests, identifies the caller's subscription tier from NetGoat's KV store, and enforces differentiated rate limits. The context.pass() allows legitimate traffic through; violations return structured 429 responses with standard rate limit headers. No external Redis or rate-limiting service needed—it's all native.

Example 2: WebSocket-Aware Load Balancing

Modern applications demand persistent connections. NetGoat handles WebSocket upgrades intelligently:

// rules/websocket-sticky.js
// Ensures WebSocket clients maintain session affinity

export default async function(request, context) {
  // Only process WebSocket upgrade requests
  const upgradeHeader = request.headers.get('Upgrade');
  if (upgradeHeader?.toLowerCase() !== 'websocket') {
    return context.pass(); // Let non-WebSocket traffic use default balancing
  }
  
  // Extract session identifier from cookie or generate new
  const cookie = request.headers.get('Cookie') || '';
  const sessionMatch = cookie.match(/ws_session=([^;]+)/);
  let sessionId = sessionMatch ? sessionMatch[1] : crypto.randomUUID();
  
  // Check if session has assigned backend
  const backendKey = `ws:session:${sessionId}`;
  let targetBackend = await context.kv.get(backendKey);
  
  if (!targetBackend) {
    // Select least-loaded backend from pool
    const backends = await context.getBackends({ healthy: true });
    targetBackend = backends.sort((a, b) => a.connections - b.connections)[0].id;
    
    // Persist assignment with WebSocket-typical TTL (24 hours)
    await context.kv.set(backendKey, targetBackend, { ttl: 86400 });
  }
  
  // Set sticky session cookie if new
  const response = await context.proxy(targetBackend);
  
  if (!sessionMatch) {
    response.headers.append('Set-Cookie', 
      `ws_session=${sessionId}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=86400`
    );
  }
  
  return response;
}

The insight: WebSocket connections break traditional round-robin load balancing—clients need session affinity. This rule maintains persistent backend assignments using NetGoat's KV store, with automatic failover to healthy nodes for new connections. The context.getBackends() API provides real-time health data for intelligent routing decisions.

Example 3: Custom Cache Policy with Per-Route Invalidation

NetGoat's smart caching layer supports granular invalidation strategies:

// rules/smart-cache.js
// Implements cache policies based on content type and route patterns

export default async function(request, context) {
  const url = new URL(request.url);
  const cacheKey = `${url.hostname}${url.pathname}${url.search}`;
  
  // Define route-specific cache configurations
  const cachePolicies = [
    { pattern: /^\/api\/v1\/users\/\d+$/, ttl: 300,   tags: ['user', 'api'] },
    { pattern: /^\/api\/v1\/products$/,    ttl: 60,    tags: ['product', 'api'] },
    { pattern: /^\/static\//,               ttl: 86400, tags: ['static'] },
    { pattern: /^\/.*/,                     ttl: 0,     tags: ['default'] }  // No cache
  ];
  
  // Find matching policy
  const policy = cachePolicies.find(p => p.pattern.test(url.pathname));
  
  if (!policy || policy.ttl === 0) {
    return context.pass(); // Bypass cache for uncached routes
  }
  
  // Check cache first
  const cached = await context.cache.get(cacheKey);
  if (cached && !context.isCacheInvalidationRequest(request)) {
    // Return cached response with cache status header
    const response = new Response(cached.body, {
      status: cached.status,
      headers: {
        ...cached.headers,
        'X-Cache': 'HIT',
        'X-Cache-TTL-Remaining': String(await context.cache.ttl(cacheKey))
      }
    });
    return response;
  }
  
  // Fetch from upstream and store in cache
  const upstreamResponse = await context.pass();
  const clonedResponse = upstreamResponse.clone();
  
  // Only cache successful responses
  if (upstreamResponse.status === 200) {
    await context.cache.set(cacheKey, {
      body: await clonedResponse.arrayBuffer(),
      status: clonedResponse.status,
      headers: Object.fromEntries(clonedResponse.headers)
    }, {
      ttl: policy.ttl,
      tags: policy.tags // For tag-based invalidation
    });
  }
  
  // Add cache status headers
  upstreamResponse.headers.set('X-Cache', 'MISS');
  upstreamResponse.headers.set('X-Cache-TTL', String(policy.ttl));
  
  return upstreamResponse;
}

Why this matters: Unlike simplistic "cache everything for X minutes" approaches, this implements semantic caching—different content types get appropriate TTLs, with tag-based invalidation for cache purging. The context.isCacheInvalidationRequest() helper detects purge requests (e.g., from your CI/CD pipeline) for instant cache coherence.

Advanced Usage & Best Practices

Production Hardening

• Run behind additional firewall: While NetGoat has WAF capabilities, layer with ufw or iptables for defense in depth
• Enable audit logging: All rule executions and admin actions log to SQLite/MongoDB—ship these to your SIEM
• Use MongoDB for multi-node: SQLite works for single-server; clusters need MongoDB for state consistency
• Monitor Bun memory: The Bun runtime is fast but young—set memory limits and watch for leaks in alpha releases

Performance Optimization

• Enable HTTP/2 push for critical assets in your domain configs
• Compress responses using Brotli (NetGoat auto-negotiates with clients)
• Tune Go worker pool: The proxy engine's concurrency model scales with available cores—vertical scaling is effective

Security Hardening

# Generate strong secrets for production
NG_SECRET=$(openssl rand -hex 64)
NG_ENCRYPTION_KEY=$(openssl rand -hex 32)

# Restrict dashboard access to VPN/internal IPs
NG_ADMIN_ALLOWLIST=10.0.0.0/8,172.16.0.0/12

NetGoat vs. Alternatives: The Honest Breakdown

The verdict? NetGoat uniquely combines zero cost, full data control, and programmable security in one package. Cloudflare Free lacks critical features; Pro still restricts advanced capabilities. Traditional proxies require complex integration for equivalent functionality. NetGoat is the sweet spot for technical teams willing to self-manage infrastructure.

FAQ: Your NetGoat Questions Answered

Is NetGoat stable enough for production use?

NetGoat is in active alpha as of early 2025. The core proxy engine (Go) is performant, but the control plane and self-hosting scripts are still stabilizing. We recommend testing in non-critical environments first, following the project's Discord for release announcements.

Can I really use NetGoat with Cloudflare simultaneously?

Absolutely. NetGoat functions beautifully as an origin server enhancement. Keep Cloudflare for DNS and basic CDN, then route to NetGoat for custom rate limiting, advanced WAF rules, and Zero Trust features you'd otherwise pay Enterprise pricing for.

What hardware do I need for NetGoat?

Minimum viable: 2 CPU cores, 4GB RAM, 20GB SSD. For high-traffic production: scale vertically (more cores help the Go engine) or horizontally with MongoDB-backed clustering. A $5-10/month VPS handles surprising traffic volumes.

How does NetGoat handle SSL certificate management?

Fully automated Let's Encrypt integration. Certificates provision, renew, and deploy without intervention. Support for custom ACME providers and wildcard certificates is planned.

Is my data private with NetGoat?

Completely. Unlike SaaS CDNs, your traffic never touches third-party infrastructure unless you explicitly configure it. Logs, certificates, and request metadata remain on your hardware. This is NetGoat's core value proposition.

What databases does NetGoat support?

Currently SQLite (default, local-first) and MongoDB (distributed deployments). The storage layer is abstracted, with PostgreSQL^{↗ Bright Coding Blog} support on the roadmap based on community demand.

How can I contribute or get support?

Join the NetGoat Discord for real-time help, star the GitHub repository to show support, and consider sponsoring through GitHub Sponsors or Open Collective to accelerate development.

Conclusion: Take Back Control of Your Edge

NetGoat represents something rare in infrastructure tooling: a genuine paradigm shift with practical immediate value. It doesn't ask you to abandon familiar workflows or accept degraded capabilities. Instead, it offers Cloudflare-grade power with sovereign control and zero licensing costs.

For bootstrapped founders, privacy advocates, compliance-bound teams, and curious engineers, the math is compelling. A few hours of setup replaces recurring SaaS expenses with owned infrastructure. The programmable rules engine turns rigid configuration into expressive code. And the modern stack—Go, Bun, Next.js—means you're not inheriting legacy technical debt.

Is NetGoat perfect? Not yet. Alpha software carries risks, and the ecosystem is young. But the trajectory is unmistakable. Early adopters are already reporting successful production deployments. The feature set expands weekly. And the community—fueled by genuine enthusiasm rather than vendor marketing—is growing rapidly.

Your move. Continue renting your edge infrastructure month after month, or invest a weekend in owning it permanently. The repository is waiting, the documentation is improving, and the Discord community will help you succeed.

👉 Star NetGoat on GitHub: https://github.com/netgoat-xyz/netgoat

👉 Join the community: Discord

👉 Deploy your first proxy: Follow the installation guide above and experience what self-hosted edge networking should have been all along.

The future of infrastructure is open, programmable, and under your control. NetGoat is how you get there.