How BurrowGate compares
A practical look at what is built in, what needs an external component, and where another proxy may be the better fit.
This is a capability comparison, not a performance or security benchmark. It compares free/community distributions and their standard first-party modules. Paid editions and third-party extensions are called out rather than counted as built in. Features vary by version and packaging; this comparison was reviewed against upstream documentation in September 2026.
- ✅ First-party capability
- ⚠️ Partial, limited, paid, or requires an external component or third-party extension
- ❌ No comparable first-party capability
A feature can still require configuration when marked ✅. Scroll tables horizontally to see every product.
Setup & TLS
| Capability | BurrowGate | Traefik | Nginx Proxy Manager | Caddy | Nginx | Apache |
|---|---|---|---|---|---|---|
| Primary configuration surface | Web dashboard | Files, labels, CRDs | Web dashboard | Caddyfile or JSON API | Text files | Text files |
| Configuration automation through JSON/API | ✅ Complete permission-scoped dashboard API (OpenAPI 3.2) | ⚠️ Status API is read-only (writes use providers) | ✅ Bearer-token API (OpenAPI 3.1) | ✅ Native JSON config API | ⚠️ JSON control/reload API (configuration remains file-based) | ❌ Files and reload signals |
| Config as code / GitOps | ❌ Dashboard/database state | ✅ | ❌ Dashboard/database state | ✅ | ✅ | ✅ |
| Docker/Kubernetes service discovery | ❌ Manual origins | ✅ Provider integrations | ❌ Manual hosts | ❌ | ❌ | ❌ |
| Automatic ACME certificates | ✅ HTTP-01; RFC 2136 DNS-01 (no wildcard issuance) | ✅ HTTP-01, DNS-01, TLS-ALPN | ✅ HTTP-01 and DNS plugins | ✅ Automatic; DNS via modules | ⚠️ Optional official ACME module or Certbot | ✅ mod_md |
| Custom PEM certificates / multi-domain SNI | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Scheduled listener-affecting changes | ✅ Dashboard scheduler | ❌ | ❌ | ❌ | ❌ | ❌ |
BurrowGate and Nginx Proxy Manager prioritize point-and-click administration. BurrowGate's database-backed state is not declarative GitOps, but it is fully automatable: every admin JSON endpoint is available to permission-scoped full-access tokens. Traefik, Caddy, Nginx, and Apache are better fits when version-controlled declarative configuration is a requirement; Traefik specializes in routes that follow a changing container or Kubernetes fleet. See the API tokens and OpenAPI guide.
Security & access control
| Capability | BurrowGate | Traefik | Nginx Proxy Manager | Caddy | Nginx | Apache |
|---|---|---|---|---|---|---|
| Bundled request-protection rules | ✅ Small managed ruleset | ⚠️ Plugin or paid Traefik Hub WAF | ⚠️ External/custom nginx build | ⚠️ Third-party module | ⚠️ ModSecurity module | ⚠️ ModSecurity module |
| Browser challenge / proof of work | ✅ SHA-256 PoW, hCaptcha, Turnstile, reCAPTCHA, Snake, Slider, Trace, password, quiz, pluggable chain | ❌ | ❌ | ❌ | ❌ | ❌ |
| Maintained bot catalog, blocking, and analytics | ✅ Category/site/route controls, IP verification, bot graphs | ⚠️ Manual HeaderRegexp routing |
⚠️ Custom nginx configuration | ⚠️ Manual header matchers | ⚠️ Manual User-Agent rules | ⚠️ Manual BrowserMatch/Require |
| Tor/VPN/datacenter/ISP detection and blocking | ✅ Opt-in, dynamic categories, site/route/stream modes | ⚠️ Middleware/plugin or external data | ⚠️ Custom nginx configuration | ⚠️ External data and matchers | ⚠️ GeoIP/custom maps | ⚠️ External data/custom rules |
| IP/CIDR access rules | ✅ Per site and route | ✅ IPAllowList middleware |
✅ Per-host Access Lists | ✅ Request matchers | ✅ allow/deny |
✅ Require ip |
| ASN/country policy | ✅ Per site and route | ⚠️ Plugin/external GeoIP | ⚠️ Custom nginx configuration | ⚠️ Third-party module | ⚠️ GeoIP2 module | ⚠️ GeoIP module |
| Request rate limiting | ✅ Fixed/sliding/token-bucket, dashboard-managed | ✅ Rate-limit middleware | ⚠️ Custom nginx configuration | ⚠️ Third-party module | ✅ limit_req |
⚠️ Third-party module |
| Protected-app users with TOTP/WebAuthn | ✅ | ⚠️ External identity provider | ⚠️ HTTP Basic Access Lists | ⚠️ Basic auth or external auth | ⚠️ Basic auth or external auth | ⚠️ Basic/digest or external auth |
| OIDC SSO for dashboard and protected apps | ✅ Admin-wide and per-site SSO, auto-provisioning, back-channel logout | ⚠️ Paid Hub or external ForwardAuth | ⚠️ External authentication gateway | ⚠️ forward_auth plus external gateway |
⚠️ External service/module | ⚠️ External module/service |
| Signed upstream identity / cross-site authentication | ✅ HMAC-signed identity headers and browser/backend SDK | ⚠️ ForwardAuth/external identity service | ⚠️ Custom configuration or external gateway | ⚠️ forward_auth plus external gateway |
⚠️ auth_request plus custom signing |
⚠️ External module/custom signing |
| CrowdSec remediation component | ✅ Built in, HTTP and TCP/UDP, ban/captcha/AppSec per site, route, and Stream | ⚠️ Third-party plugin | ❌ | ⚠️ Third-party module | ⚠️ Official bouncer | ⚠️ Third-party bouncer |
| Firewall sync | ✅ Push bans to UniFi, nftables, OVH, or AWS | ⚠️ External automation | ⚠️ External automation | ⚠️ External automation | ⚠️ External automation | ⚠️ External automation |
BurrowGate's distinction is the integration: bot and privacy-network identity and blocking, protection decisions, CrowdSec decisions, browser challenges, local or OIDC-backed access accounts, signed upstream identity, bans, traffic records, and firewall updates share one policy and audit surface. Its small bundled ruleset does not inspect request bodies and is not a replacement for the OWASP Core Rule Set, though CrowdSec's AppSec component can be enabled per route for that. Read the bot management documentation, the Tor and ASN network category detection documentation, and the managed protection documentation.
Traffic management
| Capability | BurrowGate | Traefik | Nginx Proxy Manager | Caddy | Nginx | Apache |
|---|---|---|---|---|---|---|
| HTTP load balancing | ✅ Priority, round robin, weighted, sticky sessions | ✅ Round robin, weighted, sticky cookies | ❌ One upstream per host UI | ✅ Multiple policies and sticky cookies | ✅ Multiple policies | ✅ mod_proxy_balancer |
| Active origin health checks | ✅ With maintenance fallback | ✅ | ❌ | ✅ Built in | ⚠️ Active checks in NGINX Plus; passive in OSS | ✅ mod_proxy_hcheck |
| TCP/UDP proxying | ✅ TLS termination, health checks, incoming TCP PROXY v1/v2, and outgoing PROXY forwarding | ✅ TCP/UDP routers | ✅ TCP/UDP streams | ⚠️ Third-party layer4 module | ✅ Stream module | ❌ |
| TCP/UDP protection and per-client analytics | ✅ IP/CIDR/ASN/country policy, limits, managed rules, auto-bans, live peers, GeoIP, UDP amplification guard | ⚠️ IP allowlists/connection limits; external analytics | ❌ Stream forwarding only | ⚠️ Third-party layer4 modules and external analytics | ⚠️ Stream access/limit modules plus external analytics | ❌ No generic stream proxy |
| Static file serving from disk | ✅ Folder picker, SPA fallback, mixable with proxy origins | ❌ | ❌ | ✅ | ✅ | ✅ |
| Reverse-proxy response caching | ✅ Bounded cache with dashboard purge | ⚠️ Plugin or paid product | ⚠️ Custom nginx configuration | ⚠️ Third-party module | ✅ proxy_cache |
✅ mod_cache |
Caddy, Nginx, and Apache offer deeper general-purpose web-server configuration. BurrowGate exposes a narrower set of static serving, caching, origin health, failover, and unusually broad TCP/UDP protection and telemetry controls through its dashboard. See how Streams work.
Observability & alerting
| Capability | BurrowGate | Traefik | Nginx Proxy Manager | Caddy | Nginx | Apache |
|---|---|---|---|---|---|---|
| Traffic/session/bandwidth analytics dashboard | ✅ | ⚠️ Routing dashboard; external analytics | ❌ | ❌ | ❌ | ❌ |
| GeoIP map / ASN breakdown | ✅ Interactive map, per country/ASN | ❌ | ❌ | ❌ | ❌ | ❌ |
| Request/response capture and resend | ✅ Bounded, redacted, dashboard resend | ⚠️ Access logs only | ⚠️ Log files only | ⚠️ Access logs only | ⚠️ Access logs only | ⚠️ Access logs only |
| Structured administrative audit trail | ✅ Actor, IP, action, resource, time, search | ⚠️ External Git/orchestrator audit or paid platform | ✅ Built-in audit log | ⚠️ External config/API audit | ⚠️ OS/Git/SIEM or paid management plane | ⚠️ OS/Git/SIEM |
| Prometheus-compatible metrics | ✅ OpenMetrics endpoint | ✅ | ❌ | ✅ OpenMetrics | ⚠️ Exporter or paid API | ⚠️ mod_status plus exporter |
| Host/container and internet-connectivity monitoring | ✅ CPU, memory, disk, network, reachability, thresholds, history | ⚠️ External host monitoring | ⚠️ External host monitoring | ⚠️ External host monitoring | ⚠️ External host monitoring | ⚠️ External host monitoring |
| Durable operational alerts and delivery history | ✅ Ordered retries, searchable log, recovery events, signed ntfy/Slack/Discord/generic webhooks | ⚠️ External monitoring | ⚠️ External monitoring | ⚠️ External monitoring | ⚠️ External monitoring | ⚠️ External monitoring |
Traefik and Caddy provide strong metrics for Prometheus, OpenTelemetry, or Grafana-based stacks. BurrowGate's advantage is immediate local visibility and debugging, including host resources and internet reachability, plus an administrative audit trail and durable alert delivery in its dashboard. An external telemetry stack remains the better choice for long-term, cross-service observability.
Audit-control alignment: BurrowGate's audit trail can contribute technical evidence toward NIST SP 800-53 AU-2/AU-3/AU-6, ISO/IEC 27001:2022 Annex A 8.15/8.16, SOC 2 Trust Services Criteria monitoring and change-management controls, PCI DSS 4.0.1 Requirement 10, HIPAA Security Rule §164.312(b), and GDPR Articles 5(2) and 32. This does not mean BurrowGate or a deployment is certified, attested, or compliant. Each framework requires additional controls, policies, operational evidence, scope definition, and, where applicable, independent assessment. The logging and audit documentation describes the trail's scope and current limitations.
Availability & ecosystem
| Capability | BurrowGate | Traefik | Nginx Proxy Manager | Caddy | Nginx | Apache |
|---|---|---|---|---|---|---|
| Multi-instance config replication and failover | ✅ Primary/replica replication and quorum election (experimental); external front-end LB required | ⚠️ External orchestrator/LB and shared config | ⚠️ External DB/storage/LB; no native cluster | ⚠️ External config automation/storage/LB | ⚠️ External automation/LB | ⚠️ External automation/LB |
| Maturity & community | ⚠️ New v1.x project, small community | ✅ Mature, broad cloud-native adoption | ✅ Mature, large homelab community | ✅ Mature | ✅ Long-established | ✅ Long-established |
| Extension ecosystem | ⚠️ Provider interface, no loadable general plugin system | ✅ Middleware/plugin catalog | ⚠️ Nginx custom configuration | ✅ Module ecosystem | ✅ Extensive module ecosystem | ✅ Extensive module ecosystem |
| License | EUPL-1.2 | MIT | MIT | Apache-2.0 | 2-clause BSD (Plus is commercial) | Apache-2.0 |
BurrowGate is the youngest project here, with the smallest community and a narrower extension story. Its experimental HA integrates configuration and identity-state replication plus failover elections, but deployments still need a load balancer in front and should be tested carefully. Read the high-availability guide.
Which one should you use?
Each option has a different center of gravity. Start with the operational model you actually want.
BurrowGate
Choose one dashboard-managed gateway for TLS, integrated protection, app access with 2FA, origin load balancing, permission-scoped API automation, audit history, and traffic visibility.
Traefik
Choose it for Kubernetes or a fast-changing Docker fleet where routes should be discovered automatically from labels or CRDs.
Nginx Proxy Manager
Choose a focused GUI for common homelab proxy hosts, certificates, access lists, and TCP/UDP forwarding.
Caddy
Choose automatic HTTPS, concise configuration, and a capable general-purpose web server without an integrated management dashboard.
Nginx or Apache
Choose long operational histories, exact low-level control, or a mature module-and integrate authentication, protection, and monitoring as needed.
Put BurrowGate in front of your first site
Run it on your infrastructure with Docker Compose, then configure the gateway from your browser.