Headscale - The main objective of Headscale is to provide a non-proprietary implementation of the Tailscale protocol & control server for hobbyists and self-hosters. Acts as a replacement for the listening servers while allowing you to continue using your existing clients applications. Funnel functionality is currently considered in beta status. Does not include a web ui by default.
Netbird - Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls. You can try their hosted service or selfhost it, or whatever.
Pangolin - is a self-hosted tunneled reverse proxy server with identity and context aware access control, designed to easily expose and protect applications running anywhere. Pangolin acts as a central hub and connects isolated networks — even those behind restrictive firewalls — through encrypted tunnels, enabling easy access to remote services without opening ports or requiring a VPN. Combines traefik reverse proxy with Single Sign On and Wireguard. Meant to be selfhosted, but they do offer a hosted instance.
Pin codes, temporary links, password links for exposing services as a “funnel”. Similar to cloudflare tunnels, where users cannot be bothered to sort things out and just want a service exposed.