Fabio

Fabio is a self-hosted HTTP and TCP reverse proxy that builds its routing from Consul service data. It is best suited to teams already using Consul to direct internet traffic to frontend services. Its protocol range and live route updates are compelling, but the Consul dependency and focused role make it a poor fit for service-to-service routing.

Overview

Services can register path tags such as urlprefix-/user; when Consul data changes, Fabio updates its routing table without a restart or reload. That keeps routes aligned with service registration and avoids a separate manual routing update. Fabio is intended to handle incoming HTTP(S) and TCP requests to frontend services, not to route between frontend and backend services: its deployment guidance assigns that job to Consul service discovery.

Fabio can be deployed from source, as a prebuilt binary, in Docker, or through Homebrew. It is self-hosted and supports Linux, macOS, and Windows. The project site says primary maintenance has been handled by Education Networks of America and the user community since January 2020, a consideration for organizations weighing long-term ownership.

Key features

Routing and traffic handling

Beyond HTTP and raw TCP proxying, Fabio supports redirects, access control, authorization, customizable access logs, compression, header injection, path prepending and stripping, WebSockets, server-sent events, and transparent gRPC proxying. This breadth makes it useful when frontend traffic needs more than simple host or path forwarding. Traffic shaping can send a chosen percentage upstream without requiring Fabio to know the number of service instances, which can support gradual traffic shifts.

TLS and live operations

Fabio supports TLS termination, HTTPS upstreams, and dynamic certificate stores sourced from files, HTTP servers, Consul, or Vault. TCP-SNI forwarding works without re-encryption. The README cautions that newer builds do not validate HTTPS upstream certificates lacking matching SAN extensions, so operators should account for that behavior when securing upstream connections.

Routing changes can be hot-reloaded without downtime, and Fabio can wait for in-flight requests to finish before shutdown. A web UI shows the current routing table; integrations include Vault, Docker, Graphite, StatsD/DataDog, Circonus, Amazon ELB, and Amazon NLB. Release hashes are signed with a PGP key.

Pricing

Fabio (open source): free. The MIT-licensed software is self-hosted, with no free trial; Consul is required for service discovery. There are no paid tiers or published usage caps in this plan. The tradeoff is operational responsibility: teams must deploy and maintain the proxy and its Consul integration themselves.

Platforms

Fabio supports Linux, macOS, and Windows, and is self-hosted. Installation options include source, prebuilt binaries, Docker, and Homebrew. TLS termination and WebSocket support are included, and configuration supports both documented methods.

Who it's for

Fabio is a strong fit for teams running Consul that need a self-hosted entry point for HTTP(S) and TCP traffic to frontend services, particularly where dynamic routes, multiple certificate sources, or percentage-based traffic shaping matter. It is not the natural choice for routing between application tiers, since that use case is assigned to Consul service discovery. Teams seeking a managed service or not already operating Consul should weigh the deployment burden before choosing it.

Pros and cons

• Pro: Consul-driven route updates avoid restarts when service data changes.
• Pro: HTTP, TCP, TLS, gRPC, WebSockets, and traffic shaping cover varied frontend traffic needs in one proxy.
• Pro: Hot reloads and graceful shutdown help preserve service during routing changes and maintenance.
• Con: Consul is required for service discovery, making Fabio a narrower fit outside Consul-based deployments.
• Con: Its intended role excludes frontend-to-backend and backend-to-backend routing.
• Con: The upstream certificate behavior for HTTPS connections requires care when certificates lack matching SAN extensions.

Alternatives

For a free reverse-proxy option without Fabio's stated Consul requirement, consider freenginx, which is distributed under a 2-clause BSD-like license. frp is another free, self-hosted reverse proxy with client and server binaries, and may suit deployments needing that client-server arrangement.

LocalXpose offers a free Starter plan with two active HTTP or HTTPS tunnels, SSL/TLS encryption, unique subdomains, time limits, and an interstitial warning page. ngrok may suit readers seeking a free endpoint service with included usage: its free plan specifies up to three online endpoints and 1GB of data transfer.

Openport has an enterprise plan priced at $1 a month per device, with a 30-device minimum; consider it when that device-based plan fits the deployment. Pomerium offers a free personal plan capped at 10 users, 10 routes, 5 policies, and 2 service accounts, making those limits relevant for smaller deployments. Zoraxy is a free AGPL-licensed open-source option. Envoy Proxy is a free open-source proxy installable through Docker, macOS Homebrew, or a static binary.

Browse the Reverse Proxy Software directory for more options.

Verdict

Choose Fabio if Consul already drives your service discovery and you need a self-hosted proxy for incoming HTTP(S) and TCP traffic, with flexible TLS and live routing changes. Look elsewhere if you need a proxy for traffic between application tiers or want to avoid operating Consul alongside the proxy.