What Is Nebula Proxy? Explained Simply

If you have run into the phrase "Nebula Proxy" and come away confused, that is a reasonable reaction. At least three unrelated things carry the name, the search results mix them together freely, and a good number of the pages explaining it are written by companies who would like to sell you something adjacent.

We are Geonode and we sell proxies, so here is the honest disclaimer up front: Nebula Proxy is not a thing you can buy from us, and for the use case most people arrive here with, buying a commercial proxy is not the answer either. Nebula is free, open-source software. If your goal is to open a blocked site on a school network, our residential proxies would be a strange and expensive way to attempt it, and we will explain later why they would probably not work anyway. We are writing this because the existing explanations are mostly vague, and a clear one is more useful than a sales pitch.

The short version: the Nebula most people mean is a self-hostable web proxy frontend — a website that fetches other websites on your behalf and renders them inside itself, so that from the network's point of view you are only ever visiting Nebula. It is published on GitHub under the AGPL-3.0 licence, it is built on a family of open-source proxying libraries designed for exactly this, and there are a large number of public instances of it run by people you do not know.

That last detail matters more than anything else in this article, and we will come back to it.

The Three Things Called Nebula Proxy

Getting these apart is most of the confusion solved.

1. Nebula, the web proxy frontend

This is what almost everyone means. NebulaServices/Nebula on GitHub describes itself as "a stunning and sleek web proxy with support for hundreds of popular sites". It is a web application you visit in a browser: you type a URL into a box, and the site loads inside Nebula's own page.

It is licensed AGPL-3.0 and built on Astro, Tailwind, Svelte and Fastify, with a marketplace for community themes and plugins. The actual proxying is done by separate libraries — Ultraviolet and Scramjet — which we come to shortly.

Because it is open source, there is no single "Nebula Proxy". There is the upstream project, and then there are hundreds of forks and deployments, each run by a different person, each with a different domain that tends to change when the previous one gets blocked.

2. Nebula, Slack's overlay networking tool

An entirely different piece of software with an unfortunate name collision. slackhq/nebula is a "scalable overlay networking tool with a focus on performance, simplicity and security", built at Slack by Nate Brown and Ryan Huber. It is MIT licensed and it is not a proxy at all — it is a mutually authenticated peer-to-peer software-defined network.

If you found this article while looking for that, section eight is for you. The two projects have nothing in common beyond five letters.

3. "Nebula proxy" as a generic marketing phrase

A third category worth naming: a number of commercial proxy vendors have published articles about "Nebula proxies" that describe them as a category of proxy service with distinctive properties. As far as we can tell from the actual source code and repositories, there is no such technical category. It appears to be a search term that generated traffic, so pages were written to capture it.

We are a proxy vendor writing about a search term, so treat this article with the same suspicion — but check the links. Everything technical here points at source repositories you can read yourself.

How Nebula Works Under the Bonnet

Understanding the mechanism explains both why it works and where it fails.

The Basic Idea

A classic proxy sits between your device and the internet at the network level: you configure your system or browser to route traffic through it. Nebula is not that. Nebula is a website.

You open Nebula in a browser. You type a destination. Nebula's server fetches that destination, rewrites the page so that its links, scripts and requests point back through Nebula rather than out to the original domain, and serves it to you. Your browser only ever talks to Nebula. To any device watching your traffic, you are visiting one site.

That is the entire trick, and it is why it defeats simple domain-based filters. A filter with a blocklist containing a social network's domain never sees that domain in your traffic.

Service Workers, Not Server-Side Rewriting

The interesting engineering is in the proxying libraries. Ultraviolet, the best-known of them, describes itself as "a highly advanced web proxy used for evading internet censorship or accessing websites in a controlled sandbox", and it is also AGPL-3.0.

Rather than rewriting everything on the server, Ultraviolet installs a service worker in your browser — a script that sits between the page and the network and intercepts outgoing requests, following the TompHTTP specification. When the proxied page tries to load an image, call an API or open a socket, the service worker catches that request and reroutes it through the proxy.

This matters because it is what allows heavy JavaScript applications to work at all. Server-side rewriting handles static HTML fine and falls apart the moment a page builds its own requests at runtime, which every modern site does. Intercepting in the browser catches those too.

Ultraviolet Is Being Retired

Worth knowing if you read older guides: Ultraviolet's own repository states that it is no longer actively maintained and has been superseded by Scramjet. Nebula's current documentation lists both Ultraviolet and Scramjet as backends.

An unmaintained proxying library is a genuine concern rather than a pedantic one. These libraries work by carefully emulating browser behaviour, and browsers change. Unmaintained means accumulating breakage, and any security issue found in it stays found.

Why It Is Not a Static Site

The repository is explicit that Nebula "will NOT deploy on GitHub Pages, Netlify, Vercel, Gitlab Pages, or any other static host", and also will not work on Render. It needs a real server process — Node with npm or pnpm, or Docker — plus a database, with SQLite for casual use and PostgreSQL recommended for production instances.

That requirement is the reason public instances exist at all. Most people who want a web proxy do not want to run a server, so they use someone else's. Which brings us to the part that actually matters.

Public Instance vs Self-Hosting

These are two very different propositions wearing the same interface.

Public Instances

Someone has deployed Nebula on a domain and made it available. You visit it and use it. Free, instant, no technical knowledge required.

The operator of that instance can see every request you make through it, in full. Not the domains — everything. The proxy is decrypting and re-encrypting your traffic by design; that is how it rewrites pages. Every URL, every form submission, every password typed into a proxied login page passes through their server in a readable form.

You do not know who they are. You usually cannot know. There is no contract, no privacy policy worth the name, no jurisdiction, no accountability, and no cost to them of behaving badly. Some operators are teenagers doing it as a hobby project. Some are running advertising. Some are doing something worse.

Public instances also tend to be short-lived. They get blocked, they get taken down, they run out of hosting credit. The pattern of a domain that keeps changing is inherent to the model.

Self-Hosting

You deploy Nebula yourself, on hosting you control. The repository documents both a terminal path (Node, npm or pnpm, Git) and Docker, with Koyeb explicitly supported among platforms.

Now the trust problem is solved: the only person who can read your traffic is you. You control the domain and the uptime. You can update it when the proxy libraries change.

The costs are real, though. You need somewhere to run it and a domain, which is a small but non-zero monthly bill. You need enough comfort with a terminal to deploy and update it. And you have made yourself the operator, which means if you share it with other people, you now hold their traffic — with everything that implies about responsibility for what passes through.

The Honest Recommendation

If you are going to use Nebula for anything you would mind a stranger reading, self-host or do not use it. There is no middle position. "Probably fine" is not a security model, and the operator of a free public proxy has no reason to earn your trust and no way to demonstrate it.

What Nebula Does Not Do

This is the section that saves people from bad assumptions.

It does not make you anonymous. The destination site sees the proxy's address instead of yours, but the proxy operator sees everything. You have not removed an observer; you have swapped one you can identify for one you cannot.

It does not encrypt your connection end to end in the way a VPN does. Your browser's connection to Nebula may be HTTPS, and Nebula's connection onward may be HTTPS, but Nebula sits in the middle in plaintext. That is not a flaw — it is required for the rewriting to work — but it means the guarantees are quite different from what people assume.

It does not hide anything from a managed device. This is the big one, and it is widely misunderstood. If you are using a school or employer laptop, the organisation may have installed monitoring software, a management profile, or a certificate that lets network equipment inspect encrypted traffic. All of those operate on the device or at the point of decryption, before or after the proxy is involved. A web proxy does nothing about screen recording, keystroke logging, browser extension reporting or a TLS-inspecting firewall with an installed root certificate. Plenty of people have discovered this the uncomfortable way.

It does not defeat serious filtering. Blocking a list of domains is easy to route around. Modern filtering also does category classification, TLS fingerprinting, DNS inspection and traffic analysis, and known proxy frontends are themselves a well-known category that gets blocked. This is why public instances cycle domains constantly — they are losing the same race repeatedly.

It does not remove the rules you agreed to. Circumventing a network filter is typically a straightforward breach of an acceptable use policy, whatever the technical outcome. Schools and employers treat that as a conduct matter, and the technology working does not make the consequence go away.

It does not reliably work on protected sites. Sites with strong bot detection, streaming platforms with DRM, banking, and anything doing device-level checks will frequently detect a rewriting proxy and refuse to load, or load broken.

Nebula Compared to the Alternatives

Different tools, different trust models, different failure modes.

Option	Who can read your traffic	Cost	Hides from managed device	Typical use
Nebula, public instance	Unknown operator, everything	Free	No	Casual unblocking
Nebula, self-hosted	You	Hosting + domain	No	Personal access
Reputable VPN	The provider, per its policy	~$3–$12/mo	No	Privacy, geo-shifting
Tor Browser	No single party sees both ends	Free	No	Strong anonymity
Browser proxy extension	The extension author	Free–cheap	No	Convenience
Commercial proxy service	The provider	From ~$0.14/GB	No	Automation, scraping

Reading the Table

Notice the column that says "No" the whole way down. No network-level tool protects you from software running on your own device. If the device is managed, that is the thing to reason about, and none of these change it.

A reputable VPN is the closer comparison to what most people think Nebula is. It encrypts everything from the device, covers all applications rather than one browser tab, and comes from a company with a name, a jurisdiction and a policy you can read. It costs money, and you are still trusting a single provider — but a provider with something to lose.

Tor Browser is the serious answer if the actual requirement is anonymity. Its design means no single relay can link who you are to what you are visiting, and it is free. It is also slow, obvious on a network, and blocked in many places.

Commercial proxy services — our category — are built for a different job entirely. Residential and datacenter proxies exist so that automated systems can make many requests from many addresses: price monitoring, ad verification, market research, scraping at scale. They are sold by bandwidth, they are configured in code rather than in a browser tab, and using them to open a blocked website is like renting a lorry to move a bookcase. For reference, ours run from $0.79/GB residential and $0.14/GB datacenter (pricing), and none of that is what a person trying to open a website at school needs.

The Risks Worth Understanding

Not scaremongering, just the things people find out afterwards.

Credential exposure is the serious one. Logging into anything through a public web proxy hands your username and password to the operator in readable form. Email, social accounts, school portals, anything. If you take one thing from this article: never sign in to an account through a proxy instance you do not run.

Malicious forks are easy. The project is open source, which is good, but it also means anyone can fork it, add a few lines that record form submissions, and deploy it under a friendly-looking domain. Nothing about the interface would look different. You cannot audit code you cannot see running.

Advertising and worse. Free instances cost money to run. Some monetise with ads, some with more aggressive injected content. A proxy rewrites pages as its normal function, so injecting things into them is trivial.

Being logged is likely regardless. The network you are on still records that you connected to the proxy's address, even if it cannot see what you did there. On a monitored network, repeated connections to an unfamiliar domain that is not on the allowlist is itself a signal, and often a more interesting one than an ordinary blocked-site attempt.

Policy consequences are separate from technical success. Schools and workplaces generally treat deliberate filter circumvention as a discipline matter. The tooling working perfectly does not affect that outcome at all.

Legal context varies. In most places, using a proxy is entirely lawful. What you do through one is governed by the same laws as anything else, and in some countries circumvention tools are themselves restricted. This is a general observation and not legal advice; if it matters to your situation, ask someone qualified rather than a blog.

Slack's Nebula: The Overlay Network With the Same Name

If you arrived looking for infrastructure software, this is what you wanted.

Nebula is a scalable overlay networking tool built at Slack by Nate Brown and Ryan Huber, with contributions from a number of others, released under the MIT licence. It is not a proxy and it is not for unblocking websites.

What it does is let machines anywhere in the world talk to each other over a private, mutually authenticated network as if they were on the same LAN. It is built on the Noise Protocol Framework, using ECDH key exchange and AES-256-GCM, and it runs on Linux, macOS, Windows, iOS and Android.

How It Is Put Together

Lighthouses are nodes with fixed, routable addresses whose job is helping other nodes find each other. They enable UDP hole punching so peers can establish direct connections from behind most firewalls and NATs — which means traffic flows peer to peer rather than through a central server, unlike a traditional VPN concentrator.

Certificates authenticate every node and define its membership in user-defined groups. Those groups drive the firewall rules controlling which hosts may talk to which. Access control is part of the identity system rather than bolted on afterwards.

Why the Confusion Is Worth Clearing Up

The two projects are aimed at completely different people. Slack's Nebula is for connecting servers, containers and laptops across cloud providers and offices in a secure private network. Nebula the web proxy is a browser page for loading blocked sites.

Searching "Nebula proxy" returns both, and a fair amount of content that appears not to have noticed they are different. If you are evaluating something for production infrastructure, the repository above is the one you want, and "proxy" is the wrong word for it.

When Nebula Is the Wrong Tool

Against our interest and against the topic — several common situations call for something else entirely.

You want privacy. Use a reputable VPN or Tor Browser. A public web proxy moves the observer rather than removing it, and moves it somewhere less accountable.

You are on a school or work device. Nothing at the network layer helps if the device itself is monitored. The realistic options are using your own device on your own connection, or asking for the site to be unblocked — which, for a legitimate research need, works more often than people expect.

You need it to work reliably. Public instances disappear, get blocked and break. If something matters, do not build a routine around a free domain run by a stranger.

You want to watch streaming services. Rewriting proxies and DRM do not get along. This will mostly not work, and where it does it will be unpleasant.

You are automating anything. Scraping, monitoring, testing at scale — a browser-based unblocker is the wrong shape entirely. That is what proxy services and headless browsers are for, and it is the one place our product is genuinely the right answer.

You are trying to hide something serious. If the stakes are real, a free web proxy run by an anonymous operator is close to the worst available choice. It concentrates everything you do into one unaccountable point.

You just want a site your network blocks for no good reason. Fair enough — this is the honest majority case. Self-host if you can. If you cannot, use a public instance with full awareness that the operator sees everything, and never sign in to anything through it.

Wrapping Up

Nebula Proxy is a well-built open-source web proxy that does a specific, narrow thing: it loads websites on your behalf so that your network only ever sees a connection to Nebula. The engineering is genuinely interesting — service workers intercepting requests in the browser is what lets it handle modern JavaScript applications rather than just static pages — and the whole thing is readable on GitHub under AGPL-3.0.

The decision that actually matters is not whether to use Nebula. It is whose instance you use. Self-hosted, the only person who can read your traffic is you, at the cost of a small hosting bill and a bit of terminal work. On a public instance, an anonymous operator sees every request and every credential you type, with no accountability of any kind. Those are not two versions of the same choice.

It is also worth being clear about what the tool cannot reach. A web proxy operates on the network path. Monitoring software, management profiles and TLS inspection operate on the device, and no proxy, VPN or anonymity network changes that. If you are on equipment someone else administers, that is the fact to reason about first.

We sell proxies and none of the above is a pitch for them. Commercial proxy services solve a different problem — automated systems making many requests from many addresses — and they are the wrong purchase for opening a blocked website. Saying so costs us nothing, and telling you otherwise would waste your money.

If you take two things away: never sign in to an account through a proxy instance you do not control, and if the device belongs to your school or employer, the network layer was never where the question was decided.

What Is Nebula Proxy?