firezone

Firezone is a zero-trust remote access platform built on WireGuard. Group-based policies replace the all-or-nothing VPN model: each resource (host, subnet, service) has its own access rules, and users only see what they are allowed to reach. The current product is the second-generation Firezone, a full rewrite of the original self-hosted product.

License is the part to read carefully. Elixir components ship under Elastic License 2.0, the rest is Apache 2.0. The team explicitly says self-hosting is permitted for educational and hobby use but is not officially supported for production, and that internal APIs change rapidly. That makes the cloud product the intended deployment, not a nice-to-have. Setup of the cloud version is genuinely fast: connect an identity provider, deploy gateways via Docker, define resources and policies.

Solo developers and homelabs get the free cloud tier with up to 6 users, which is enough for most personal setups. Small teams scale to Team at $5 per user per month. Enterprises pay for directory sync, audit logs, and SLA support.

The catch is the open source posture is closer to source-available than truly open. If you want a fully self-hostable zero-trust platform with no vendor commitment, look at Tailscale's open source Headscale implementation or Twingate's alternatives. Pick Firezone when you want a managed service backed by code you can audit, not a self-hosted product.