Open-source NordVPN alternatives

Headscale is a self-hosted, open-source take on the Tailscale control server. Tailscale is a VPN built on WireGuard that works as an overlay network between your computers using NAT traversal, and the control server is the piece that exchanges WireGuard public keys, assigns IP addresses, separates users and shares routes. Headscale replaces that coordination role with software you run yourself. It is written in Go under the BSD-3-Clause license.

The project has a deliberately narrow scope. It implements a single Tailscale network, called a tailnet, which is suitable for personal use or a small open-source organization, and it aims to give self-hosters and hobbyists a server for their projects and labs. The README explains that Tailscale's own clients and control server are not all open source, which is the gap Headscale fills.

Documentation is published for both stable and development versions, and the maintainers advise using the same Git tag as the release you run so the example configuration matches. A Discord server offers community chat. Headscale suits homelab users and small teams who want private mesh networking without relying on a hosted coordination service.

NetBird joins a configuration-free peer-to-peer private network with a central access control system on one platform. It creates a WireGuard-based overlay that connects machines over encrypted tunnels automatically, which avoids opening ports, writing complex firewall rules or running VPN gateways. It is written in Go and can be used for an organization or a home network. The repository metadata lists the license as Other.

Connectivity features include kernel WireGuard, peer-to-peer connections with relay fallback, routes to external networks, exit nodes, and private DNS with custom zones. For management and security there is an admin web UI, automatic peer discovery, SSO and MFA, identity provider integrations, groups and rules for access control, activity logging, traffic events and device posture checks. A public API, setup keys, a Terraform provider and a self-hosting quickstart script support automation. Clients cover Linux, macOS, Windows, Android and Android TV, and an agent network beta targets AI agents.

WireGuard Easy (wg-easy) combines a WireGuard VPN server and a web-based admin interface into a single package for Linux hosts. The web UI lets you list, create, edit, delete, enable and disable VPN clients, show a client's QR code, and download its configuration file. It is written in TypeScript and released under the AGPL-3.0 license.

Monitoring and security options include connection statistics, transmit and receive charts for each client, Prometheus metrics, client expiration, one-time links, two-factor authentication, OIDC sign-in with providers such as Google, GitHub, Authelia and Authentik, and per-client firewall filtering that requires iptables. The interface supports light and dark modes, multiple languages, IPv6 and CIDR. Installation uses Docker Compose, docker run or Podman, and the documentation covers reverse proxy setups with Caddy and Traefik as well as a migration guide from older versions.

This entry is the OpenVPN source repository. OpenVPN is an open-source VPN daemon, a program that creates secure virtual private network connections between machines. The code is written in C, and the repository is tagged for security and VPN.

No readme or homepage details were available for this entry, so specifics about features, deployment and licensing are not listed here. The repository lists its license as 'Other', and the project community site is community.openvpn.net, which is the place to look for downloads, documentation and support.

This project provides a Docker image for running your own IPsec VPN server. It supports IPsec/L2TP, Cisco IPsec and IKEv2 modes, is built on Alpine or Debian, and uses Libreswan as the IPsec software and xl2tpd as the L2TP daemon. A VPN like this encrypts traffic between a device and the server, which helps on untrusted networks such as cafes, airports and hotels.

On first start it automatically generates VPN credentials and the IKEv2 configuration. It supports IKEv2 with modern ciphers such as AES-GCM, creates profiles that configure iOS, macOS and Android devices, and works with Windows, macOS, iOS, Android, Chrome OS and Linux clients. A helper script manages IKEv2 users and certificates, data persists in a Docker volume, and images are built for amd64, arm64 and arm/v7 through GitHub Actions.

Setup is a single docker run command, or the IPsec VPN can be installed without Docker. The author also publishes related projects for WireGuard, OpenVPN and Headscale. The repository lists the license as Other, so check the licence file. It suits individuals and small teams running a personal or private VPN on a VPS, home server or Raspberry Pi.