Open-source Twingate alternatives

Tailscale makes private networks between devices using the WireGuard protocol, with sign-in handled by existing identity providers and two-factor authentication. The GitHub repository contains most of the company's open-source code, notably the tailscaled daemon and the tailscale command-line tool. It is published under the BSD-3-Clause license and written in Go.

The daemon runs on Linux, Windows and macOS, with partial support on FreeBSD and OpenBSD. The iOS and Android apps reuse this code, while the graphical wrappers for some non-open platforms are not open source, so the full product is a mix of open and proprietary parts. Packages for many distributions are served from the project's package site, and the code can be built from source with the latest Go release. The service itself is hosted by Tailscale.

NetBird joins a configuration-free peer-to-peer private network with a central access control system on one platform. It creates a WireGuard-based overlay that connects machines over encrypted tunnels automatically, which avoids opening ports, writing complex firewall rules or running VPN gateways. It is written in Go and can be used for an organization or a home network. The repository metadata lists the license as Other.

Connectivity features include kernel WireGuard, peer-to-peer connections with relay fallback, routes to external networks, exit nodes, and private DNS with custom zones. For management and security there is an admin web UI, automatic peer discovery, SSO and MFA, identity provider integrations, groups and rules for access control, activity logging, traffic events and device posture checks. A public API, setup keys, a Terraform provider and a self-hosting quickstart script support automation. Clients cover Linux, macOS, Windows, Android and Android TV, and an agent network beta targets AI agents.

Pangolin is an open-source secure access service edge platform built on WireGuard. It aims to connect and protect users wherever they are by combining networking and security in one system: a zero-trust VPN, a zero-trust reverse proxy, privileged access control and a gateway for AI workloads that is aware of user identity, with one identity and policy model underneath.

The project compares its idea to commercial platforms such as Cloudflare One, Zscaler and Prisma, but argues that it is open, self-hostable and light enough to be easy to deploy. Legacy SASE products, it says, are heavy, closed and cloud-locked. Topics include reverse proxy, single sign-on, OIDC, SSH, tunneling, NAT traversal and remote access. Because the source is open to inspection, you can verify how traffic and access decisions are handled.

You can use Pangolin Cloud at app.pangolin.net or run it yourself. The repository's license is listed as 'Other' on GitHub, because it mixes open-source and enterprise components, so check the terms. It suits homelab users, small companies and IT teams that want zero-trust remote access without a large vendor contract.

Nebula is an overlay networking tool, created at Slack, that connects computers anywhere in the world into one private network. It is designed around performance, simplicity and security, and it can link a handful of machines or scale up to tens of thousands. It runs on Linux, macOS, Windows and FreeBSD, with iOS and Android versions available as source code.

Technically, Nebula is a mutually authenticated peer-to-peer software-defined network based on the Noise Protocol Framework. Certificates assert each node's IP address, name and membership in user-defined groups, and those groups allow traffic filtering between nodes regardless of cloud provider. Discovery nodes called lighthouses help peers find each other, with optional UDP hole punching to connect through most firewalls and NATs.

Because addressing does not depend on where machines run, data can move between nodes across different cloud providers, data centers and endpoints without a fixed addressing scheme. Nebula fills a role similar to a mesh VPN. It is written in Go, released under the MIT license and can be self-hosted, with packages available for several Linux distributions, Homebrew and Docker.

ZeroTier describes itself as a programmable Ethernet switch for the planet. It lets networked devices, virtual machines, containers and applications communicate as if they were located in the same data center or cloud region, no matter where they actually are. The client is written in C++.

It combines an encrypted peer-to-peer network layer, called VL1, with an Ethernet emulation layer, called VL2, that works somewhat like VXLAN. The virtualization layer includes enterprise SDN features such as fine-grained access control rules for micro-segmentation and security monitoring. Traffic is encrypted end to end with keys the user controls, and most of it flows directly between peers, with free but slow relaying for cases where a direct connection cannot be made.

Android and iOS apps are available free of charge from the app stores. Most of the code sits under a Mozilla Public License file, while parts of the repository are marked as non-free, source-available code, which is why the repository lists the license as 'Other'. The vendor also offers a network controller, a service API and commercial support.

This entry is the OpenVPN source repository. OpenVPN is an open-source VPN daemon, a program that creates secure virtual private network connections between machines. The code is written in C, and the repository is tagged for security and VPN.

No readme or homepage details were available for this entry, so specifics about features, deployment and licensing are not listed here. The repository lists its license as 'Other', and the project community site is community.openvpn.net, which is the place to look for downloads, documentation and support.

Netmaker builds on WireGuard to create and manage virtual networks automatically, from a home lab to an enterprise. It markets itself as a zero trust networking platform for connecting devices, clouds and sites, with an admin UI so that networks do not have to be configured by hand with wg-quick files.

Its capabilities include WireGuard networks, mesh VPNs, remote access gateways, site-to-site connectivity, private DNS, access control lists and OAuth sign-in. Clients are available for Linux, Mac and Windows, and the server can be deployed with Docker or on Kubernetes. The topics also mention IPv6 support and overlay networking.

You can deploy the open-source server yourself, for example on an Ubuntu 24.04 cloud VM with a static public IP, using a quick-start script and opening the documented ports, or install the self-hosted Pro version. A managed Netmaker SaaS is also offered for those who want to skip operations. The repository lists the license as Other.

Firezone is a zero trust access platform that uses WireGuard and is published as open source. It is positioned as a replacement for a traditional VPN, connecting users to internal apps, services and networks through access policies rather than broad network-level rules.

Administrators define policies for resources and can restrict access by conditions such as device location and time of day, with every authorized connection visible by user, resource or policy. Users and groups sync from an identity provider, which simplifies onboarding and offboarding. Lightweight Gateways run as Linux binaries wherever access is needed, and using two or more Gateways gives automatic load balancing and failover. Hole-punching keeps protected resources hidden from the public internet.

Client apps are available for macOS, Windows, Linux, Android, ChromeOS and iOS. The codebase is licensed under Apache-2.0 and written largely in Elixir, with Rust used for networking components. The vendor offers a hosted admin portal, a free way to get started and a separate pricing page.

Pomerium is an identity and context-aware reverse proxy that makes secure, clientless connections to internal web apps and other services. The goal is to protect internal resources without asking users to connect through a corporate VPN.

According to the project, clientless access makes it easier to adopt, running tunnel-free and close to your apps and services makes it faster, and verifying each action before it executes makes it safer. Context-aware policies can draw on data from several sources, so access decisions can reflect your organization's own needs. Repository topics point to zero-trust, BeyondCorp-style, identity-aware proxy and IAM use cases.

Pomerium is written in Go and licensed under Apache-2.0. Teams that want a hosted control plane and a management GUI can look at Pomerium Zero, while the open-source proxy can be run on your own infrastructure. Documentation and tutorials are available on pomerium.com.

Ziti is the parent project of OpenZiti, an open-source zero-trust networking platform that makes network services invisible to unauthorized users. Every connection, whether from a person, service, device or workload, is authenticated with a cryptographic identity, authorized by policy and encrypted end to end.

It works with existing applications through lightweight tunnelers that need no code changes, and with new applications through embedded SDKs for the strongest zero-trust model. The README lists use cases such as replacing VPNs with per-service authorization, hiding APIs and services so they have no listening ports, and giving IoT devices and other non-human workloads their own identities.

OpenZiti was created and sponsored by NetFoundry and is licensed under Apache-2.0. The code is written in Go, the README describes three deployment models, and a managed solution is available for teams that prefer not to operate it themselves.