Open Source Appgate Alternatives

NetBird pairs a configuration-free peer-to-peer private network with a central access control system in one platform. Machines join an encrypted WireGuard overlay and reach each other directly, which removes the familiar work of opening ports, writing firewall rules and standing up VPN gateways for every site.

Every machine runs an agent that manages WireGuard locally and connects to a Management Service holding network state, peer addresses and configuration updates. Agents use ICE to discover candidates for direct connections, with a relay as fallback when no peer-to-peer path can be established.

Around that core sits the management surface an organization actually needs.

• Access control: Groups and rules, device posture checks and periodic re-authentication.
• Identity: SSO and MFA support, identity provider integrations and group sync through JWT.
• Routing: Routes into external networks, domain-based DNS routes, exit nodes and private DNS zones.
• Automation: A public API, setup keys for bulk provisioning, a Terraform provider and an Ansible collection.
• Visibility: Activity logging and traffic events, plus browser-based SSH and RDP to peers.

Clients cover Linux, macOS, Windows, Android, iOS, FreeBSD and appliance platforms including pfSense, OPNsense, OpenWRT, Synology and Raspberry Pi. Self-hosting needs a Linux VM with one CPU and two gigabytes of memory, public reachability on TCP 80 and 443 and UDP 3478, a public domain pointing at it, and Docker with the Compose plugin.

Pangolin connects users to private resources and decides what each may reach, in one system. The large commercial platforms got that pairing right but shipped it as a heavyweight closed stack locked to their cloud. Pangolin unifies the same way in the open, on infrastructure you choose.

It is built on WireGuard. Site connectors open outbound tunnels with NAT traversal, so a network behind a restrictive firewall becomes reachable without public IPs or open ports, from a user space binary light enough for modest hardware. Sites, proxy, client access, role based control and the AI gateway share one identity and policy model.

Access reaches resources along several paths.

• Browser based proxy: HTTPS apps plus VNC, RDP and SSH sessions open in a browser with single sign-on and no client to install.
• Client tunnels: peer to peer access to SSH servers, databases, RDP and whole network ranges, with DNS aliases for friendly names.
• Zero trust policy: access is granted per resource, not per network, with identity provider sync, role based access control and audit logs.
• AI gateway: an identity aware proxy fronts cloud and self-hosted model servers, with budgets, session history and usage analytics on each call.
• Traffic handling: routing, load balancing, health checks and automatic SSL certificates are handled for you.

The Community Edition is free under AGPL-3. An open core Enterprise Edition adds more features and stays free for personal use and for businesses under 100,000 dollars of annual revenue, while Pangolin Cloud is hosted for you. Self-hosting starts from the quick install guide or a DigitalOcean image.

Firezone manages remote access for an organization of any size, replacing the flat network a traditional VPN hands out. Group based policies gate access to individual applications, to entire subnets and to everything in between, so one compromised laptop does not expose the rest.

It is built on WireGuard, with a Rust data plane that needs only a few megabytes of memory and an Elixir admin portal and control plane. Tunnels are established on the fly through hole punching, and traffic runs peer to peer and end to end encrypted rather than through Firezone's own infrastructure.

The product is organized around a small set of components.

• Gateways: deploy into your infrastructure, and two or more give automatic load balancing and failover.
• Relays: run STUN and TURN so peers can find each other behind NAT.
• Clients: cover macOS, iOS, Android, ChromeOS, Windows and Linux, in graphical and headless form.
• Identity: authenticates through email, Google Workspace, Okta, Entra ID or OIDC, with automatic user and group sync.
• Policy templates: ship MDM profiles for Windows and macOS fleet management.

Firezone is not a mesh network builder, a full router or firewall, or an IPSec server. The code is open under Apache 2.0 with the Elixir portal under the Elastic License 2.0, and the maintainers state that production self-hosting is not supported today because internal APIs move quickly, so running it yourself suits educational and hobby use while the managed cloud covers production.