Open Source Cloudflare One Alternatives

Tailscale states its purpose in one line: private WireGuard networks made easy. This repository holds the majority of that open source code, principally the tailscaled daemon and the tailscale command line tool, which together form a node on the network.

Coverage differs by platform. The daemon runs on Linux, Windows and macOS, and to varying degrees on FreeBSD and OpenBSD. The iOS and Android apps are built from this code too, though the mobile interface code lives elsewhere, and the GUI wrappers shipped for closed platforms are not themselves open source.

Distribution is spread across several places.

• Packages: prebuilt packages for a range of distributions and platforms, served by the project.
• Separate repositories: the Android app, the Synology package, the QNAP package and Chocolatey packaging each live on their own.
• Source builds: a go install of the two commands is enough for personal use.
• Distribution builds: packagers are asked to use the supplied script so commit IDs and version information end up inside the binaries, which keeps bug reports useful.

Building always requires the most recent Go release, and while the project maintains its own Go fork for releases, using that fork is not a requirement. Contributions are welcome with a filed bug and a Developer Certificate of Origin sign off on every commit. WireGuard is a registered trademark of Jason A. Donenfeld.

NetBird pairs a configuration-free peer-to-peer private network with a central access control system in one platform. Machines join an encrypted WireGuard overlay and reach each other directly, which removes the familiar work of opening ports, writing firewall rules and standing up VPN gateways for every site.

Every machine runs an agent that manages WireGuard locally and connects to a Management Service holding network state, peer addresses and configuration updates. Agents use ICE to discover candidates for direct connections, with a relay as fallback when no peer-to-peer path can be established.

Around that core sits the management surface an organization actually needs.

• Access control: Groups and rules, device posture checks and periodic re-authentication.
• Identity: SSO and MFA support, identity provider integrations and group sync through JWT.
• Routing: Routes into external networks, domain-based DNS routes, exit nodes and private DNS zones.
• Automation: A public API, setup keys for bulk provisioning, a Terraform provider and an Ansible collection.
• Visibility: Activity logging and traffic events, plus browser-based SSH and RDP to peers.

Clients cover Linux, macOS, Windows, Android, iOS, FreeBSD and appliance platforms including pfSense, OPNsense, OpenWRT, Synology and Raspberry Pi. Self-hosting needs a Linux VM with one CPU and two gigabytes of memory, public reachability on TCP 80 and 443 and UDP 3478, a public domain pointing at it, and Docker with the Compose plugin.

Pangolin connects users to private resources and decides what each may reach, in one system. The large commercial platforms got that pairing right but shipped it as a heavyweight closed stack locked to their cloud. Pangolin unifies the same way in the open, on infrastructure you choose.

It is built on WireGuard. Site connectors open outbound tunnels with NAT traversal, so a network behind a restrictive firewall becomes reachable without public IPs or open ports, from a user space binary light enough for modest hardware. Sites, proxy, client access, role based control and the AI gateway share one identity and policy model.

Access reaches resources along several paths.

• Browser based proxy: HTTPS apps plus VNC, RDP and SSH sessions open in a browser with single sign-on and no client to install.
• Client tunnels: peer to peer access to SSH servers, databases, RDP and whole network ranges, with DNS aliases for friendly names.
• Zero trust policy: access is granted per resource, not per network, with identity provider sync, role based access control and audit logs.
• AI gateway: an identity aware proxy fronts cloud and self-hosted model servers, with budgets, session history and usage analytics on each call.
• Traffic handling: routing, load balancing, health checks and automatic SSL certificates are handled for you.

The Community Edition is free under AGPL-3. An open core Enterprise Edition adds more features and stays free for personal use and for businesses under 100,000 dollars of annual revenue, while Pangolin Cloud is hosted for you. Self-hosting starts from the quick install guide or a DigitalOcean image.

OpenVPN is a secure tunneling daemon, and this repository is the community source tree behind it, distributed under version 2 of the GNU General Public License. The README offers no product tour, only what an administrator needs to fetch the source, build it, and find the reference material that explains the rest.

Building follows the familiar Unix sequence. Unpack the release tarball, run configure, then make and make install, with the INSTALL file covering the details. Windows builds with MinGW or MSVC are described separately in the CMake readme, and released versions are published on the community downloads page rather than assembled by hand.

The source distribution ships samples worth reading before writing a configuration of your own.

• Sample config files: a collection of configurations and scripts taken from the project HOWTO.
• Sample keys: RSA keys and certificates for testing only, deliberately insecure and never for real deployments.
• verify-cn: a Perl script for the tls-verify option, showing a custom authentication test against embedded X509 certificate fields.
• ssl.h: the header describing the protocol underneath OpenVPN.

Detailed usage lives in the man page and the HOWTO, both maintained on the project website rather than in the tree.

Two former parts of the source now live as their own subprojects, easy-rsa for certificate management and tap-windows6 for the Windows driver, while community MSI installers and Debian packages are built from the separate openvpn-build repository.

Firezone manages remote access for an organization of any size, replacing the flat network a traditional VPN hands out. Group based policies gate access to individual applications, to entire subnets and to everything in between, so one compromised laptop does not expose the rest.

It is built on WireGuard, with a Rust data plane that needs only a few megabytes of memory and an Elixir admin portal and control plane. Tunnels are established on the fly through hole punching, and traffic runs peer to peer and end to end encrypted rather than through Firezone's own infrastructure.

The product is organized around a small set of components.

• Gateways: deploy into your infrastructure, and two or more give automatic load balancing and failover.
• Relays: run STUN and TURN so peers can find each other behind NAT.
• Clients: cover macOS, iOS, Android, ChromeOS, Windows and Linux, in graphical and headless form.
• Identity: authenticates through email, Google Workspace, Okta, Entra ID or OIDC, with automatic user and group sync.
• Policy templates: ship MDM profiles for Windows and macOS fleet management.

Firezone is not a mesh network builder, a full router or firewall, or an IPSec server. The code is open under Apache 2.0 with the Elixir portal under the Elastic License 2.0, and the maintainers state that production self-hosting is not supported today because internal APIs move quickly, so running it yourself suits educational and hobby use while the managed cloud covers production.

Defguard collapses the usual pile of disconnected tools for identity, VPN access, authentication and network permissions into a single self-hosted platform. Nothing leaves your infrastructure, and the architecture is arranged to keep the attack surface small.

Three components split the responsibilities, with network segmentation between them. Core is the management plane holding identity, authentication, authorization and policy. Edge is the public-facing entry point exposing selected services. Gateway enforces access policy in front of protected resources. The code is dual licensed, AGPL for the open core and a separate license for enterprise components.

The capabilities line up with what a security team has to prove.

• WireGuard VPN: multiple locations with per-location access control, MFA per connection, self-service device setup, and kernel or userspace operation.
• Identity and access management: an internal OIDC provider for single sign-on, external OIDC through Google, Microsoft or a custom provider, and LDAP or Active Directory sync.
• Multi-factor authentication: TOTP, WebAuthn and FIDO2, email tokens and biometrics through the mobile app.
• Firewall: allow and deny rules per location by user or group, applied in real time.
• Activity log: an audit trail with filtering and search, and real-time SIEM streaming in the enterprise build.
• Clients: desktop apps for Linux, macOS and Windows, plus Android and iOS with QR code onboarding.

A one-line installer brings up an instance in minutes, though the documentation is blunt that it suits testing and evaluation only. Production work follows separate architecture and high-availability guidance, alongside published SBOMs, penetration test reports and architecture decision records.