Open Source Twingate Alternatives

Tailscale states its purpose in one line: private WireGuard networks made easy. This repository holds the majority of that open source code, principally the tailscaled daemon and the tailscale command line tool, which together form a node on the network.

Coverage differs by platform. The daemon runs on Linux, Windows and macOS, and to varying degrees on FreeBSD and OpenBSD. The iOS and Android apps are built from this code too, though the mobile interface code lives elsewhere, and the GUI wrappers shipped for closed platforms are not themselves open source.

Distribution is spread across several places.

• Packages: prebuilt packages for a range of distributions and platforms, served by the project.
• Separate repositories: the Android app, the Synology package, the QNAP package and Chocolatey packaging each live on their own.
• Source builds: a go install of the two commands is enough for personal use.
• Distribution builds: packagers are asked to use the supplied script so commit IDs and version information end up inside the binaries, which keeps bug reports useful.

Building always requires the most recent Go release, and while the project maintains its own Go fork for releases, using that fork is not a requirement. Contributions are welcome with a filed bug and a Developer Certificate of Origin sign off on every commit. WireGuard is a registered trademark of Jason A. Donenfeld.

NetBird pairs a configuration-free peer-to-peer private network with a central access control system in one platform. Machines join an encrypted WireGuard overlay and reach each other directly, which removes the familiar work of opening ports, writing firewall rules and standing up VPN gateways for every site.

Every machine runs an agent that manages WireGuard locally and connects to a Management Service holding network state, peer addresses and configuration updates. Agents use ICE to discover candidates for direct connections, with a relay as fallback when no peer-to-peer path can be established.

Around that core sits the management surface an organization actually needs.

• Access control: Groups and rules, device posture checks and periodic re-authentication.
• Identity: SSO and MFA support, identity provider integrations and group sync through JWT.
• Routing: Routes into external networks, domain-based DNS routes, exit nodes and private DNS zones.
• Automation: A public API, setup keys for bulk provisioning, a Terraform provider and an Ansible collection.
• Visibility: Activity logging and traffic events, plus browser-based SSH and RDP to peers.

Clients cover Linux, macOS, Windows, Android, iOS, FreeBSD and appliance platforms including pfSense, OPNsense, OpenWRT, Synology and Raspberry Pi. Self-hosting needs a Linux VM with one CPU and two gigabytes of memory, public reachability on TCP 80 and 443 and UDP 3478, a public domain pointing at it, and Docker with the Compose plugin.

OpenVPN is a secure tunneling daemon, and this repository is the community source tree behind it, distributed under version 2 of the GNU General Public License. The README offers no product tour, only what an administrator needs to fetch the source, build it, and find the reference material that explains the rest.

Building follows the familiar Unix sequence. Unpack the release tarball, run configure, then make and make install, with the INSTALL file covering the details. Windows builds with MinGW or MSVC are described separately in the CMake readme, and released versions are published on the community downloads page rather than assembled by hand.

The source distribution ships samples worth reading before writing a configuration of your own.

• Sample config files: a collection of configurations and scripts taken from the project HOWTO.
• Sample keys: RSA keys and certificates for testing only, deliberately insecure and never for real deployments.
• verify-cn: a Perl script for the tls-verify option, showing a custom authentication test against embedded X509 certificate fields.
• ssl.h: the header describing the protocol underneath OpenVPN.

Detailed usage lives in the man page and the HOWTO, both maintained on the project website rather than in the tree.

Two former parts of the source now live as their own subprojects, easy-rsa for certificate management and tap-windows6 for the Windows driver, while community MSI installers and Debian packages are built from the separate openvpn-build repository.

Firezone manages remote access for an organization of any size, replacing the flat network a traditional VPN hands out. Group based policies gate access to individual applications, to entire subnets and to everything in between, so one compromised laptop does not expose the rest.

It is built on WireGuard, with a Rust data plane that needs only a few megabytes of memory and an Elixir admin portal and control plane. Tunnels are established on the fly through hole punching, and traffic runs peer to peer and end to end encrypted rather than through Firezone's own infrastructure.

The product is organized around a small set of components.

• Gateways: deploy into your infrastructure, and two or more give automatic load balancing and failover.
• Relays: run STUN and TURN so peers can find each other behind NAT.
• Clients: cover macOS, iOS, Android, ChromeOS, Windows and Linux, in graphical and headless form.
• Identity: authenticates through email, Google Workspace, Okta, Entra ID or OIDC, with automatic user and group sync.
• Policy templates: ship MDM profiles for Windows and macOS fleet management.

Firezone is not a mesh network builder, a full router or firewall, or an IPSec server. The code is open under Apache 2.0 with the Elixir portal under the Elastic License 2.0, and the maintainers state that production self-hosting is not supported today because internal APIs move quickly, so running it yourself suits educational and hobby use while the managed cloud covers production.

Defguard collapses the usual pile of disconnected tools for identity, VPN access, authentication and network permissions into a single self-hosted platform. Nothing leaves your infrastructure, and the architecture is arranged to keep the attack surface small.

Three components split the responsibilities, with network segmentation between them. Core is the management plane holding identity, authentication, authorization and policy. Edge is the public-facing entry point exposing selected services. Gateway enforces access policy in front of protected resources. The code is dual licensed, AGPL for the open core and a separate license for enterprise components.

The capabilities line up with what a security team has to prove.

• WireGuard VPN: multiple locations with per-location access control, MFA per connection, self-service device setup, and kernel or userspace operation.
• Identity and access management: an internal OIDC provider for single sign-on, external OIDC through Google, Microsoft or a custom provider, and LDAP or Active Directory sync.
• Multi-factor authentication: TOTP, WebAuthn and FIDO2, email tokens and biometrics through the mobile app.
• Firewall: allow and deny rules per location by user or group, applied in real time.
• Activity log: an audit trail with filtering and search, and real-time SIEM streaming in the enterprise build.
• Clients: desktop apps for Linux, macOS and Windows, plus Android and iOS with QR code onboarding.

A one-line installer brings up an instance in minutes, though the documentation is blunt that it suits testing and evaluation only. Production work follows separate architecture and high-availability guidance, alongside published SBOMs, penetration test reports and architecture decision records.

This repository holds the main userspace tooling for using and configuring WireGuard tunnels, chiefly the wg and wg-quick utilities. WireGuard itself encapsulates IP packets over UDP: you add an interface, configure it with your private key and your peers' public keys, then send packets across it.

The design goal is to be as easy to deploy as SSH. A connection is made by exchanging public keys, with no daemons to manage, no connection state to track, and roaming between IP addresses handled transparently. Key distribution and pushed configuration are deliberately out of scope, left to other layers rather than absorbed as IKE and OpenVPN absorbed them.

The choices behind the protocol are conservative and documented.

• Cryptography: the Noise protocol framework with Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24 and HKDF.
• Small surface: the implementation is meant to be auditable by one person, not a team of specialists.
• Performance: fast primitives inside the Linux kernel suit embedded devices and backbone routers alike.
• Ordinary interfaces: a tunnel appears as a normal network interface, configured with the usual address and route tools.
• Whitepaper: the protocol comes out of a documented academic process, with formal verification alongside.

Building the tools needs nothing beyond a C compiler and a sane libc, and installation honors the usual prefix, destdir and man directory variables, plus switches for bash completion, the wg-quick script and systemd units. Linux, OpenBSD, FreeBSD, macOS, Windows and Android are supported. The contrib directory carries scripts and examples meant as inspiration rather than production tools. It is released under GPLv2.