Open Source Zscaler Alternatives

Tailscale states its purpose in one line: private WireGuard networks made easy. This repository holds the majority of that open source code, principally the tailscaled daemon and the tailscale command line tool, which together form a node on the network.

Coverage differs by platform. The daemon runs on Linux, Windows and macOS, and to varying degrees on FreeBSD and OpenBSD. The iOS and Android apps are built from this code too, though the mobile interface code lives elsewhere, and the GUI wrappers shipped for closed platforms are not themselves open source.

Distribution is spread across several places.

• Packages: prebuilt packages for a range of distributions and platforms, served by the project.
• Separate repositories: the Android app, the Synology package, the QNAP package and Chocolatey packaging each live on their own.
• Source builds: a go install of the two commands is enough for personal use.
• Distribution builds: packagers are asked to use the supplied script so commit IDs and version information end up inside the binaries, which keeps bug reports useful.

Building always requires the most recent Go release, and while the project maintains its own Go fork for releases, using that fork is not a requirement. Contributions are welcome with a filed bug and a Developer Certificate of Origin sign off on every commit. WireGuard is a registered trademark of Jason A. Donenfeld.

Pangolin connects users to private resources and decides what each may reach, in one system. The large commercial platforms got that pairing right but shipped it as a heavyweight closed stack locked to their cloud. Pangolin unifies the same way in the open, on infrastructure you choose.

It is built on WireGuard. Site connectors open outbound tunnels with NAT traversal, so a network behind a restrictive firewall becomes reachable without public IPs or open ports, from a user space binary light enough for modest hardware. Sites, proxy, client access, role based control and the AI gateway share one identity and policy model.

Access reaches resources along several paths.

• Browser based proxy: HTTPS apps plus VNC, RDP and SSH sessions open in a browser with single sign-on and no client to install.
• Client tunnels: peer to peer access to SSH servers, databases, RDP and whole network ranges, with DNS aliases for friendly names.
• Zero trust policy: access is granted per resource, not per network, with identity provider sync, role based access control and audit logs.
• AI gateway: an identity aware proxy fronts cloud and self-hosted model servers, with budgets, session history and usage analytics on each call.
• Traffic handling: routing, load balancing, health checks and automatic SSL certificates are handled for you.

The Community Edition is free under AGPL-3. An open core Enterprise Edition adds more features and stays free for personal use and for businesses under 100,000 dollars of annual revenue, while Pangolin Cloud is hosted for you. Self-hosting starts from the quick install guide or a DigitalOcean image.

OpenVPN is a secure tunneling daemon, and this repository is the community source tree behind it, distributed under version 2 of the GNU General Public License. The README offers no product tour, only what an administrator needs to fetch the source, build it, and find the reference material that explains the rest.

Building follows the familiar Unix sequence. Unpack the release tarball, run configure, then make and make install, with the INSTALL file covering the details. Windows builds with MinGW or MSVC are described separately in the CMake readme, and released versions are published on the community downloads page rather than assembled by hand.

The source distribution ships samples worth reading before writing a configuration of your own.

• Sample config files: a collection of configurations and scripts taken from the project HOWTO.
• Sample keys: RSA keys and certificates for testing only, deliberately insecure and never for real deployments.
• verify-cn: a Perl script for the tls-verify option, showing a custom authentication test against embedded X509 certificate fields.
• ssl.h: the header describing the protocol underneath OpenVPN.

Detailed usage lives in the man page and the HOWTO, both maintained on the project website rather than in the tree.

Two former parts of the source now live as their own subprojects, easy-rsa for certificate management and tap-windows6 for the Windows driver, while community MSI installers and Debian packages are built from the separate openvpn-build repository.

Firezone manages remote access for an organization of any size, replacing the flat network a traditional VPN hands out. Group based policies gate access to individual applications, to entire subnets and to everything in between, so one compromised laptop does not expose the rest.

It is built on WireGuard, with a Rust data plane that needs only a few megabytes of memory and an Elixir admin portal and control plane. Tunnels are established on the fly through hole punching, and traffic runs peer to peer and end to end encrypted rather than through Firezone's own infrastructure.

The product is organized around a small set of components.

• Gateways: deploy into your infrastructure, and two or more give automatic load balancing and failover.
• Relays: run STUN and TURN so peers can find each other behind NAT.
• Clients: cover macOS, iOS, Android, ChromeOS, Windows and Linux, in graphical and headless form.
• Identity: authenticates through email, Google Workspace, Okta, Entra ID or OIDC, with automatic user and group sync.
• Policy templates: ship MDM profiles for Windows and macOS fleet management.

Firezone is not a mesh network builder, a full router or firewall, or an IPSec server. The code is open under Apache 2.0 with the Elixir portal under the Elastic License 2.0, and the maintainers state that production self-hosting is not supported today because internal APIs move quickly, so running it yourself suits educational and hobby use while the managed cloud covers production.