[opensourcedex]

FireZone is a free, open source network security project written in Elixir and released under Apache-2.0. It has 9,097 GitHub stars, 456 forks and 412 open issues, and was last pushed 20 hours ago. On this registry it ranks #4 of 7 tracked projects in Network Security, with 5 head-to-head comparisons available. It gained 12 stars over the last 6 tracked days.

What is FireZone?

What it is

FireZone is an enterprise-ready zero-trust access platform built on WireGuard. It connects users to private applications, databases, servers, and subnets through granular policies that define who can reach each Resource and under what conditions. It lives in the Security & Privacy / Network Security ecosystem, with Elixir, Phoenix LiveView, and Rust components indicated by repository topics and language metadata.

As a VPN replacement, FireZone addresses remote access that is too broad or too hard to audit. It combines identity-based access, cryptographic device verification, detailed audit records, and Gateways that run in the infrastructure containing Resources, with full product source available in the repository.

Key capabilities

  • Grants least-privilege access to Resources through group policies, including conditions that require device attestation.
  • Requires cryptographic device trust using X.509 certificates from an MDM or enterprise PKI, plus user authentication.
  • Tracks configuration changes, sessions, API requests, and traffic flows in audit logs with 90-day retention and SIEM export through Log Sinks.
  • Forms Device Pools with encrypted Client-to-Client WireGuard tunnels without a Gateway, while policies control group access to pooled devices.
  • Integrates Google Workspace, Okta, Microsoft Entra ID, and OIDC, and syncs users and groups from the identity provider.
  • Deploys Gateways near Resources across cloud and on-premises environments, with direct connections when possible and Relays when needed.

Who uses it and how

  • Teams connect users to private applications, databases, servers, and subnets by deploying a Gateway in the Resource network, defining Resources, assigning policies to groups, and having users sign in from a Client.
  • Security teams require X.509 device trust from an MDM or enterprise PKI before access, then review configuration changes, sessions, API requests, and traffic flows in audit logs exported to a SIEM.
  • Operators place multiple Gateways near cloud or on-premises Resources to distribute connections and provide failover, while users or automation use Device Pools and headless Clients for Client-to-Client or automated workload access.

Getting started

Cloud use starts by signing up free, deploying a Gateway in the Resource network, defining Resources and policies, and installing a Client to sign in and connect. Self-hosting is permitted by the Apache-2.0 license for development or evaluation through CONTRIBUTING.md, but production self-hosting is not officially supported, and published Clients are only guaranteed with the managed service.

When to use it — and when not to

Use FireZone when you need WireGuard-based zero-trust remote access with identity provider groups, device trust, audit logs, and Gateways near Resources. Avoid it if you require a fully supported self-hosted production deployment, because production self-hosting is not officially supported, published Clients are only guaranteed with the managed service, internal APIs change, and app store releases may lag behind the repository. The 412 open issues also warrant a maintenance review.

project readme (upstream, from github) — read inline

Firezone logo

Blazing-fast remote access with identity-based policies, attested device trust, and detailed audit logs

Documentation | Quickstart | Download Clients | Support

firezoneGitHub commit activity GitHub closed issues X (formerly Twitter) Follow

Overview

Firezone is a secure remote access platform built on WireGuard®. Connect users to private applications, databases, servers, and subnets with granular policies that define who can access each Resource and under what conditions.

Combine identity-based access with cryptographic device verification and detailed audit records. Gateways run in your infrastructure, and the full product source is available for inspection in this repository.

Firezone component diagram

Getting Started

Cloud (recommended)

Sign up free and follow the Quickstart to:

  1. Deploy a Gateway in the network containing your Resources.
  2. Define Resources and policies that grant access to the appropriate groups.
  3. Install a Client, sign in, and connect to an authorized Resource.

For plan details and feature availability, see pricing.

Self-hosting

The licenses permit self-hosting, subject to their terms. Production self-hosting is not officially supported. For development or evaluation, follow CONTRIBUTING.md to run a local environment.

Published Clients are only guaranteed to work with the managed service. Internal APIs change, and app store releases may lag behind this repository. A self-hosted portal may require Clients built from a compatible revision. Build instructions are available in swift/apple, kotlin/android, and rust/gui-client.

Features

  • Least-privilege access: Grant groups access to specific Resources through policies, including conditions that require device attestation.
  • Device Trust: Require cryptographic device verification in addition to user authentication, using X.509 certificates issued by your MDM or enterprise PKI. Learn more.
  • Audit Logs: Track configuration changes, sessions, API requests, and traffic flows with 90-day retention. Export records to your SIEM through Log Sinks. Learn more.
  • Device Pools: Create a peer-to-peer mesh of devices with encrypted Client-to-Client WireGuard tunnels, without deploying a Gateway. Policies control which groups can reach the devices in each pool. Learn more.
  • Identity provider integration: Authenticate with Google Workspace, Okta, Microsoft Entra ID, or OIDC. Directory sync keeps users and groups aligned with your identity provider.
  • Encrypted connectivity: WireGuard tunnels encrypt traffic between Clients and Gateways or between devices in a Device Pool. Direct connections reduce routing overhead; Relays carry encrypted traffic when a direct connection cannot be established.
  • Distributed deployment: Deploy Gateways near your Resources across cloud and on-premises environments. Use multiple Gateways for load balancing and failover.
  • Cross-platform access: Clients are available for Windows, macOS, Linux, iOS, and Android, with headless clients for automated workloads.
  • Compliance: The managed service is SOC 2 Type II compliant. See the Trust Center.

See the architecture documentation for details on the control plane, data plane, and connection lifecycle.

Performance

  • Latency: Direct Client-to-Gateway connections avoid a central traffic hub. Relays provide connectivity when a direct path is unavailable.
  • Scaling: Add Gateways to distribute connections and increase aggregate capacity. Deploy them near Resources to keep traffic paths short.

Throughput and memory usage depend on hardware, network conditions, and workload. See the Gateway sizing documentation for sizing and configuration guidance.

Repository structure

This monorepo contains the Firezone product:

Directory Contents
elixir Admin portal and control plane
rust Data plane and shared Rust libraries
rust/gateway WireGuard tunnel server for your infrastructure
rust/relay STUN/TURN relay for connection establishment
rust/headless-client Headless client
rust/gui-client Windows and Linux GUI client
swift/apple macOS and iOS clients
kotlin/android Android and ChromeOS clients
policy-templates MDM policy templates for Windows and macOS

The marketing website and product documentation live in firezone/website.

Documentation and support

Contributing

See CONTRIBUTING.md for development setup, code guidelines, testing, and the pull request process. Browse help wanted issues for contribution opportunities.

Star History

Star History Chart

Security

To report a vulnerability, follow SECURITY.md. Do not report security vulnerabilities through public GitHub issues.

License

Portions of this software are licensed as follows:

  • All content residing under the "elixir/" directory of this repository, if that directory exists, is licensed under the "Elastic License 2.0" license defined in "elixir/LICENSE".
  • All third party components incorporated into the Firezone Software are licensed under the original license provided by the owner of the applicable component.
  • Content outside of the above mentioned directories or restrictions above is available under the "Apache 2.0 License" license as defined in "LICENSE".

WireGuard® is a register

readme truncated — read the full docs on github

Frequently asked questions

Is FireZone free to use?

FireZone is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does FireZone do?

Fast, flexible VPN replacement with zero-trust security

What is FireZone written in?

FireZone is primarily written in Elixir. Its source is publicly available at https://github.com/firezone/firezone, and it has 9,097 GitHub stars.