Dev tools · September 28, 2021
Firezone, an open-source WireGuard-based alternative to OpenVPN AS
I created Firezone to make it easier to host and manage your own WireGuard VPN server. While working at Cisco as a security automation engineer I experienced a lot of unnecessary pain managing secure network-level access into our cloud VPCs. I tried OpenVPN Access Server but I personally feel that security software should be open source to be validated (and improved) by the community. I discovered WireGuard and quickly fell in love with it, but soon found managing the peer configs to be a bit tedious and error-prone. So I built some convenience functionality on top, added a simple Web UI,…
What it does
In the maker’s words, at launch
I created Firezone to make it easier to host and manage your own WireGuard VPN server. While working at Cisco as a security automation engineer I experienced a lot of unnecessary pain managing secure network-level access into our cloud VPCs. I tried OpenVPN Access Server but I personally feel that security software should be open source to be validated (and improved) by the community. I discovered WireGuard and quickly fell in love with it, but soon found managing the peer configs to be a bit tedious and error-prone. So I built some convenience functionality on top, added a simple Web UI, and open sourced it. Firezone is packaged with Chef Omnibus so the only dependencies are a recent Linux kernel (4.19+) and the WireGuard module. The Web UI is built with Elixir/Phoenix (I’m a recovering full-stack Rails engineer) and runs as an unprivileged user. The Web UI communicates with two other Elixir applications that manage the WireGuard configuration and firewall configuration respectively. I built it this way to allow potentially decoupling the Web UI, VPN, and firewall hosts at some point in the future, but for now Firezone assumes they’re all running on the same host. The firewall application is essentially a frontend to nftables and currently functions as a simple egress firewall to block outbound traffic to specific hosts/CIDRs (in your private network or elsewhere). In the near term I’m planning to polish it up a bit and add more security features. Longer-term I’d like to add things like DNS-based ad blocking, IP blocklist support, LDAP / SSO authentication, and more user management features. I wanted to show it here and see what HN thinks. Hope you find it useful!
Does the same job
all alternatives →
- DADsnet, a simple command to manage a centralised WireGuard VPN2020 · github.com · ▲69
- SASmokeVPN – All-in-One WireGuard VPN Hub – Switch Exits in RealtimeAug 2026 · smokevpn.com · ▲9
I have started developing a prototype of a WireGuard VPN hub, where I could set a custom exit to a specific device, for example, my TV box would use a VPN in Germany, while my desktop a VPN is Serbia and I could switch the exit in realtime without having to stop the VPN connections and consequently no disconnections (ssh, etc). The project grew, and I ended up adding SOCKS5 and HTTP proxy, Tor exits, exit pools, random exits, timed exits, and exits/routes based on domains or IP addresses. I also added an in-house DNS with several default block lists (malware, gambling, social media,…
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, September 2021
the whole month →- 4H
Life & fun · 2021 · hacker-recommended-books.vercel.app
- WB
Life & fun · 2021 · bonsaibrowser.com
LetterHunt▲77410,000+ active, curated newsletters to promote your product
Growth · 2021 · letterhunt.co
Noto▲739Create a Notion-style avatar with 120+ mix-and-match items
Work · 2021 · abstractlab.gumroad.com