The archive · Product Ideas · Product decision · 2021
Firezone rebuilds the corporate VPN server on WireGuard and opens the code
Firezone wrapped WireGuard in an admin UI and identity-aware policies so teams can run a fast VPN without OpenVPN's pain — launched on HN in 2021.
Firezone
What it had to solve
WireGuard had become the fast, modern VPN protocol, but running it for a team still meant editing config files, managing keys and hand-rolling the server — the work OpenVPN Access Server existed to remove, at the cost of speed and operational overhead. Firezone set out to be the open-source alternative: WireGuard underneath, an easy-to-run server on top.
How it works
Legacy corporate VPNs were built like routers: a hub-spoke appliance that every remote client tunnels through, configured by specialists and slow because all traffic pays the middleman's toll. Firezone's founding idea was that WireGuard had already fixed the transport, and what teams actually lacked was the server software around it — the web UI, the user and group management, the deployment story that OpenVPN Access Server provided with far worse speed and far more friction.
The launch, posted as a Show HN in September 2021, was exactly that missing control plane: an open-source, self-hosted WireGuard server whose creator said he built it to make hosting and managing your own WireGuard VPN server easier. Instead of a commercial appliance, anyone could pull the code, run the server, and let an admin UI generate and manage client configurations.
The project stayed open source under Apache 2.0 + Elastic 2.0 and evolved into a zero-trust access platform. Today's README describes gateways deployed to your own infrastructure, group-based policies that control access to individual applications or entire subnets, authentication and directory sync through Google Workspace, Okta, Entra ID or OIDC, and hole-punched peer-to-peer tunnels so traffic never routes through Firezone's infrastructure. Its comparison table sets the gap with legacy VPNs as five-minute setup versus hours, and three times the throughput.
The launch thread drew 183 points and 35 comments on 2021-09-28. Years later the public repository shows about 9.1k stars, 450 forks and over 11,000 commits, alongside a managed cloud edition with usage-based pricing and SOC 2 compliance — the open-source artifact grew into a commercial product without changing its license terms.
Why it lands
- Anchor on WireGuard, the protocol already winning on speed and cryptography, instead of inventing another tunnel protocol from scratch.
- Make the hard-won capability self-hostable and auditable: open source removed the trust question that stops teams from routing work traffic through a VPN vendor.
- Shift the abstraction from network to identity — policies tied to people and groups, not IP ranges — which turned a VPN appliance into a zero-trust access tool.
- Keep the deploy story embarrassingly simple, minutes not hours, so the person running the server needs no VPN specialist training.
What it did
The Show HN on 2021-09-28 drew 183 points and 35 comments. The repo has since grown to about 9.1k stars and 450 forks, and the project now sells a managed cloud edition beside the open-source code.
What you can take
Take the protocol everyone already trusts and sell the control plane around it: WireGuard solved speed, the product win was making identity-aware access deployable in minutes by an ordinary admin.
Since then
The public repository grew from the 2021 launch into a full product line: by the 2026 snapshot it held 11,482 commits, native clients for Windows, macOS, iOS, Android and Linux, a usage-based managed cloud (Starter free for six users, Team at $5 per user per month), SOC 2 Type I and II compliance, and a documentation site. The README's headline still sells the founding trade — WireGuard-based remote access faster than OpenVPN, zero-trust and peer-to-peer — and the FAQ keeps self-hosting available for educational and hobby use while production support ships with the managed service.
Sources
- Show HN: Firezone, an open-source WireGuard-based alternative to OpenVPN AS
- firezone/firezone — secure remote access built on WireGuard
spotted an error? The archive wants to know.
Your turn
You just read one. Describe the brief you are staring at, and see who has been given the same problem.
Free account · 3 free questions · no card