Blazing-fast remote access with identity-based policies, attested device trust, and detailed audit logs

Documentation | Quickstart | Download Clients | Support

Firezone is a secure remote access platform built on WireGuard®. Connect users to private applications, databases, servers, and subnets with granular policies that define who can access each Resource and under what conditions.

Combine identity-based access with cryptographic device verification and detailed audit records. Gateways run in your infrastructure, and the full product source is available for inspection in this repository.

Sign up free and follow the Quickstart to:

1. Deploy a Gateway in the network containing your Resources. See the Gateway sizing documentation for sizing and configuration guidance.
2. Define Resources and policies that grant access to the appropriate groups.
3. Install a Client, sign in, and connect to an authorized Resource.

For plan details and feature availability, see pricing.

The licenses permit self-hosting, subject to their terms. Production self-hosting is not officially supported. For development or evaluation, follow CONTRIBUTING.md to run a local environment.

Published Clients are only guaranteed to work with the managed service. Internal APIs change, and app store releases may lag behind this repository. A self-hosted portal may require Clients built from a compatible revision. Build instructions are available in swift/apple, kotlin/android, and rust/gui-client.

• Least-privilege access: Grant groups access to specific Resources through policies, including conditions that require device attestation.
• Device Trust: Require cryptographic device verification in addition to user authentication, using X.509 certificates issued by your MDM or enterprise PKI. Learn more.
• Audit Logs: Track configuration changes, sessions, API requests, and traffic flows with 90-day retention. Export records to your SIEM through Log Sinks. Learn more.
• Device Pools: Create a peer-to-peer mesh of devices with encrypted Client-to-Client WireGuard tunnels, without deploying a Gateway. Policies control which groups can reach the devices in each pool. Learn more.
• Identity provider integration: Authenticate with Google Workspace, Okta, Microsoft Entra ID, or OIDC. Directory sync keeps users and groups aligned with your identity provider.
• Encrypted connectivity: WireGuard tunnels encrypt traffic between Clients and Gateways or between devices in a Device Pool. Direct connections reduce routing overhead; Relays carry encrypted traffic when a direct connection cannot be established.
• Distributed deployment: Deploy Gateways near your Resources across cloud and on-premises environments. Use multiple Gateways for load balancing and failover.
• Cross-platform access: Clients are available for Windows, macOS, Linux, iOS, and Android, with headless clients for automated workloads.
• Compliance: The managed service is SOC 2 Type II compliant. See the Trust Center.

See the architecture documentation for details on the control plane, data plane, and connection lifecycle.

Firezone is committed to achieving the fastest possible speeds on every platform. Its shared Rust data plane combines WireGuard encryption with platform-specific I/O optimizations to reduce system calls, task wake-ups, and per-packet overhead.

Throughput varies with round-trip latency, packet loss, hardware, network capacity, and workload.

Firezone combines packet batching with each platform's available offloads to process more packets with fewer system calls and wake-ups.

• macOS and iOS: kqueue-backed readiness through Tokio/Mio, with batched sendmsg_x / recvmsg_x calls for both UDP sockets and the utun interface. A cache of connected UDP sockets enables Darwin's fast send path and flow advisories for active peers.
• Windows: Batched packet transfer to and from WinTUN, with support for TCP coalescing before injection into its ring buffer. UDP sockets use segmentation offload (USO) and receive coalescing (URO) where supported.
• Android: UDP GSO/GRO where supported by the device's kernel.
• Linux: UDP GSO/GRO plus TCP and UDP segmentation and checksum offloads on the TUN interface.

The bandwidth-delay product means throughput is a function of round-trip latency. Firezone keeps network paths short to minimize that latency.

Direct peer connections form on demand through a custom NAT traversal system optimized for time to first byte. By piggybacking connection establishment on the WireGuard handshake, connections to new peers are typically ready in 200 ms or less.

When a direct connection is unavailable, encrypted traffic flows through one of our 34 relay clusters worldwide. Relays combine eBPF/XDP and SR-IOV to process packets at line rate for most workloads.

This monorepo contains the Firezone product:

• Documentation: Deployment, configuration, and troubleshooting.
• GitHub Issues: Bug reports and feature requests.
• Support: Support options for your deployment.
• Contact sales: Enterprise requirements and deployment planning.

See CONTRIBUTING.md for development setup, code guidelines, testing, and the pull request process. Browse help wanted issues for contribution opportunities.

To report a vulnerability, follow SECURITY.md. Do not report security vulnerabilities through public GitHub issues.

Portions of this software are licensed as follows:

• All content residing under the "elixir/" directory of this repository, if that directory exists, is licensed under the "Elastic License 2.0" license defined in "elixir/LICENSE".
• All third party components incorporated into the Firezone Software are licensed under the original license provided by the owner of the applicable component.
• Content outside of the above mentioned directories or restrictions above is available under the "Apache 2.0 License" license as defined in "LICENSE".

WireGuard® is a registered trademark of Jason A. Donenfeld.