Overview
Firezone is a secure remote access
platform built on WireGuard®. Connect users to private applications, databases,
servers, and subnets with granular policies that define who can access each
Resource and under what conditions.
Combine identity-based access with cryptographic device verification and detailed
audit records. Gateways run in your infrastructure, and the full product source
is available for inspection in this repository.
Getting Started
Cloud (recommended)
Sign up free and follow
the Quickstart to:
- Deploy a Gateway in the network containing your Resources.
See the Gateway sizing documentation
for sizing and configuration guidance.
- Define Resources and policies that grant access to the appropriate groups.
- Install a Client, sign in, and connect to an authorized Resource.
For plan details and feature availability, see pricing.
Self-hosting
The licenses permit self-hosting, subject to their terms. Production
self-hosting is not officially supported. For development or evaluation, follow
CONTRIBUTING.md to run a local environment.
Published Clients are only guaranteed to work with the managed service. Internal
APIs change, and app store releases may lag behind this repository. A self-hosted
portal may require Clients built from a compatible revision. Build instructions
are available in swift/apple,
kotlin/android, and rust/gui-client.
Features
- Least-privilege access: Grant groups access to specific Resources through
policies, including conditions that require device attestation.
- Device Trust: Require cryptographic device verification in addition to user
authentication, using X.509 certificates issued by your MDM or enterprise PKI.
Learn more.
- Audit Logs: Track configuration changes, sessions, API requests, and traffic
flows with 90-day retention. Export records to your SIEM through Log Sinks.
Learn more.
- Device Pools: Create a peer-to-peer mesh of devices with encrypted
Client-to-Client WireGuard tunnels, without deploying a Gateway. Policies
control which groups can reach the devices in each pool.
Learn more.
- Identity provider integration: Authenticate with Google Workspace, Okta,
Microsoft Entra ID, or OIDC. Directory sync keeps users and groups aligned with
your identity provider.
- Encrypted connectivity: WireGuard tunnels encrypt traffic between Clients
and Gateways or between devices in a Device Pool. Direct connections reduce
routing overhead; Relays carry encrypted traffic when a direct connection
cannot be established.
- Distributed deployment: Deploy Gateways near your Resources across cloud
and on-premises environments. Use multiple Gateways for load balancing and
failover.
- Cross-platform access: Clients are available for Windows, macOS, Linux,
iOS, and Android, with headless clients for automated workloads.
- Compliance: The managed service is SOC 2 Type II compliant.
See the Trust Center.
See the architecture documentation
for details on the control plane, data plane, and connection lifecycle.
Performance
Firezone is committed to achieving the fastest possible speeds on every platform.
Its shared Rust data plane combines WireGuard encryption with platform-specific
I/O optimizations to reduce system calls, task wake-ups, and per-packet overhead.
Throughput
| Platform | Throughput (as tested) |
|---|
| iOS | 2+ Gbps |
| Android | 2+ Gbps |
| Windows | 5+ Gbps |
| macOS | 5+ Gbps |
| Linux | 5+ Gbps on commodity VMs / 10+ Gbps on tuned hardware |
Throughput varies with round-trip latency, packet loss, hardware, network capacity,
and workload.
Platform-specific optimizations
Firezone combines packet batching with each platform's available offloads to
process more packets with fewer system calls and wake-ups.
- macOS and iOS: kqueue-backed readiness through Tokio/Mio, with batched
sendmsg_x / recvmsg_x calls for both UDP sockets and the utun interface.
A cache of connected UDP sockets enables Darwin's fast send path and flow
advisories for active peers.
- Windows: Batched packet transfer to and from WinTUN, with support for TCP
coalescing before injection into its ring buffer. UDP sockets use segmentation
offload (USO) and receive coalescing (URO) where supported.
- Android: UDP GSO/GRO where supported by the device's kernel.
- Linux: UDP GSO/GRO plus TCP and UDP segmentation and checksum offloads on
the TUN interface.
Network path optimizations
The bandwidth-delay product
means throughput is a function of round-trip latency. Firezone keeps network
paths short to minimize that latency.
Direct peer connections form on demand through a custom NAT traversal system
optimized for time to first byte. By piggybacking connection
establishment on the WireGuard handshake, connections to new peers are typically
ready in 200 ms or less.
When a direct connection is unavailable, encrypted traffic flows through one of
our 34 relay clusters worldwide. Relays combine eBPF/XDP and SR-IOV to process
packets at line rate for most workloads.
Repository structure
This monorepo contains the Firezone product:
Documentation and support
Contributing
See CONTRIBUTING.md for development setup, code guidelines,
testing, and the pull request process. Browse
help wanted issues
for contribution opportunities.
Star History
Security
To report a vulnerability, follow SECURITY.md. Do not report
security vulnerabilities through public GitHub issues.
License
Portions of this software are licensed as follows:
- All content residing under the "elixir/" directory of this repository, if that
directory exists, is licensed under the "Elastic License 2.0" license defined
in "elixir/LICENSE".
- All third party components incorporated into the Firezone Software are
licensed under the original license provided by the owner of the applicable
component.
- Content outside of the above mentioned directories or restrictions above is
available under the "Apache 2.0 License" license as defined in "LICENSE".
WireGuard® is a registered trademark of Jason A. Donenfeld.
