Self-hosted VPN: WireGuard, OpenVPN, and Tailscale alternatives
Commercial VPNs charge $5-15/mo per device and you trust them with all your traffic. Self-hosted WireGuard, OpenVPN, and Headscale (Tailscale alternative) give you a private mesh on a $4/mo VPS. The open-source VPN options ranked by maintainer health.
The 13 picks, ranked by health
Health score is a 6-dimension composite. See methodology.
Identity-aware VPN and tunneled reverse proxy for remote access based on WireGuard®.
Pomerium is an identity and context-aware access proxy.
Enterprise-ready zero-trust access platform built on WireGuard®.
The Mullvad VPN client app for desktop and mobile
The parent project for OpenZiti. Here you will find the executables for a fully zero-trust, programmable network @OpenZiti
DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.
A simple, decentralized mesh VPN with WireGuard support.
Zero-Trust access management with true WireGuard® 2FA/MFA
tun2socks - powered by gVisor TCP/IP stack
Userspace WireGuard® Implementation in Rust
Official git repo for iodine dns tunnel
A multi-protocol proxy server written in Rust (HTTP, SOCKS5, Vmess, Vless, Shadowsocks, Trojan, Snell, Hysteria2, TUIC v5, AnyTLS, Naiveproxy, XTLS)
A secure, efficient TCP/UDP tunneling solution that delivers fast, reliable access across network restrictions using pre-established TCP/QUIC/WebSocket or HTTP/2 connections.
Specifically replacing
These categories on ossreplace cover the SaaS in this space.
Ready to self-host?
Most operators land on pangolin (top health) and run it on hetzner for around $4.13/mo.