Headscale is an open source, self-hosted implementation of the Tailscale control server for managing a private tailnet, nodes, keys, IPs, and routes.
43.2k stars2.5k forksBSD-3-Clauselast commit Actively maintained
8 self-hosted Cloudflare WARP alternatives
Cloudflare WARP is a secure VPN client and Zero Trust connector that routes device traffic through Cloudflare's network to encrypt connections, apply DNS and content filtering, and enforce access and identity-based policies for internet and corporate resource access.
Alternatives to Cloudflare WARP
#2
Open-source zero-trust networking platform delivering a WireGuard-based private network with centralized access control, SSO/MFA, and cross-platform clients.
28.7k stars1.6k forkslast commit Actively maintained
#3
Open-source identity-based remote access platform combining WireGuard VPN and tunneled reverse proxy access with granular zero-trust controls.
22.5k stars765 forkslast commit Actively maintained
#4
Open-source VPN client for desktop and mobile that can automatically set up a private VPN server and connect using WireGuard, OpenVPN, IKEv2, and obfuscated modes.
14.7k stars1.1k forksGPL-3.0last commit Actively maintained
#5
OpenVPN is a widely used open-source VPN daemon providing TLS/SSL-based secure tunneling, flexible client-server and site-to-site modes, and cross-platform support.
14.4k stars3.4k forkslast commit Actively maintained
#6
Firezone is a zero-trust VPN replacement built on WireGuard, providing identity-aware access policies, peer-to-peer encrypted tunnels, and lightweight gateways.
9k stars450 forksApache-2.0last commit Actively maintained
#7
OpenZiti is an open-source zero trust networking platform that builds an identity-based overlay mesh with SDKs, tunnelers, and policy-based access controls.
4.4k stars266 forksApache-2.0last commit Actively maintained
#8
Self-hosted ingress platform that exposes internal HTTP/TCP services to the internet through reverse WireGuard tunnels, with NGINX routing and automatic TLS certificates.
1.6k stars77 forksApache-2.0last commit Actively maintained
What replacing Cloudflare WARP actually involves
Every option on this page is open source and free to run on your own hardware, so you own the data and there is no subscription to cancel. 8 of 8 shipped a commit in the last six months. Licences in this list: BSD-3-Clause, GPL-3.0, Apache-2.0. In exchange you take on hosting, backups and updates yourself.
Browse everything in Network Security (VPN, Firewall, WAF).
