17 self-hosted Perimeter 81 alternatives

Headscale is an open source, self-hosted implementation of the Tailscale control server for managing a private tailnet, nodes, keys, IPs, and routes.

43.2k stars2.5k forksBSD-3-Clauselast commit 25 Aug 2026Actively maintained

Open-source zero-trust networking platform delivering a WireGuard-based private network with centralized access control, SSO/MFA, and cross-platform clients.

28.7k stars1.6k forkslast commit 26 Aug 2026Actively maintained

Run a WireGuard VPN server with an easy web admin UI to manage clients, generate configs and QR codes, and monitor connections and traffic.

26.8k stars2.6k forksAGPL-3.0last commit 25 Aug 2026Actively maintained

Open-source identity-based remote access platform combining WireGuard VPN and tunneled reverse proxy access with granular zero-trust controls.

22.5k stars765 forkslast commit 26 Aug 2026Actively maintained

CLI tool to create Cloudflare Tunnels and route traffic through Cloudflare’s edge.

15.4k stars1.4k forksApache-2.0last commit 26 Aug 2026Actively maintained

OAuth2 Proxy is a reverse proxy and middleware that protects web apps with OAuth2/OIDC login and forwards authenticated user identity to upstream services.

14.9k stars2.2k forksMITlast commit 24 Aug 2026Actively maintained

Open-source VPN client for desktop and mobile that can automatically set up a private VPN server and connect using WireGuard, OpenVPN, IKEv2, and obfuscated modes.

14.7k stars1.1k forksGPL-3.0last commit 24 Aug 2026Actively maintained

OpenVPN is a widely used open-source VPN daemon providing TLS/SSL-based secure tunneling, flexible client-server and site-to-site modes, and cross-platform support.

14.4k stars3.4k forkslast commit 26 Aug 2026Actively maintained

Firezone is a zero-trust VPN replacement built on WireGuard, providing identity-aware access policies, peer-to-peer encrypted tunnels, and lightweight gateways.

9k stars450 forksApache-2.0last commit 27 Aug 2026Actively maintained

iodine is a DNS tunneling tool that forwards IPv4 traffic through DNS queries and replies, providing a TUN interface to route IP traffic when only DNS is allowed.

8k stars596 forksISClast commit 4 Sept 2025Slowing down

Self-hosted transparent bastion host and PAM for SSH, HTTPS, MySQL and Postgres with RBAC, session recording, and SSO/2FA—no client-side software required.

7.7k stars356 forksApache-2.0last commit 26 Aug 2026Actively maintained

OPNsense is an open source FreeBSD-based firewall and routing platform with a web GUI, API, VPN, traffic shaping, and security features for networks and homelabs.

4.7k stars983 forksBSD-2-Clauselast commit 26 Aug 2026Actively maintained

OpenZiti is an open-source zero trust networking platform that builds an identity-based overlay mesh with SDKs, tunnelers, and policy-based access controls.

4.4k stars266 forksApache-2.0last commit 26 Aug 2026Actively maintained

Self-hosted web dashboard for WireGuard and AmneziaWG to manage configs, peers, and access with a simple UI and optional 2FA.

3.7k stars452 forksApache-2.0last commit 5 Jun 2026Actively maintained

Enterprise-grade zero-trust access management platform providing WireGuard VPN with true protocol-level 2FA/MFA, plus integrated OpenID Connect SSO and user/device controls.

2.8k stars110 forkslast commit 10 Aug 2026Actively maintained

Centralized SSH gateway to remotely manage Linux servers, containers and IoT devices via web or native SSH; offers key auth, firewall rules, audit logging and session recording.

2.1k stars188 forksApache-2.0last commit 26 Aug 2026Actively maintained

Self-hosted ingress platform that exposes internal HTTP/TCP services to the internet through reverse WireGuard tunnels, with NGINX routing and automatic TLS certificates.

1.6k stars77 forksApache-2.0last commit 19 Aug 2026Actively maintained