firezone/firezone
Firezone
Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers.
The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports.
The platform includes a control plane for managing network gateways and access policies, with support for multi-gateway load balancing and containerized deployment. It provides capabilities for network access auditing, user activity tracking, and the management of secure remote infrastructure.
Features
- WireGuard VPN Support - Uses the WireGuard protocol to create high-performance, encrypted peer-to-peer network tunnels for secure data transport.
- Secure Remote Access - Implements a zero-trust system for establishing encrypted tunnels and authenticated communication to private network resources.
- Control Planes - Implements a control plane that decouples administrative policy orchestration from the data plane handling network traffic.
- NAT Traversal Mechanisms - Uses relay protocols to establish outbound connections through firewalls, bypassing the need for inbound ports.
- NAT Traversal - Utilizes holepunching to establish direct peer-to-peer connections by bypassing restrictive firewall rules.
- Secure Tunnel Clients - Provides clients to establish and manage encrypted peer-to-peer connections to remote network gateways.
- WireGuard Management - Provides a central interface for configuring and monitoring WireGuard VPN tunnels and peer keys.
- Identity Synchronization - Automatically imports and updates user lists and group memberships from external identity providers.
- Encrypted Tunneling - Builds end-to-end encrypted network tunnels using holepunching to ensure private connectivity.
- Identity Authentication - Verifies user identities and synchronizes group memberships through integration with external single sign-on providers.
- Identity-Based Access Control - Enforces network-level access control by mapping user identities and groups to specific resource permissions.
- Identity Provider Integrations - Synchronizes user authentication and group memberships by integrating with external OIDC and LDAP identity services.
- Identity-Based VPNs - Provides a virtual private network that synchronizes authentication and group memberships via OpenID Connect.
- Zero Trust Access - Implements an identity-based access framework that replaces traditional VPNs with zero-trust connectivity.
- Zero Trust Networking - Implements a zero-trust security model to provide identity-based access for all network communication.
- Access Policy Managers - Provides a system to manage network access policies and connectivity rules using group-based restrictions.
- Group-Based - Enforces least privilege by restricting network resource availability based on identity provider group memberships.
- Gateway Token Authentication - Links network resources to a central control plane using unique identity tokens and environment settings.
- Container Deployment - Provides containerized images for the management server and network gateways to ensure consistent deployment across environments.
- Load Balancers - Distributes network traffic across multiple gateway instances to ensure high availability and increase throughput.
- Network Gateways - Deploys scalable network gateways that act as endpoints for managing encrypted traffic flow.
- Peer-to-Peer Tunneling - Establishes direct encrypted connections between peers using holepunching to reduce routing overhead.
- Remote Access Connectivity - Provides dedicated applications for Apple devices to establish secure remote connectivity to internal resources.
- Traffic Management Gateways - Uses multiple network gateways to distribute traffic and maintain high throughput for remote connections.
- Access Auditing - Maintains detailed audit logs of user connections and administrative changes for security compliance.
- Network and Infrastructure Security - Deploys and scales network gateways to protect internal subnets and applications from public exposure.
- Activity Monitors - Maintains detailed audit trails of network events to monitor for security threats and meet regulatory compliance.
- Administrative Change Auditing - Maintains a verifiable history of administrative changes and configuration updates within the network control plane.
- Virtual Network GUIs - Provides a visual interface for managing secure network connections across multiple desktop operating systems.
- DevOps and Infrastructure - Zero-trust access platform built on WireGuard.
- Networking and Infrastructure - Self-hosted VPN server and firewall.
- Overlay Networks - WireGuard-based network gateway with SSO authentication support.
- Cloud Security - VPN server and firewall management for teams.
- Cybersecurity - VPN server and firewall solution for teams.
- Security and Compliance - VPN and firewall built on WireGuard.
- VPN and Networking - WireGuard-based VPN server and firewall.
- VPN and Privacy - WireGuard-based VPN server and egress firewall.
