Self-Hosted

Most people think a strong WiFi password is enough to keep their home network safe. But here’s the thing — once a device joins your network, consumer routers treat it like family. Your smart TV, your kid’s tablet, your IoT light bulb — they all get the same network access as your work computer. But SPR (Secure Programmable Router) by Supernetworks approaches this differently. It gives every single device its own isolated /30 subnet with a unique WPA3 passphrase. No device can talk to another unless you explicitly allow it. And it runs on a Raspberry Pi 4 or 5, or their pre-built Compute Board ($399.99). ...

Netbird connects two machines at 890 Mbps over a 1 Gbps fiber link with just 11% WireGuard overhead — but here’s the real test: what happens when you throw SSO, device posture checks, and quantum-resistant encryption into the same stack. But most mesh VPNs make you pick between self-hosted simplicity and enterprise access controls. Netbird is the first one that doesn’t. And it hit v0.74.2 on July 3, 2026 — two days before this review — and sits at 26,751 stars on GitHub. We ran it through our full test suite: deployment, speed benchmarks across three server locations, SSO integration, DNS leak checks, and a direct comparison against Tailscale and Headscale. Here’s what we found. When you purchase through our links, we may earn a commission. Thanks for supporting our independent testing! ...

Starting a Docker container should be enough to make it reachable over Tailscale. That’s the idea behind TSDProxy (almeidapaulopt/tsdproxy) — and it actually delivers. But traditional reverse proxies ask for config files, certificate resolvers, entrypoints, and network setup before you see a single service online. TSDProxy skips all that. Add one label to a container, and it gets https://<name>.<tailnet>.ts.net automatically. No sidecars, no reverse proxy config, no manual SSL work. ...

WireGuard is fast, modern, and refreshingly simple. And you’re connected within seconds — set a private key, configure a peer. But simplicity has a blind spot — there’s no multi-factor authentication. If a private key leaks, your VPN is wide open. WAG changes that. What Is WAG? — WireGuard MFA Gateway But WAG (NHAS/wag, v9.1.10) is a self-hosted authentication gateway that plugs directly into WireGuard. So you get security keys (WebAuthn), SSO (OIDC), system authentication (PAM), and TOTP codes — all from one gateway. Think of it as a focused MFA layer for teams already running WireGuard, not a full zero-trust platform, just the authentication piece that WireGuard leaves out. ...

The traditional VPN is dying. Not hyperbole — enterprise security teams are actively replacing perimeter-based access with zero-trust architectures. And Firezone is one of the most compelling open-source options in this space right now. After spending a week testing it on a $6 DigitalOcean VPS, here’s what stood out — and what didn’t. So first, the one-liner: Firezone is an open-source (Apache 2.0) zero-trust access platform built entirely on WireGuard. It gives teams resource-level access control with default-deny policies, SSO sync from Google Workspace or Microsoft Entra ID, and NAT hole-punching. You self-host it on a cheap VPS, or go with their managed cloud tier. Either way, the same Gateways work in both modes — so migrating later doesn’t hurt. ...

Sure, WireGuard is easy to set up — two key pairs, a config file, and wg-quick up gets you a tunnel in under a minute. But managing multiple clients? Adding a phone, a laptop, a travel router, revoking access — that’s where the friction lives. You end up manually editing configs, generating keys, bumping IPs in the address range. For a 5-device road warrior setup, it’s doable but tedious. But anything bigger than a handful of devices? Total headache. ...

Firezone: open-source zero-trust via WireGuard with Docker self-hosted deploy. Quick review of features, pricing, and comparison to Tailscale and Netbird.