Open-source alternatives to Business VPNs

If your team works from home even part of the time, you probably need a way into the office systems that doesn't involve leaving the front door open. That's what a business VPN does. There are plenty of paid ones, and the prices look small until you add them up.

NordLayer Core is $11 a person a month on a yearly plan, with a five-person minimum, plus $40 a month for the dedicated IP server it requires. For five people that's about $1,140 a year, or around £864. Tailscale Standard is $8 a person a month. These are decent products, and for lots of firms that's a fair price. But the technology underneath is open source, and you can run it yourself.

NetBird

NetBird builds a private network between your laptops, phones and servers, on top of WireGuard, and gives you a dashboard to manage it.

• A proper web dashboard. Add people, add machines and set who can reach what, without touching a config file.
• Sign-in sorted. There's a built-in identity server for local users, or you can connect Google, Microsoft or Okta. So when someone leaves, you turn them off in one place.
• Access rules. Sales can reach the CRM without being able to reach the accounts server.
• Direct connections. Machines connect to each other wherever they can, rather than dragging all the traffic through one central box.
• A cloud version if you'd rather. Up to 5 users free, then from €6 a user a month, so you can try it before self-hosting.

The self-hosted setup needs a Linux server with at least 1 CPU and 2 GB of memory, a domain name, Docker, and ports 80, 443 and UDP 3478 open. That server has to be reachable from the internet, because it's what coordinates everything. The client side is BSD licensed, and the server is AGPL.

Do check the feature list if you need the advanced bits. On the cloud version, things like device posture checks and traffic logging sit in the paid Business plan, and NetBird's site didn't make clear what a free self-hosted install includes.

WireGuard

WireGuard is the engine the others are built on. It's a small, fast VPN that runs inside the Linux kernel, with clients for Windows, Mac, BSD, iPhone and Android.

It works a bit like SSH keys. Each device has a public key, you tell each end about the other, and the tunnel just works. It uses modern cryptography, and there's far less to go wrong than with older VPNs. For a link between two offices or a few people reaching one server, it's lovely.

The catch is that WireGuard deliberately doesn't do management. Sharing keys and pushing out settings are your job. There's no dashboard, no user accounts and no single sign-on. When somebody leaves, somebody has to remove their key by hand. That's fine for 3 people, and tedious for 30.

Headscale

Headscale is a self-hosted, open-source version of Tailscale's control server. You run Headscale, and your team uses the normal Tailscale apps, pointed at your server. Note that those apps aren't all open source: Tailscale's graphical clients for proprietary systems such as Windows and Mac are closed.

• Tailscale's features: access policies, subnet routers, exit nodes, MagicDNS, and an embedded relay.
• Single sign-on through OIDC.
• Simple storage. SQLite is the recommended database.

But read the small print. It covers a single network and the project says it's aimed at hobbyists, self-hosters and small open-source organisations. It's not associated with Tailscale Inc., though one of the maintainers works there. The project's FAQ says it can likely handle hundreds of devices, with problems arising when many of them change networks often. Docker and reverse proxies aren't officially supported, and any web interface comes from a third party. For a business, that's a lot of asterisks.

Which one?

My pick is NetBird. It gets you WireGuard's speed plus the things a business really needs: a dashboard, single sign-on and access rules. The main drawback is that you depend on a control server that you have to keep updated and online.

• A team, with staff coming and going: NetBird.
• Two sites or a few technical people: plain WireGuard.
• Happy on the command line, and you like the Tailscale apps: Headscale.

The UK angle

• Little data at stake. A mesh VPN mostly carries your own traffic, encrypted between your own devices. It isn't holding your customer records, so data location isn't a big deal here, and a US or EU vendor is fine for most small firms.
• What the vendor does see. Paid services hold user lists, device details and connection logs. Worth a line in your supplier list, and not much more.
• Cyber Essentials and insurers. If you're asked about remote access, per-user sign-in and being able to remove leavers quickly make for an easier answer. That favours NetBird over hand-managed WireGuard.

Honest drawbacks

• You're now running security infrastructure. If the control server is neglected, it becomes a risk. Patch it.
• It needs a public server, for NetBird and Headscale. That's another thing to keep an eye on.
• Not the "hide my location" kind of VPN. These connect your own devices. They don't come with a network of servers round the world.
• No vendor support by default. With a paid service you have someone to ask. Here, it's whoever runs it.
• Phones and locked-down laptops can need more care, and rolling out an app to everyone still takes time.

If you need remote staff to reach a system that wasn't built for it, or a staff portal that does away with the VPN altogether, the team at Dev Partners can help build that.

Sources

• NetBird on GitHub
• NetBird self-hosted quickstart
• NetBird pricing
• WireGuard
• wireguard-tools licence
• wireguard-go licence
• Headscale on GitHub
• Headscale features
• Headscale FAQ
• NordLayer pricing
• Tailscale pricing