• https://forum.cloudron.io/topic/7565/netmaker-foss-noconf-mesh-vpn-using-wireguard-alternative-to-zerotier-tailscale-omniedge-etc

I also really like that it's about as low level as it gets - it's really just coordinating wireguard tunnel updates from a central console. Fantastic "simplicity" without the fuss.

Haven't gotten "external clients" figured out yet, and the windows app is still rough, but Linux on Linux is solid across clouds.

Netmaker Pricing/Features

Firezone Pricing/Features

If you compare GitHub stars and Twitter followers, then Netmaker is way ahead.

I really do think Cloudron would benefit from having both options though, the best way to compare anything is trying to live with it.

Intro from the founder seems reassuring for his Cisco experience:

• https://www.producthunt.com/products/firezone-beta-2#firezone-beta

Jamil Bou Kheir@jamilbk
Maker
Hi Product Hunt!

I'm Jamil, the CEO of Firezone. I'm here with my co-founder and COO @jgong.

While working as a security automation engineer at Cisco I found myself needing to set up remote access for my team into various internal private networks for running security tests and scanning networks. We quickly found OpenVPN cumbersome and complicated to manage, and often found ourselves frustrated by its slow and unreliable connections.

Then we discovered WireGuard. WireGuard is an absolute godsend to anyone needing a layer 3/4 tunnel. It boasts 3-4x faster throughput than OpenVPN, reconnect times measured in milliseconds, and typically incurs no noticeable latency overhead vs a direct connection.

WireGuard is a great foundation -- but it's lacking critical features like 2FA, SSO, and more that prevent it from being used effectively in team environments.

So we built Firezone.

Firezone's an intuitive, snappy web UI bundled as a Linux package designed to make it as painlesss as possible to manage secure remote access for your team.

Use Firezone to manage secure remote access to applications in your private cloud, funnel traffic through a single egress gateway for your team, establish a reverse tunnel to a host behind NAT, or simply ensure that the first hop from your teams' laptops is encrypted when connecting from untrusted cafe and airport WiFi.

What makes Firezone different?

We're 100% open source and plan to remain that way. We're also self-hosted; we believe virtual private networks should remain private. Firezone can be deployed in air-gapped environments such that none of your traffic ever touches our servers.

What's next?

Firezone is still in its infancy; we've got tons of new features in the pipeline for release later this year. Now's a great time to check it out and offer your feedback to steer development! We just launched our public Beta program and will be giving early adopters license keys to paid Firezone tiers when they become available. Register to receive yours! https://e04kusl9oz5.typeform.com...

This whole Mesh VPN area seems to solve that in a very non-technical way, and actually looks like many experienced IT admins have not really explored it, as they already have their comfort zones in the previous ways of doing these things with routers, firewalls and device VPNs etc.

These zero-conf Mesh VPN options are sooooo much easier, faster and less hazardous for time-loss because of one small piece of missing information in what can otherwise be complex setups.

It's had several breaking changes in the past few months as they get closer to their 1.0, but aside from that, it's been smooth sailing - even behind CGNat (which is a story unto itself).

This *might *be a better approach for avoiding lock-in, having a wider community monitoring and updating the client codebase. In which case, that might help you narrow down your options for at-least the priority order in which to go though trying them.

On the flip-side, Tailscale and OmniEdge you can try out immediately, without any need to setup a self-hosted server.

I see no harm in trying them all, we're lucky to have all these optios eh!

I post them all for the many more eyes and viewpoints to highlight the good, bad and ugly gotchyas of each.

They all seem to be Golang in some way, so that might make packaging easier — but we have to leave it up to the more experienced and enthused to choose to package any or many of them for Cloudron.

My thinking otherwise is that it is best to have one's own Proxmox server, and just make mini-VMs for each of these things using their regular install scripts designed for that.

Personally, I don't think you need self-hosted for the user account management aspect, but it's nice for assurance of being totally off-grid or getting access to more features without subscription costs.

They all look so good though eh! We are certainly spoiled for choice with open-source nowadays, happily open-source publishing seems to becoming a competitive advantage in both cheap network marketing, and assurances needed to attract enterprise clients.

On Netmaker, at:-
https://www.reddit.com/r/selfhosted/comments/p2d8a5/netmaker_07_very_fast_linux_server_networking/

"Netmaker is a VPN platform built for kernel WireGuard (because of this it can run ~50%+ faster than many similar platforms)."

"...ran some speed tests last week and Netmaker was over 60% faster than Tailscale. This is because we use kernel WireGuard instead of userspace."

Server Side Public License - Wikipedia
https://en.wikipedia.org/wiki/Server_Side_Public_License

Just a heads up!