Home / Egress and tunnels
Firezone
github.com/firezone/firezoneZero trust access built on WireGuard (private only)egress/firezoneJSONcomparereport an errorprovider JSON
- Free allowance
- 'Firezone is a secure remote access platform built on WireGuard.
- Verdict
- fails: egressdata cannot be read back out at a usable rate or price
- Cost
- not statedsee Price below
- Identity
- emailno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented2 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | 'Firezone is a secure remote access platform built on WireGuard. Connect users to private applications, databases, servers, and subnets with granular policies'. 'Sign up free' is offered with no number on the page read. unit none; metered on unstated |
|---|
| Price | USD 0 |
|---|
| Binding | none No published byte meter and no public listener. The design is the constraint: a Gateway 'in the network containing your Resources' answers authenticated Clients, not the internet. |
|---|
| Identity | email app.firezone.dev sign-up |
|---|
| Egress | unverified: the pricing page renders client-side and its extracted text carries no plan numbers; ingress: none free allowance: none published |
|---|
| Interface | cli Gateway deployment plus per-platform clients |
|---|
| Tooling | Firezone Gateway, the Firezone client (Apple, Android, Rust GUI), Docker |
|---|
| Composes with | a private access layer over a VPS; it publishes nothing, so it needs an ingress in front |
|---|
| Reliability | self-hosted production deployment is 'not officially supported'; published clients are only guaranteed against the managed service |
|---|
| Notes | The strongest WireGuard name that is still not an ingress: it is the same shape as Tailscale's private tailnet, not Funnel. Production self-hosting is explicitly unsupported, which matters if the plan was to run it on a free VPS. |
|---|
| Evidence note | documented A rendered read of the pricing page would fill the missing numbers; it would not change the ingress verdict. |
|---|
| Parsed numbers | |
|---|
Evidence 2
| date | source | what it proved |
|---|
| 2026-10-23 | github.com/firezone/firezone | 'a secure remote access platform built on WireGuard. Connect users to private applications, databases, servers, and subnets'; 'Gateways run in your infrastructure' |
| 2026-10-23 | www.firezone.dev/pricing | the page returned 200 with an extraction that yields plan names only ('Starter: Free tier for small teams'), no numbers |
More fields 6
| wg path | none |
|---|
| wg detail | WireGuard is the data plane but a user is the vendor's: 'WireGuard tunnels encrypt traffic between Clients and Gateways or between devices in a Device Pool'. No .conf export is documented. |
|---|
| ingress | none |
|---|
| volume stated | unverified: the pricing page renders client-side and its extracted text carries no plan numbers |
|---|
| bytes transit | yes |
|---|
| transit note | Client to Gateway over WireGuard, with Relays when a direct path fails |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer