Alternatives to Octelium
A self-hosted zero trust access platform that can act as a remote access VPN or ZTNA gateway. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Octelium
A self-hosted zero trust access platform that can act as a remote access VPN or ZTNA gateway.
Replacements
Listings that take over the same core job as Octelium.
OpenZiti
An open-source zero trust networking platform that connects services by identity instead of IP address.
OpenZiti is an open-source self-hostable zero trust platform using identity-based access with no open inbound ports, plus SDKs to embed connectivity in applications.
NetBird
A WireGuard-based mesh network with single sign-on, multi-factor authentication and access policies, self-hostable or managed.
NetBird provides WireGuard mesh networking with SSO, MFA and group access policies, self-hostable under the AGPL or used as a managed service.
Firezone
WireGuard-based zero trust access with self-hosted gateways.
Firezone offers WireGuard-based zero trust access with self-hosted gateways and identity provider policies, but its control plane is hosted by the vendor.
defguard
A self-hosted WireGuard VPN platform with built-in identity management and multi-factor authentication per connection.
defguard is a self-hosted WireGuard platform enforcing MFA on each connection with LDAP, Active Directory and OIDC, though some features are in paid enterprise plans.
Twingate
An identity-based network access service meant to replace a traditional VPN for teams.
Twingate is a hosted identity-based access service for teams, removing the need to run a cluster but not self-hostable and closed source.
Pritunl
A self-hosted VPN server for OpenVPN, WireGuard and IPsec, managed through a web interface.
Pritunl is a self-hosted OpenVPN, WireGuard and IPsec server with a web interface, offering traditional remote-access VPN rather than ZTNA gateway features.
Similar software
Related functionality, not a direct replacement.
Tailscale
Builds a private network between your own devices using WireGuard, without opening ports or running a server.
headscale
A self-hosted, open-source implementation of the Tailscale control server, so your mesh VPN does not depend on a company.
Netmaker
Self-hosted platform for building and managing WireGuard mesh networks.
ocserv
An open-source Linux SSL VPN server compatible with OpenConnect and AnyConnect clients.
OpenVPN Access Server
A self-hosted business VPN server with a web admin interface, free for two simultaneous connections.
WireGuard
A small, fast VPN protocol and set of official clients that connect two machines by exchanging public keys.
