Alternatives to OpenZiti

An open-source zero trust networking platform that connects services by identity instead of IP address. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as OpenZiti.

  • Twingate

    An identity-based network access service meant to replace a traditional VPN for teams.

    FreemiumProprietaryWeb

    Twingate is a hosted identity-based access service with a free tier for small teams, removing self-hosting but making you depend on a closed commercial service.

  • Firezone

    WireGuard-based zero trust access with self-hosted gateways.

    FreemiumOpen sourceWindowsmacOSLinuxAndroidiOS

    Firezone uses WireGuard for zero trust access with identity provider policies and self-hosted gateways under Apache-2.0, but its control plane cannot be fully self-hosted.

  • Octelium

    A self-hosted zero trust access platform that can act as a remote access VPN or ZTNA gateway.

    FreeOpen sourceSelf-hostedCommand line

    Octelium is a self-hosted AGPL and Apache licensed platform combining VPN, ZTNA and gateway roles, and can replace ngrok-style tunnels, though it requires operating a cluster.

  • NetBird

    A WireGuard-based mesh network with single sign-on, multi-factor authentication and access policies, self-hostable or managed.

    FreemiumOpen sourceWindowsmacOSLinuxSelf-hosted

    NetBird provides a WireGuard mesh with SSO, MFA and group-based access rules, self-hostable under the AGPL, and is simpler to deploy than application-embedded connectivity.

  • Tailscale

    Builds a private network between your own devices using WireGuard, without opening ports or running a server.

    FreemiumOpen sourceWindowsmacOSLinuxAndroidiOSCommand line

    Tailscale offers WireGuard networking with central access rules and clients for all major platforms, but relies on a hosted coordination server and network-level access.

  • defguard

    A self-hosted WireGuard VPN platform with built-in identity management and multi-factor authentication per connection.

    FreemiumOpen sourceLinuxSelf-hosted

    defguard is a self-hosted WireGuard VPN with per-connection MFA and LDAP, Active Directory and OIDC integration, keeping a VPN model rather than hiding services by identity.

Also worth comparing

These listings name OpenZiti as their own alternative, so the relationship runs both ways.

  • Pomerium

    An identity-aware reverse proxy that gives secure access to internal applications without a VPN.

    FreemiumOpen sourceSelf-hosted

    OpenZiti is an open source zero trust networking platform that hides services with no inbound ports and offers SDKs, but it is more complex to deploy.

  • Teleport

    An identity-based access platform for infrastructure such as servers, Kubernetes, databases and desktops.

    FreemiumProprietaryWebSelf-hosted

    OpenZiti is an open-source zero trust networking platform with a self-hostable controller and SDKs to embed connectivity in applications, and it is more complex to deploy.

Similar software

Related functionality, not a direct replacement.