Firezone

Jamil Bou Kheir founded Firezone in 2021 after hunting malware at Cisco and seeing how monolithic VPN concentrators exposed entire internal networks to lateral movement. To eliminate centralized choke points, he built an open-source tool that partitions private infrastructure into WireGuard micro-perimeters. Firezone now provides identity-governed zero-trust network access that routes user traffic directly to designated internal subnets and hosts.

Why Firezone instead of Perimeter 81

Perimeter 81 relies on a proprietary architecture that funnels employee traffic through centralized cloud points of presence. That model incurs recurring per-seat fees, routes private traffic through third-party infrastructure, and forces administrators into a closed management stack. For infrastructure teams with workloads distributed across multiple clouds and on-premise clusters, relying on external transit adds unwanted network hops and latency to routine operations.

Firezone treats remote access as infrastructure code. DevOps engineers deploy stateless Gateway containers directly inside target VPCs, Kubernetes clusters, or bare-metal environments next to private resources. Clients establish direct, end-to-end encrypted WireGuard tunnels to these gateways over UDP, bypassing intermediate proxies. While Perimeter 81 bundles managed public internet exit nodes and web filtering, Firezone gives platform teams direct operational ownership of their internal network paths.

What it does well

• Point-to-point tunnels: Clients negotiate direct WireGuard connections to private gateways via STUN and TURN signaling, bypassing centralized VPN concentrators.
• Resource-level routing: Policies restrict access to specific IP ranges, CIDRs, or hostnames rather than granting broad subnet visibility.
• Multi-gateway failover: Running redundant Gateway containers per site delivers automatic connection migration in under ten seconds if an instance drops.
• Identity provider sync: OpenID Connect integrations with Okta, Microsoft Entra ID, and Google Workspace map directory groups directly to access rules.
• Headless service tokens: Automation jobs and CI runners authenticate non-interactively without requiring browser-based logins.
• Multi-platform clients: Rust-based client runtimes install across Linux, macOS, Windows, iOS, Android, and ChromeOS without manual key distribution.