What Is VPN & ZTNA?
Mix (35 tools)
- License: 22 open source · 13 proprietary
- Hosting: 21 self-hosted · 10 SaaS · 4 both
VPN (Virtual Private Network) creates an encrypted tunnel between a client and a network, granting the client full access to resources as if it were physically connected. ZTNA (Zero Trust Network Access) replaces the broad network tunnel with identity-based, per-application access – users reach only the specific resources they are authorized for, without exposing the rest of the network.
Traditional VPNs follow a “trust the network” model: once authenticated, the user has broad access. ZTNA follows a “never trust, always verify” model: every request is authenticated, authorized, and encrypted independently.
Organizations are moving from VPN to ZTNA for several reasons:
- Reduced attack surface – ZTNA exposes only specific applications, not the entire network; compromised credentials grant limited access
- Identity-centric security – access decisions based on user identity, device posture, and context rather than network location
- No inbound firewall rules – ZTNA clients initiate outbound connections; no open ports on the corporate firewall
- Better user experience – per-application access without full tunnel overhead; works across networks without VPN client hassle
VPN remains relevant for:
- Site-to-site connectivity – linking offices, data centers, and cloud VPCs
- Full network access – use cases requiring broad protocol support (legacy apps, network scanning, multicast)
- Infrastructure connectivity – server-to- server encrypted tunnels for internal services
- Mesh networking – peer-to-peer encrypted connections between distributed nodes
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
This evaluation covers VPN/ZTNA tools across deployment, protocol, ZTNA, MSP, platform, and monitoring dimensions.
SSO / OIDC Comparison
OIDC is the preferred SSO protocol; the notes below assume Authentik as the external identity provider.
Raw VPN protocols (WireGuard, OpenVPN CE, strongSwan, SoftEther) have no native SSO. Orchestration layers and commercial platforms add identity integration.
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| WireGuard | No | No | No | Raw protocol; no user mgmt; use orchestration for SSO |
| OpenVPN CE | No | No | No | RADIUS/PAM only; no native SSO; Access Server adds SSO |
| strongSwan | No | No | No | EAP/RADIUS only; no native SSO |
| SoftEther | No | No | No | RADIUS only; no native SSO |
| Algo VPN | No | No | No | Deployment tool; no user mgmt beyond keys |
| Headscale | Yes | No | No | Native OIDC; Authentik as IdP; group claims for ACLs |
| NetBird | Yes | No | No | Native OIDC (any provider); Authentik as IdP; group sync |
| Nebula | No | No | No | Certificate PKI only; no SSO; cert groups for access |
| Netmaker | Yes | No | No | Native OIDC; Authentik as IdP |
| ZeroTier | No | No | No | API key auth; no native SSO; Central UI has SSO (paid) |
| Firezone | Yes | No | No | Native OIDC; Authentik as IdP; per-resource policies |
| DefGuard | Yes | No | No | Native OIDC (also an OIDC IdP); LDAP sync; Authentik |
| OpenZiti | Yes | No | No | External IdP via OIDC; Authentik as IdP |
| Pomerium | Yes | No | No | Native OIDC (required); Authentik as IdP; policy-based |
| Ferrumgate | Yes | No | No | Native OIDC; Authentik as IdP |
| Pritunl | Yes* | No | No | Google/Okta/Azure/OneLogin SSO; Authentik via OIDC |
| Pritunl Zero | Yes* | No | No | Google/Okta/Azure/OneLogin SSO; Authentik via OIDC |
| Octelium | Yes | No | No | Native OIDC; Authentik as IdP |
| Nylon | No | No | No | WireGuard keys only; no user directory; use orchestration for SSO |
| pfSense | No | No | No | RADIUS/LDAP for VPN auth; no native OIDC |
| OPNsense | No | No | No | RADIUS/LDAP for VPN auth; no native OIDC |
| MikroTik | No | No | No | RADIUS for VPN auth; no native SSO |
| OpenVPN AS | Yes* | Yes | No | LDAP/RADIUS/SAML; OIDC via bridge; Authentik SAML |
| Tailscale | Yes | No | No | Native OIDC (any provider); Authentik as IdP; ACLs |
| Twingate | Yes | Yes | Yes | OIDC + SAML + SCIM; Authentik as IdP; directory sync |
| Appgate SDP | Yes | Yes | Yes | Native OIDC + SAML + SCIM; Authentik federation |
| Cloudflare ZT | Yes | Yes | Yes | OIDC + SAML + SCIM; Authentik as IdP; Access |
| Zscaler ZPA | Yes | Yes | Yes | OIDC + SAML + SCIM; Authentik federation |
| Prisma Access | Yes | Yes | Yes | Native SAML + OIDC + SCIM; Authentik federation |
| Cisco SA | Yes | Yes | Yes | SAML + OIDC; SCIM via Entra; Authentik |
| Harmony SASE | Yes | Yes | No | Native SAML + OIDC; Authentik federation |
| Netskope PA | Yes | Yes | Yes | Native SAML + OIDC + SCIM; Authentik federation |
| FortiClient | Yes | Yes | No | FortiAuthenticator SAML/OIDC; Authentik via SAML |
| SonicWall CSE | Yes | Yes | No | Native OIDC + SAML; Authentik as IdP |
| Defined Net | No | No | No | Certificate-based (Nebula); no SSO |
* = requires specific configuration or limited provider support
Best SSO support: Twingate, Appgate SDP, Cloudflare Zero Trust, Zscaler ZPA, Prisma Access, Cisco Secure Access, Netskope PA (OIDC
- SAML + SCIM)
Best OSS SSO: Headscale, NetBird, Firezone, DefGuard, Pomerium (native OIDC)
No SSO: WireGuard, OpenVPN CE, strongSwan, SoftEther, Nebula, ZeroTier (free), pfSense, OPNsense, MikroTik, Defined Networking
API Comparison
| Tool | API Type | Auth | Webhooks | SDKs | Terraform |
|---|---|---|---|---|---|
| WireGuard | None (CLI) | N/A | No | None | Community |
| OpenVPN CE | None (CLI) | N/A | No | None | No |
| strongSwan | VICI (socket) | Local | No | Python, Ruby | No |
| SoftEther | JSON-RPC | Admin key | No | None | No |
| Algo VPN | None (Ansible) | N/A | No | None | No |
| Headscale | REST + gRPC | API key | No | Go | Community |
| NetBird | REST | Token, OAuth2 | Yes | Go, Python | Yes (official) |
| Nebula | None (config) | N/A | No | None | No |
| Netmaker | REST | Token | No | None | Community |
| ZeroTier | REST | Token | No | None | Community |
| Firezone | REST | Token | No | None | Community |
| DefGuard | REST | Token | Yes | None | No |
| OpenZiti | REST | JWT | Yes | Go, Python, JS | Yes (official) |
| Pomerium | REST | Token | No | None | Yes (official) |
| Ferrumgate | REST | Token | No | None | No |
| Pritunl | REST | Token | No | Python | Community |
| Pritunl Zero | REST | Token | No | None | No |
| Octelium | REST + gRPC | Token | Yes | None | No |
| Nylon | None (config) | N/A | No | None | No |
| pfSense | REST (pkg) | Token | No | None | Community |
| OPNsense | REST | Key + Secret | No | Python | Community |
| MikroTik | REST + API | Token | No | Python, Go | Yes (official) |
| OpenVPN AS | REST + XML-RPC | Token | No | Python | No |
| Tailscale | REST | API key, OAuth | Yes | Go (official) | Yes (official) |
| Twingate | GraphQL | API key | Yes | None | Yes (official) |
| Appgate SDP | REST | Token | Yes | Python | Yes (official) |
| Cloudflare ZT | REST | Token | Yes | Go, JS, Python | Yes (official) |
| Zscaler ZPA | REST | OAuth2 | Yes | Python | Yes (official) |
| Prisma Access | REST | OAuth2 | Yes | Python | Yes (official) |
| Cisco SA | REST | OAuth2 | Yes | None | No |
| Harmony SASE | REST | API key | Yes | None | No |
| Netskope PA | REST | Token | Yes | Python | Yes (official) |
| FortiClient | REST (EMS) | Token | Yes | None | Yes (FortiOS) |
| SonicWall CSE | REST | Token | Yes | None | No |
| Defined Net | REST | Token | No | None | No |
VPN Protocol Support
| Tool | WG | OVPN | IPsec | Custom | S2S | Remote | Split |
|---|---|---|---|---|---|---|---|
| WireGuard | Yes | No | No | No | Yes | Yes | Yes (AllowedIPs) |
| OpenVPN CE | No | Yes | No | No | Yes | Yes | Yes |
| strongSwan | No | No | Yes | No | Yes | Yes | Yes |
| SoftEther | No | Yes | Yes | Yes (SE-VPN) | Yes | Yes | Yes |
| Algo VPN | Yes | No | Yes | No | No | Yes | Yes |
| Headscale | Yes | No | No | No | Yes (subnet) | Yes | Yes (ACLs) |
| NetBird | Yes | No | No | No | Yes (routes) | Yes | Yes (routes) |
| Nebula | No | No | No | Yes (Nebula) | Yes | Yes | Yes (groups) |
| Netmaker | Yes | No | No | No | Yes | Yes | Yes (ACLs) |
| ZeroTier | No | No | No | Yes (ZT) | Yes | Yes | Yes (rules) |
| Firezone | Yes | No | No | No | No | Yes | Yes (resources) |
| DefGuard | Yes | No | No | No | Yes | Yes | Yes |
| OpenZiti | No | No | No | Yes (Ziti) | Yes | Yes | Yes (services) |
| Pomerium | No | No | No | No | No | Yes (proxy) | N/A (per-app) |
| Ferrumgate | Yes | No | No | No | No | Yes | Yes |
| Pritunl | Yes | Yes | Yes | No | Yes | Yes | Yes |
| Pritunl Zero | No | No | No | No | No | Yes (proxy) | N/A (per-app) |
| Octelium | Yes | No | No | No | No | Yes | Yes |
| Nylon | Yes | No | No | No | Yes | Yes | Yes (routes) |
| pfSense | Yes* | Yes | Yes | No | Yes | Yes | Yes |
| OPNsense | Yes | Yes | Yes | No | Yes | Yes | Yes |
| MikroTik | Yes | Yes | Yes | No | Yes | Yes | Yes |
| OpenVPN AS | No | Yes | No | No | Yes | Yes | Yes |
| Tailscale | Yes | No | No | No | Yes (subnet) | Yes | Yes (ACLs) |
| Twingate | No | No | No | Yes | No | Yes | Yes (resources) |
| Appgate SDP | No | No | No | Yes | Yes | Yes | Yes (entitle.) |
| Cloudflare ZT | Yes* | No | No | Yes | Yes (tunnel) | Yes | Yes (policies) |
| Zscaler ZPA | No | No | No | Yes | No | Yes | Yes (policies) |
| Prisma Access | No | No | Yes | Yes | Yes | Yes | Yes |
| Cisco SA | No | No | Yes | Yes | Yes | Yes | Yes |
| Harmony SASE | Yes | No | Yes | No | Yes | Yes | Yes |
| Netskope PA | No | No | No | Yes | No | Yes | Yes |
| FortiClient | No | No | Yes | Yes | Yes | Yes | Yes |
| SonicWall CSE | No | No | No | Yes | No | Yes | Yes |
| Defined Net | No | No | No | Yes (Nebula) | Yes | Yes | Yes (groups) |
* = via package or module, not native
ZTNA & Mesh Features
| Tool | Mesh P2P | Per-App | Posture | Identity | Micro-Seg | NAT Trav | Clientless |
|---|---|---|---|---|---|---|---|
| WireGuard | No | No | No | No | No | No | No |
| OpenVPN CE | No | No | No | No | No | No | No |
| strongSwan | No | No | No | No | No | Yes | No |
| SoftEther | No | No | No | No | No | Yes | No |
| Headscale | Yes | No | No | OIDC | ACLs | Yes | No |
| NetBird | Yes | Yes | Yes | OIDC | Yes | Yes | No |
| Nebula | Yes | No | No | Certs | Groups | Yes | No |
| Netmaker | Yes | ACLs | No | OIDC | ACLs | Yes | No |
| ZeroTier | Yes | Rules | No | No | Rules | Yes | No |
| Firezone | No | Yes | Limited | OIDC | Yes | Yes | No |
| DefGuard | No | No | No | OIDC | No | No | No |
| OpenZiti | Yes | Yes | Yes | OIDC | Yes | Yes | Yes |
| Pomerium | No | Yes | Yes | OIDC | Yes | No | Yes |
| Ferrumgate | No | Yes | No | OIDC | Yes | Yes | No |
| Pritunl | No | No | No | SSO | No | No | No |
| Pritunl Zero | No | Yes | No | SSO | No | No | Yes |
| Octelium | No | Yes | No | OIDC | Yes | No | No |
| Nylon | Yes | No | No | No | No | Yes | No |
| pfSense | No | No | No | No | FW rules | No | No |
| OPNsense | No | No | No | No | FW rules | No | No |
| MikroTik | No | No | No | No | FW rules | No | No |
| OpenVPN AS | No | No | No | SSO | No | No | No |
| Tailscale | Yes | ACLs | Yes | OIDC | ACLs | Yes | No |
| Twingate | No | Yes | Yes | OIDC | Yes | Yes | No |
| Appgate SDP | No | Yes | Yes | OIDC | Yes | No | No |
| Cloudflare ZT | No | Yes | Yes | OIDC | Yes | Yes | Yes |
| Zscaler ZPA | No | Yes | Yes | OIDC | Yes | No | Yes |
| Prisma Access | No | Yes | Yes | OIDC | Yes | No | Yes |
| Cisco SA | No | Yes | Yes | OIDC | Yes | No | Yes |
| Harmony SASE | No | Yes | Yes | OIDC | Yes | No | Yes |
| Netskope PA | No | Yes | Yes | OIDC | Yes | No | Yes |
| FortiClient | No | Yes | Yes | SAML | Yes | No | No |
| SonicWall CSE | No | Yes | Yes | OIDC | Yes | No | Yes |
| Defined Net | Yes | No | No | Certs | Groups | Yes | No |
Best mesh: Headscale, NetBird, Nebula, Netmaker, ZeroTier, Tailscale (peer-to-peer WireGuard or custom protocol)
Best ZTNA: Cloudflare ZT, Zscaler ZPA, Pomerium, Twingate, NetBird (per-app access + device posture + identity)
Clientless access: Pomerium, OpenZiti, Cloudflare ZT, Zscaler ZPA, Prisma Access, Cisco SA, Harmony SASE, Netskope PA, SonicWall CSE, Pritunl Zero (browser-based, no client install)
MSP / Multi-Tenant Features
| Tool | Multi-Tenant | MSP Portal | Per-Client Nets | Central Mgmt | Partner Program |
|---|---|---|---|---|---|
| WireGuard | Manual | No | Manual | No | No |
| OpenVPN CE | Manual | No | Manual | No | No |
| strongSwan | Manual | No | Manual | No | No |
| Headscale | No | No | No | Single instance | No |
| NetBird | Yes | Yes | Yes | Yes | Yes |
| Nebula | Manual (CAs) | No | Yes (CAs) | No | No |
| Netmaker | Yes | No | Yes | Yes | No |
| ZeroTier | Yes | No | Yes | Yes | Yes (Partner) |
| Firezone | No | No | No | Single org | No |
| DefGuard | No | No | No | Single org | No |
| OpenZiti | Yes | No | Yes | Yes | No |
| Pomerium | No | No | No | Single org | No |
| Pritunl | Yes | No | Yes | Yes | No |
| Nylon | Manual | No | Manual | No | No |
| pfSense | No | No | Per-device | No | No |
| OPNsense | No | No | Per-device | No | No |
| MikroTik | Yes* | No | Per-device | The Dude NMS | No |
| OpenVPN AS | No | No | No | Single server | No |
| Tailscale | Yes | No | Yes (tailnets) | Yes | Yes |
| Twingate | Yes | Yes | Yes | Yes | Yes (Partner) |
| Appgate SDP | Yes | No | Yes | Yes | Yes |
| Cloudflare ZT | Yes | Multi-acct | Yes | Yes | Yes (Channel) |
| Zscaler ZPA | Yes | Partner | Yes | Yes | Yes |
| Prisma Access | Yes | Panorama | Yes | Yes | Yes |
| Cisco SA | Yes | Partner | Yes | Yes | Yes |
| Harmony SASE | Yes | Infinity | Yes | Yes | Yes |
| Netskope PA | Yes | Partner | Yes | Yes | Yes |
| FortiClient | Yes | FortiCloud | Yes | Yes | Yes |
| SonicWall CSE | Yes | Partner | Yes | Yes | Yes |
* = via The Dude NMS for multi-device management
Best MSP support: Twingate (dedicated MSP portal + partner pricing), NetBird (MSP portal), Cloudflare ZT (multi-account + channel partner), Zscaler, Prisma Access, Fortinet (established partner programs)
No multi-tenancy: Headscale, Firezone, DefGuard, Pomerium, OpenVPN AS (single-org focus; MSPs must run separate instances)
Platform Support
| Tool | Windows | macOS | Linux | iOS | Android | ChromeOS | Router |
|---|---|---|---|---|---|---|---|
| WireGuard | Yes | Yes | Yes | Yes | Yes | No | Many |
| OpenVPN CE | Yes | Yes | Yes | Yes | Yes | No | Many |
| strongSwan | Yes* | Yes | Yes | Yes | Yes | No | Many |
| SoftEther | Yes | Yes | Yes | No | No | No | No |
| Algo VPN | Yes | Yes | Yes | Yes | Yes | No | No |
| Headscale | Yes | Yes | Yes | Yes | Yes | No | No |
| NetBird | Yes | Yes | Yes | Yes | Yes | No | No |
| Nebula | Yes | Yes | Yes | Yes | Yes | No | No |
| Netmaker | Yes | Yes | Yes | No | No | No | No |
| ZeroTier | Yes | Yes | Yes | Yes | Yes | Yes | Some |
| Firezone | Yes | Yes | Yes | Yes | Yes | No | No |
| DefGuard | Yes | Yes | Yes | No | No | No | No |
| OpenZiti | Yes | Yes | Yes | Yes | Yes | No | No |
| Pomerium | Yes | Yes | Yes | No | No | No | No |
| Ferrumgate | Yes | Yes | Yes | No | No | No | No |
| Pritunl | Yes | Yes | Yes | Yes | Yes | No | No |
| Pritunl Zero | Browser | Browser | Browser | Browser | Browser | Browser | No |
| Octelium | Yes | Yes | Yes | No | No | No | No |
| Nylon | Yes | Yes | Yes | Yes | Yes | No | No |
| pfSense | N/A | N/A | N/A | N/A | N/A | N/A | x86 |
| OPNsense | N/A | N/A | N/A | N/A | N/A | N/A | x86 |
| MikroTik | N/A | N/A | N/A | N/A | N/A | N/A | MIPS/ARM |
| OpenVPN AS | Yes | Yes | Yes | Yes | Yes | No | No |
| Tailscale | Yes | Yes | Yes | Yes | Yes | No | No |
| Twingate | Yes | Yes | Yes | Yes | Yes | Yes | No |
| Appgate SDP | Yes | Yes | Yes | Yes | Yes | No | No |
| Cloudflare ZT | Yes | Yes | Yes | Yes | Yes | Yes | No |
| Zscaler ZPA | Yes | Yes | Yes | Yes | Yes | Yes | No |
| Prisma Access | Yes | Yes | Yes | Yes | Yes | Yes | No |
| Cisco SA | Yes | Yes | Yes | Yes | Yes | No | No |
| Harmony SASE | Yes | Yes | Yes | Yes | Yes | No | No |
| Netskope PA | Yes | Yes | Yes | Yes | Yes | Yes | No |
| FortiClient | Yes | Yes | Yes | Yes | Yes | Yes | No |
| SonicWall CSE | Yes | Yes | Yes | Yes | Yes | No | No |
| Defined Net | Yes | Yes | Yes | Yes | Yes | No | No |
* = strongSwan Windows support is limited; IKEv2 native client preferred
Broadest platform support: Cloudflare ZT, Zscaler ZPA, Prisma Access, FortiClient, Netskope PA (all major platforms including ChromeOS)
Clientless / browser-only: Pritunl Zero, Pomerium, Cloudflare Access, Zscaler ZPA Browser Access (no client install needed)
Deployment and Licensing
| Tool | License | Self-Hosted | Language | Pricing |
|---|---|---|---|---|
| WireGuard | GPL-2.0 | Yes (kernel) | C | Free |
| OpenVPN CE | GPL-2.0 | Yes | C | Free |
| strongSwan | GPL-2.0 | Yes | C | Free |
| SoftEther | Apache-2.0 | Yes | C | Free |
| Algo VPN | AGPL-3.0 | Yes (cloud) | Python | Free |
| Headscale | BSD-3 | Yes | Go | Free |
| NetBird | BSD-3 | Yes | Go | Free (OSS) / Paid (cloud) |
| Nebula | MIT | Yes | Go | Free |
| Netmaker | SSPL-1.0 | Yes | Go | Free (CE) / Paid (Pro) |
| ZeroTier | BSL-1.1 | Yes (ctrl) | C++ | Free tier / Paid |
| Firezone | Apache-2.0 | Yes | Elixir/Rust | Free (OSS) / Paid (cloud) |
| DefGuard | Apache-2.0 | Yes | Rust | Free |
| OpenZiti | Apache-2.0 | Yes | Go | Free |
| Pomerium | Apache-2.0 | Yes | Go | Free (OSS) / Paid (Enterprise) |
| Ferrumgate | GPL-3.0 | Yes | TypeScript | Free |
| Pritunl | AGPL-3.0 | Yes | Python | Free (CE) / Paid (Enterprise) |
| Pritunl Zero | Custom | Yes | Python | Free |
| Octelium | Apache-2.0 | Yes | Go | Free |
| Nylon | Apache-2.0 | Yes | Go | Free |
| pfSense | Apache-2.0 | Yes | PHP/C | Free (CE) / Paid (Plus) |
| OPNsense | BSD-2 | Yes | PHP/C | Free |
| MikroTik | Proprietary | Yes (RouterOS) | N/A | Per-device license |
| OpenVPN AS | Proprietary | Yes | C/Python | Per-connection |
| Tailscale | BSD-3 (client) | No (SaaS) | Go | Free tier / Per-user |
| Twingate | Proprietary | No (SaaS) | N/A | Per-user / Per-resource |
| Appgate SDP | Proprietary | Yes + SaaS | N/A | Per-user |
| Cloudflare ZT | Proprietary | No (SaaS) | N/A | Free tier / Per-user |
| Zscaler ZPA | Proprietary | No (SaaS) | N/A | Per-user (bundle) |
| Prisma Access | Proprietary | No (SaaS) | N/A | Per-user (bundle) |
| Cisco SA | Proprietary | No (SaaS) | N/A | Per-user (bundle) |
| Harmony SASE | Proprietary | No (SaaS) | N/A | Per-user |
| Netskope PA | Proprietary | No (SaaS) | N/A | Per-user (bundle) |
| FortiClient | Proprietary | Yes (EMS) | N/A | Per-endpoint |
| SonicWall CSE | Proprietary | No (SaaS) | N/A | Per-user |
| Defined Net | Proprietary | No (SaaS) | N/A | Per-host |
Monitoring Integration
| Tool | Prometheus | Structured Logs | Grafana |
|---|---|---|---|
| WireGuard | No (wg show) | No | Community |
| OpenVPN CE | No (status file) | File logs | Community |
| strongSwan | No | syslog | None |
| SoftEther | No | File logs | None |
| Headscale | Yes (/metrics) | Yes (JSON) | Community |
| NetBird | Yes (/metrics) | Yes (JSON) | Community |
| Nebula | Yes (/metrics) | Yes (JSON) | Community |
| Netmaker | No | stdout logs | None |
| ZeroTier | No | File logs | None |
| Firezone | Yes | Yes (JSON) | Community |
| DefGuard | Yes (/metrics) | Yes | None |
| OpenZiti | Yes | Yes (JSON) | Community |
| Pomerium | Yes (/metrics) | Yes (JSON) | Community |
| Ferrumgate | No | File logs | None |
| Pritunl | No | File logs | Community |
| Nylon | No (wg stats) | File logs | Community |
| pfSense | Yes (pkg) | syslog | Community |
| OPNsense | Yes (plugin) | syslog | Community |
| MikroTik | Yes (SNMP) | syslog | Community |
| OpenVPN AS | No | File logs | None |
| Tailscale | No (SaaS) | Audit log API | None |
| Twingate | No (SaaS) | Audit log API | None |
| Appgate SDP | Yes | Yes (JSON) | Community |
| Cloudflare ZT | No (SaaS) | Log push API | Community |
| Zscaler ZPA | No (SaaS) | Log streaming | Community |
| Prisma Access | No (SaaS) | Log forwarding | Community |
| Cisco SA | No (SaaS) | Log export | None |
| Harmony SASE | No (SaaS) | Log export | None |
| Netskope PA | No (SaaS) | Log streaming | Community |
| FortiClient | Yes (EMS) | syslog/CEF | Community |
| SonicWall CSE | No (SaaS) | Log export | None |
Best monitoring integration: Headscale, NetBird, Nebula, Firezone, DefGuard, Pomerium, OpenZiti (native Prometheus endpoints + structured JSON logging)
Network appliances: pfSense, OPNsense, MikroTik (Prometheus via package/plugin + syslog to Fluent Bit)
SaaS tools: Tailscale, Twingate, Cloudflare ZT, Zscaler, Prisma, Netskope (log push/stream APIs to Fluent Bit; no direct Prometheus)
Tools
35 tools.
Algo VPN
Algo VPN is an automated VPN deployment tool created by Trail of Bits that provisions a WireGuard (and optionally IPsec/IKEv2) VPN server on cloud infrastructure with a single command.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Appgate SDP
Appgate SDP (Software-Defined Perimeter) is an enterprise zero trust network access platform that implements the Cloud Security Alliance (CSA) Software-Defined Perimeter specification.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Directory / LDAP
Check Point Harmony SASE
Check Point Harmony SASE is Check Point’s cloud- delivered Secure Access Service Edge platform that combines ZTNA, SD-WAN, Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Firewall-as- a-Service (FWaaS), and data loss preventi…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Cisco Secure Access
Cisco Secure Access is Cisco’s converged SSE/ZTNA platform that unifies capabilities formerly spread across Duo (igap/MFA), Umbrella (DNS security/ SWG), and Cisco AnyConnect (VPN) into a single cloud-delivered service.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Cloudflare Zero Trust
Cloudflare Zero Trust (formerly Cloudflare for Teams) is a comprehensive SASE/ZTNA platform built on Cloudflare’s global edge network spanning 300+ cities worldwide.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
DefGuard
DefGuard is an open-source WireGuard VPN server with integrated identity management, multi-factor authentication, and an OpenID Connect provider.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Defined Networking
Defined Networking is the commercial management platform built on top of the open-source Nebula overlay networking tool.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Ferrumgate
Ferrumgate is a self-hosted zero trust network access gateway that provides identity-aware, policy-controlled access to internal networks and services.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: direct, docker · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
Firezone
Firezone is a WireGuard-based zero trust access platform that has evolved significantly since its inception.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, saas · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
FortiClient ZTNA
FortiClient ZTNA is Fortinet’s zero trust network access solution integrated into the broader Fortinet Security Fabric.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Headscale
Headscale is an open-source, self-hosted implementation of the Tailscale control server, providing WireGuard mesh networking with the official Tailscale clients, ACL policies, MagicDNS, and native OIDC.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: direct · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
MikroTik
MikroTik is a Latvian networking equipment manufacturer whose RouterOS operating system provides comprehensive VPN capabilities alongside routing, switching, firewall, and wireless features.
License: Proprietary (proprietary) · Kind: web · Deploy: appliance · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential · Key-based access
Nebula
Nebula is a scalable overlay networking tool developed by Slack (now Salesforce) for connecting hosts across any network topology.
License: MIT (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
NetBird
NetBird is a WireGuard-based mesh networking and zero trust network access platform that combines peer-to-peer VPN connectivity with identity-aware access control.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: direct, saas · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Netmaker
Netmaker is a WireGuard network automation platform that simplifies the creation and management of WireGuard-based virtual networks.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Netskope Private Access
Netskope Private Access (NPA) is the ZTNA component of Netskope’s Security Service Edge (SSE) platform, providing secure access to private applications in data centers and cloud environments without traditional VPN infrastructure.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Nylon
Self-healing decentralized WireGuard mesh VPN implementing the Babel routing protocol (RFC 8966) for multi-hop routing over lowest-latency paths.
License: Apache-2.0 (OSS) · Kind: service · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account · Key-based access
Octelium
Octelium is a unified access platform that provides zero trust access to any service or resource regardless of protocol.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: direct, k8s · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
OpenVPN Access Server
OpenVPN Access Server is the commercial, enterprise-ready version of OpenVPN that adds a web-based management interface, user self-service portal, and integrated authentication to the OpenVPN Community Edition engine.
License: Proprietary (proprietary) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OpenVPN CE
OpenVPN Community Edition is the original open-source SSL/TLS-based VPN solution that has been the de facto standard for self-hosted VPN deployments since its initial release in 2001.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OpenZiti
OpenZiti is a zero trust overlay network platform developed by NetFoundry that provides application- embedded zero trust connectivity.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
OPNsense
OPNsense is a FreeBSD-based firewall and routing platform forked from pfSense in 2015 by Deciso. It provides a modern web interface, weekly security updates, and a plugin-based architecture that extends core functionality.
License: BSD-2-Clause (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
pfSense
pfSense is a FreeBSD-based firewall and router platform that includes comprehensive VPN capabilities.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Pomerium
Pomerium is an identity-aware reverse proxy that provides secure, clientless access to internal web applications and services.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Prisma Access
Prisma Access is Palo Alto Networks’ cloud-delivered SASE platform that unifies ZTNA, SD-WAN, Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Firewall-as-a-Service (FWaaS), and data loss prevention (DLP) into a single converg…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Pritunl
Pritunl is an enterprise VPN server with a web-based management interface that supports OpenVPN and WireGuard protocols.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: direct · SSO: OIDC, SAML
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Pritunl Zero
Pritunl Zero is a zero trust system that provides secure access to internal services through an identity-aware reverse proxy and SSH certificate authority.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: direct · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
SoftEther
SoftEther VPN is a multi-protocol VPN solution developed at the University of Tsukuba in Japan. It supports multiple VPN protocols simultaneously, including its own SoftEther protocol, OpenVPN, L2TP/IPsec, SSTP, and EtherIP.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
SonicWall Cloud Secure Edge
SonicWall Cloud Secure Edge (CSE), formerly Banyan Security, is a cloud-delivered zero trust network access platform that SonicWall acquired in 2024.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
strongSwan
strongSwan is a comprehensive IPsec-based VPN solution implementing the IKEv1 and IKEv2 key exchange protocols. It is the successor to the FreeS/WAN project and has been actively developed since 2005.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Tailscale
Tailscale is a mesh VPN service built on WireGuard that makes secure networking as simple as installing an app.
License: BSD-3-Clause (OSS) · Kind: web · Deploy: saas · SSO: OIDC
ResorsIT usage: Web App without SSO
Access & Identity: Single sign-on
Twingate
Twingate is a cloud-native zero trust network access (ZTNA) platform designed to replace traditional VPNs with resource-level access control.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
WireGuard
WireGuard is a modern, high-performance VPN protocol that operates at the kernel level on Linux and as a cross-platform userspace implementation on other operating systems.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: direct · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
ZeroTier
ZeroTier is a virtual networking platform that creates software-defined networks (SDNs) connecting devices as if they were on the same local Ethernet segment.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Zscaler Private Access
Zscaler Private Access (ZPA) is a cloud-native ZTNA service that provides secure access to private applications without traditional VPN infrastructure.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
