I’m looking for a self-hosted WireGuard VPN admin interface UI that is actively maintained but also is not cloud-based (e.g., no Tailscale or Headscale or ZeroTier). I’m talking about opening port 51820 in my firewall without some cloud-server brokering the connection.
For an access VPN deployment for my department, I’ve tested several variations of wireguard based VPN provisioning servers. My basic requirements were simple setup for end users, split tunnel, and LDAP user support (can be via proxy like oidc) with groups and/or ACLs
Tailscale - easy but not really self-hosted. Good off-the-shelf solution if you can pay for it
Headscale - self hosted but not really easy. The configuration required for clients is problematic and there is no official web UI
Pritunl - functional but very clunky. Had various issues with the client application failing to switch between openvpn and wireguard as well as authentication issues.
Nebula - fantastic system but the user management isn’t really there and it’s not “point and click” enough for some end users
NetBird - great UI and highly configurable, but poor error logging and some things intentionally difficult to set up to push people towards their cloud version
Firezone - 0.X was nice but not ready, and 1.X apparently won’t support self-hosting
Zerotier - good but had a few issues with its nat-punching. Not a bad option but also not wireguard
NetMaker - reasonably good product with easy user-facing support but lacking some client platforms and vital user/ACL features are paywalled
I never ended up putting any of them into production, NetBird came the closest but with some small test groups I had lots of complaints of very slow connections which seemed to be from a storming issue between endpoints on different subnets. Not particularly easy to diagnose and didn’t happen with a very similarly configured traditional VPN
Based on this thread, I will be checking out DefGuard as it looks quite polished and feature-rich, although it does seem fairly new and very much “in development”
OpenZiti does not require a cloud-based server, it can be deployed fully behind your own FW, in fact, a large defence contractor uses it in an air-gapped network. It does not use Wireguard though.
I tried wg-easy, wgdashboard and wg-portal… all lack some critical feature for my usecase.
The best one I found to be is : https://github.com/NOXCIS/Wiregate which is based on wgdashboard but brings a lot more to the party.
