Best wg-based VPN for small org reddit / selfhosted ---------------------------------------------------------------------- jasieqb · 2023-12-20 22:59 Hi guys In my organisation(non-commercial), we use firezone VPN with oidc provider to securely connect our servers. But in the end of January 2024 support for 0.7 version will end. Version 1.0 is cloud-based solution which is unacceptable for as. We love pure Wireguard configs from Firezone UI... The question is: what's next? We looking for VPN with oidc integrations ---------------------------------------------------------------------- NikStalwart · 2023-12-21 01:03 Uhhhhh if you want OIDC, look at Headscale. Not sure, maybe Slack's Nebula might also have OIDC support, but I haven't used it myself. I prefer 'innernet' for a dead-simple wg-based mesh network, but that is a manual (but simple) config without OIDC. ---------------------------------------------------------------------- arcadianarcadian · 2023-12-21 08:35 Subspace : [https://github.com/subspacecommunity/subspace](https://git hub.com/subspacecommunity/subspace) Supports SAML integrations but no OIDC I think. ---------------------------------------------------------------------- sk1nT7 · 2023-12-21 17:35 Maybe: https://github.com/netbirdio/netbird ---------------------------------------------------------------------- jasieqb · 2023-12-21 18:59 Manual config is great, but not for organizations.... ---------------------------------------------------------------------- zfa · 2023-12-21 22:08 Nebula is just straight up signed host-based key pairs for auth. There's not really any user concept. ---------------------------------------------------------------------- NikStalwart · 2023-12-21 22:10 So same-ish as innernet? Okay. ---------------------------------------------------------------------- NikStalwart · 2023-12-21 22:11 innernet was developed in-house by a software development org. Then again, people in that org had a certain degree of technical sophistication. ---------------------------------------------------------------------- zfa · 2023-12-21 22:36 Yeah kind of but not really. It's more involved as you create yourself a CA and sign keys for hosts manually outside of the networky product itself. I've not seen anything build on top of it to automate key distribution. There's no inherent invitation process per se, either nodes authenticate and can talk or they dont and can't. More like pure WG than innernet in that respect. It results in there being a bit more management overhead even than pure WG though as you need key rotation due to expiry but does result in something where the paranoid could even have the CA env airgapped and do all that signing offline if they really wanted. It's a design more suited to meshing servers IMO with less focus on giving users access, more on getting devices on the same (software- designed) network. ---------------------------------------------------------------------- sinamics · 2023-12-27 20:14 Give ztnet ( zerotier ) a try: [https://github.com/sinamics/ztnet](https://github.com/sinamics/ztnet) It supports oauth and has organization features baked in. It should be fairly easy to install, if not let me know :)