Firezone is an open-source zero-trust network access (ZTNA) platform operating at layer 3 of the OSI model, providing secure remote connectivity to resources including homelabs, VPCs, databases, subnets, IP addresses, DNS names, and SaaS applications. The system separates functionality into a control plane and a data plane: the control plane is hosted as a globally load-balanced SaaS on Microsoft Azure, consisting of a web-based admin portal, a WebSocket-based real-time API, and a policy engine implemented in Elixir and Phoenix with an Azure PostgreSQL database for persistence; the data plane consists of client applications, gateways, and relays, all built in Rust. The platform uses WireGuard for data plane encryption with ephemeral keys, TLS for control plane encryption, and implements STUN, TURN, and ICE protocols for NAT hole-punching with eBPF XDP-accelerated relay fallback. Core networking capabilities include split tunneling, full-tunnel routing via Internet Resource, DNS-based routing with a lightweight client-side DNS resolver, automatic NAT64, gateway load-balancing, automatic failover with 10-second keepalive detection, and support for both IPv4 and IPv6 resources with selective or full tunnel routing. The platform supports all TCP, UDP, and HTTP-based application protocols without modification.
Access control is managed through resource-level policies that associate user groups with resources, with conditional access rules based on location, IP address, identity provider, client verification status, and time of day. Authentication is supported via email OTP or OpenID Connect providers including Microsoft Entra ID, Google Workspace, Okta, and generic OIDC providers using the authorization_code grant type with PKCE, requiring openid, profile, and email scopes, with configurable session lifetimes, distinct authentication contexts for admin and client applications, and MFA enforcement delegated to identity providers; directory synchronization is available for automatic user provisioning on Enterprise plans. Client applications are available for macOS, Windows, Linux (GUI and headless), Android, ChromeOS, and iOS, maintaining separate control-plane event loops and data-plane state machines to handle WireGuard tunnels and STUN information without blocking data traffic. Gateways are lightweight Linux binaries requiring kernel 3.10+, x86_64/aarch64/armv7l architecture, iptables, and Docker or systemd, operating with CAP_NET_ADMIN to access the TUN device, open UDP sockets, and modify routes via netlink; a 4-core, 4 GB VM supports up to 1,000 clients with recommended link speeds of 2.5 Gbps+. Performance optimizations include batch processing of UDP datagrams, Generic Segmentation Offload (GSO), increased socket buffer sizes, and multi-threaded TUN device handling. The platform exposes a versioned RESTful API (v1.0) defined using OpenAPI Specification 3.0, supporting CRUD operations on Clients, Gateways, Resources, Policies, Actors, Groups, and external identities with bearer token authentication, session tracking with metadata, paginated endpoints, and queryable change logs for audit events.
