Pangolin
Pangolin is an open source, identity-aware tunneled reverse-proxy platform that lets you securely expose applications from any location without opening inbound ports or requiring a traditional VPN. It uses a distributed architecture of globally available nodes to route traffic through encrypted WireGuard tunnels, enabling devices behind NATs or firewalls to serve applications publicly via a central dashboard. Through the unified dashboard, you can manage sites and resources across your infrastructure, define granular access-control rules (such as SSO, OIDC, PINs, geolocation, and IP restrictions), and monitor real-time health and usage metrics. The system supports self-hosting (Community or Enterprise editions) or a managed cloud option, and works by installing a lightweight agent on each site while using the central control server to handle ingress, routing, authentication, and failover.
Learn more
StrongVPN
StrongVPN is your fast and easy solution for navigating a truly open internet. Connect to StrongVPN with WireGuard®, a state-of-the-art VPN protocol. WireGuard outperforms other protocol options with its industry-leading speed, security, and performance. Experience WireGuard, a next-generation VPN protocol that delivers industry-leading speed, security, and performance. StrongVPN is proud to be one of the first commercial VPN providers to offer WireGuard across all of our apps and platforms.
Learn more
Mozilla VPN
Security you can rely on. A name you can trust. A VPN from the trusted pioneer in internet privacy. We use the most advanced protocol, WireGuard®, to encrypt your network activity and hide your IP address. Surf, stream, game, and get work done with fast network speed using our WireGuard® powered servers. Your privacy comes first. We don’t store your online activity logs on our servers. The Mozilla VPN runs on a global network of servers powered by Mullvad using the WireGuard® protocol. Mullvad puts your privacy first and does not keep logs of any kind.
Learn more
Headscale
Headscale is an open-source, self-hosted implementation of the control server used by the Tailscale network, enabling users to keep full ownership of their private tailnets while using Tailscale clients. It supports registering users and nodes, issuing pre-authentication keys, advertising subnet-routes and exit-node capabilities, enforcing access-control lists, and integrating with OIDC/SAML identity providers for user authentication. The server is deployable via Debian/Ubuntu packages or standalone binaries, configurable through a YAML file, and managed via its CLI or REST API. Headscale tracks each node, route, and user in its database, supports route approval workflows, and enables features such as subnet routing, exit node designation, and node-to-node mesh within the tailnet. Being self-hosted, it gives organizations and hobbyists full control over their private network endpoints, encryption keys, and traffic flows, rather than depending on a commercial control plane.
Learn more