# Top 7 Open-Source Zero Trust and ZTNA Tools Source: https://startwithidentity.com/articles/top-7-open-source-zero-trust-tools/ Last updated: 2026-08-29 License: content by Start with Identity. Cite the source URL. --- [Zero trust](https://startwithidentity.com/guides/fundamentals/what-is-zero-trust/) is a set of principles, not a product, and the open-source ecosystem reflects that by solving different parts of it. Some tools front web applications with an identity-aware proxy. Some build an overlay network where every endpoint carries a cryptographic identity. Some broker privileged access to infrastructure. Choosing well means naming which of those problems you actually have before comparing feature lists. Licensing deserves scrutiny in this category specifically. HashiCorp moved its products to the Business Source License in August 2023, which is source-available rather than OSI open source, and several commercial tools describe a proprietary control plane with an open-source client as "open source". This guide states the license for each entry. For the commercial landscape see the [zero trust vendor category](https://startwithidentity.com/vendors/zero-trust/) and [best zero trust tools](https://startwithidentity.com/rankings/best-zero-trust-tools/). ## Evaluation Criteria We assessed each tool against the following dimensions: - **Architecture**, identity-aware proxy, overlay network, or access broker - **License**, OSI-approved open source versus source-available - **Protocol coverage**, HTTP only versus arbitrary TCP, SSH, Kubernetes, and databases - **Identity integration**, OIDC and SAML support and policy expressiveness - **Operational burden**, what running the control plane actually requires - **Audit and session recording**, what evidence the tool produces - **Community and governance**, project health and vendor independence ## The Top 7 Open-Source Zero Trust Tools ### 1. OpenZiti **Best For:** Teams that want a genuinely open, protocol-agnostic zero trust overlay with no proprietary control plane. **Overview** OpenZiti, maintained by NetFoundry, is the most complete fully open-source zero trust networking platform. Every connection is authenticated with a cryptographic identity, authorized by policy, and encrypted end to end, and services are invisible to unauthorized users because there is no listening port to find. It ships SDKs for several languages so applications can be "zero trust native" with no tunneler, plus tunnelling apps where you cannot modify the application. **Key Features** - Apache 2.0 across the whole platform including the control plane - Cryptographic identity per endpoint, with policy-based service authorization - Application-embedded SDKs as well as host and edge tunnellers - Outbound-only connections, so no inbound firewall exposure - Protocol-agnostic, not limited to HTTP **License** Apache 2.0 (true open source), across client and control plane. **Pros** - The most complete open-source story in the category, with nothing held back commercially - SDK model removes the network entirely for applications you control - Works for arbitrary TCP, not just web applications **Cons** - Concepts (identities, services, policies, edge routers) take real time to learn - Running the controller and routers highly available is your job - Smaller talent pool than commercial alternatives --- ### 2. Pomerium **Best For:** Fronting internal web applications with per-request authorization tied to your identity provider. **Overview** Pomerium is an identity-aware reverse proxy: it sits in front of an application, authenticates users against your [OIDC](https://startwithidentity.com/standards/openid-connect/) provider, and evaluates policy on every request rather than issuing a network session. The application is never directly reachable and nobody joins a network. It supports context in policy including identity, group, device, and request attributes, and is the closest open-source analogue to a commercial identity-aware access product. **Key Features** - Per-request authorization against identity, group, and device context - OIDC and SAML integration with major identity providers - Continuous verification rather than a one-time gate at connect - Kubernetes ingress controller support - Audit logging of access decisions **License** Apache 2.0, with an enterprise console offered commercially. **Pros** - Straightforward mental model that maps cleanly onto zero trust principles - Excellent fit for the majority case, which is internal web applications - Deploys well in Kubernetes **Cons** - HTTP-centric, so non-web protocols need another tool - Advanced management and reporting sit in the commercial console - You operate the proxy on the critical path for every request --- ### 3. Teleport **Best For:** Engineering access to SSH, Kubernetes, databases, and internal applications with session recording. **Overview** [Teleport](https://startwithidentity.com/vendors/pam/teleport/) brokers access to infrastructure with short-lived certificates instead of static keys, covering SSH, Kubernetes, databases, and web applications from one control plane. Sessions are recorded and access is tied to identity from your provider, which is why it appears in [privileged access](https://startwithidentity.com/guides/fundamentals/what-is-pam/) evaluations as often as in zero trust ones. The community edition is open source; identity governance, device trust, and several enterprise capabilities are commercial. **Key Features** - Short-lived certificate-based access, replacing long-lived SSH keys - Unified access to SSH, Kubernetes, databases, and web apps - Session recording and audit trail across protocols - Machine ID for workload access alongside human access - SSO integration with major identity providers **License** Open source community edition (AGPL-3.0 for the core since 2023); enterprise features are commercially licensed. **Pros** - Removes standing SSH keys, which is a genuine risk reduction rather than a control layer - Covers the protocols engineers actually use - Session recording produces the evidence auditors ask for **Cons** - Community and enterprise feature split is significant - Operating the cluster is a real commitment - Overlaps with your PAM purchase, so scope carefully --- ### 4. Headscale **Best For:** Teams that want Tailscale's mesh model with a self-hosted control plane. **Overview** Headscale is an open-source, self-hosted implementation of the Tailscale control server. The official [Tailscale](https://startwithidentity.com/vendors/zero-trust/tailscale/) clients are open source but its coordination server is not, and Headscale fills that gap for organizations that cannot send coordination metadata to a third party or want full control of the ACL policy. It supports the WireGuard mesh, ACL policy files, and OIDC authentication. **Key Features** - Self-hosted control plane compatible with official Tailscale clients - WireGuard-based peer-to-peer mesh with NAT traversal - ACL policy expressed as a file you can version control - OIDC authentication for user identity **License** BSD-3-Clause. **Pros** - Removes the third-party coordination dependency that rules Tailscale out for some organizations - Policy as a version-controlled file fits infrastructure-as-code practice - Uses the mature, widely deployed Tailscale clients **Cons** - Community project, not supported by Tailscale - Feature lag behind the commercial control plane - Single point of failure unless you engineer around it --- ### 5. NetBird **Best For:** Organizations wanting a self-hostable WireGuard overlay with a managed option and a European base. **Overview** NetBird is an open-source overlay network built on WireGuard with an identity-aware access control layer, offering both self-hosted and managed deployments. It raised Series A funding in January 2026 positioning itself as a European alternative to US-based ZTNA vendors, which matters for organizations with data sovereignty constraints. Setup is deliberately simpler than OpenZiti's, at the cost of some flexibility. **Key Features** - WireGuard mesh with automatic peer discovery and NAT traversal - Access control policies tied to identity provider groups - Self-hosted or managed deployment from the same codebase - OIDC integration and device posture checks - Network routes for reaching non-agent resources **License** AGPL-3.0 (BSD-3-Clause for the client). **Pros** - Notably easier to stand up than most of this list - Genuine self-hosting option with a managed fallback - European operating base for sovereignty-constrained buyers **Cons** - Younger project with a smaller production track record - Less protocol flexibility than OpenZiti's SDK model - Some management features favour the managed offering --- ### 6. HashiCorp Boundary **Best For:** Teams already standardized on HashiCorp tooling that accept source-available licensing. **Overview** [HashiCorp Boundary](https://startwithidentity.com/vendors/pam/hashicorp-boundary/) provides identity-based access to infrastructure without distributing credentials or exposing networks, with tight integration into Vault for dynamic credential injection. The important caveat is licensing: HashiCorp relicensed its products from MPL 2.0 to the Business Source License 1.1 in August 2023, so Boundary is source-available with restrictions on competitive use rather than open source. Unlike Vault, which has the Linux Foundation's OpenBao fork under MPL 2.0, Boundary has no widely adopted open fork. **Key Features** - Identity-based session brokering to hosts, databases, and services - Dynamic credential injection through Vault integration - Session recording in the enterprise tier - Host catalogs that discover targets dynamically - Terraform-native configuration **License** Business Source License 1.1 (source-available, not OSI open source) since August 2023. **Pros** - Excellent fit if Vault and Terraform are already your platform - Dynamic credentials mean nothing long-lived is distributed - Infrastructure-as-code management throughout **Cons** - Not open source under the OSI definition, which rules it out for some organizations - Value depends heavily on also running Vault - No community fork to fall back on, unlike Vault and OpenBao --- ### 7. Authelia **Best For:** Small deployments that need authentication and authorization in front of self-hosted services. **Overview** [Authelia](https://startwithidentity.com/vendors/open-source/authelia/) is a lightweight authentication and authorization server designed to sit alongside a reverse proxy such as nginx, Traefik, or Caddy, providing single sign-on, multi-factor authentication, and per-resource access rules for self-hosted applications. It is not a full ZTNA platform, and it is the pragmatic answer for a homelab or small team that wants an identity gate in front of services without operating an overlay network. **Key Features** - Forward-auth integration with common reverse proxies - Multi-factor authentication including TOTP, WebAuthn, and Duo - Per-resource access control rules in a config file - LDAP and file-based user backends - OIDC provider capability for downstream applications **License** Apache 2.0. **Pros** - Very low operational burden for the value delivered - Supports [WebAuthn](https://startwithidentity.com/standards/webauthn-fido2/), so phishing-resistant authentication is available - Clear configuration that is easy to review and version **Cons** - Depends on a reverse proxy, so it is a component rather than a platform - Not designed for large, multi-team deployments - No overlay networking or non-HTTP protocol support --- ## How to choose Pick the architecture first, then the tool. **Internal web applications** are the majority of most access problems, and an identity-aware proxy is the right shape. Pomerium for a real deployment, Authelia for something small. **Engineering access to infrastructure** (SSH, Kubernetes, databases) needs an access broker with session recording and short-lived credentials. Teleport is the strongest open-source answer, with Boundary as an option if you accept source-available licensing and already run Vault. **Service-to-service and non-HTTP traffic** needs an overlay. OpenZiti if you want maximum control and true open source, NetBird or Headscale if a WireGuard mesh with simpler operations fits better. Whatever you choose, the migration bottleneck is the same and it is not technical: an inventory of every internal application, who should reach it, and which systems currently depend on flat network access. Both open-source and commercial vendors will help you deploy; neither can produce that list for you. Pair the rollout with [device posture](https://startwithidentity.com/glossary/device-posture/) signal, because identity alone is only half of a zero trust decision. ## Related reading - [Tailscale vs Cloudflare](https://startwithidentity.com/compare/tailscale-vs-cloudflare/) and [Cloudflare vs Zscaler](https://startwithidentity.com/compare/cloudflare-vs-zscaler/) for the commercial comparison - [What is zero trust](https://startwithidentity.com/guides/fundamentals/what-is-zero-trust/) and [ZTNA](https://startwithidentity.com/glossary/ztna/) - [Top 8 zero trust network access tools](https://startwithidentity.com/articles/top-8-zero-trust-network-access-tools/) - [Top 10 open-source IAM solutions](https://startwithidentity.com/articles/top-10-open-source-iam-solutions/) ## The open-source identity landscape This is one of a series covering open-source tooling across every identity category: - [Open-source IAM solutions](https://startwithidentity.com/articles/top-10-open-source-iam-solutions/) - [Open-source CIAM platforms](https://startwithidentity.com/articles/top-8-open-source-ciam-platforms/) - [Open-source IGA tools](https://startwithidentity.com/articles/top-5-open-source-iga-tools/) - [Open-source PAM solutions](https://startwithidentity.com/articles/top-7-open-source-pam-solutions/) - [Open-source MFA and passwordless tools](https://startwithidentity.com/articles/top-6-open-source-mfa-passwordless-tools/) - [Open-source authorization tools](https://startwithidentity.com/articles/top-7-open-source-authorization-tools/) - [Open-source secrets management](https://startwithidentity.com/articles/top-6-open-source-secrets-management/) - [Open-source password managers](https://startwithidentity.com/articles/top-7-open-source-password-managers/) - [Open-source machine and workload identity](https://startwithidentity.com/articles/top-6-open-source-machine-identity-tools/) - [Open-source PKI and certificate management](https://startwithidentity.com/articles/top-6-open-source-pki-certificate-management-tools/) - [Open-source directory services and LDAP servers](https://startwithidentity.com/articles/top-6-open-source-directory-services/) - [Open-source Active Directory security tools](https://startwithidentity.com/articles/top-7-open-source-active-directory-security-tools/) - [Open-source decentralized identity tools](https://startwithidentity.com/articles/top-7-open-source-decentralized-identity-tools/) - [Open-source cloud entitlement and CIEM tools](https://startwithidentity.com/articles/top-7-open-source-cloud-entitlement-ciem-tools/) - [Open-source secrets scanning and NHI tools](https://startwithidentity.com/articles/top-6-open-source-secrets-scanning-nhi-tools/)