firezone gui-client-1.5.16

Blazing-fast remote access with identity-based policies, attested device trust, and detailed audit logs

Documentation | Quickstart | Download Clients | Support

---

---

Overview

Firezone is a secure remote access platform built on WireGuard®. Connect users to private applications, databases, servers, and subnets with granular policies that define who can access each Resource and under what conditions.

Combine identity-based access with cryptographic device verification and detailed audit records. Gateways run in your infrastructure, and the full product source is available for inspection in this repository.

Getting Started

Cloud (recommended)

Sign up free and follow the Quickstart to:

1. Deploy a Gateway in the network containing your Resources. See the Gateway sizing documentation for sizing and configuration guidance.
2. Define Resources and policies that grant access to the appropriate groups.
3. Install a Client, sign in, and connect to an authorized Resource.

For plan details and feature availability, see pricing.

Self-hosting

The licenses permit self-hosting, subject to their terms. Production self-hosting is not officially supported. For development or evaluation, follow CONTRIBUTING.md to run a local environment.

Published Clients are only guaranteed to work with the managed service. Internal APIs change, and app store releases may lag behind this repository. A self-hosted portal may require Clients built from a compatible revision. Build instructions are available in swift/apple, kotlin/android, and rust/gui-client.

Features

• Least-privilege access: Grant groups access to specific Resources through policies, including conditions that require device attestation.
• Device Trust: Require cryptographic device verification in addition to user authentication, using X.509 certificates issued by your MDM or enterprise PKI. Learn more.
• Audit Logs: Track configuration changes, sessions, API requests, and traffic flows with 90-day retention. Export records to your SIEM through Log Sinks. Learn more.
• Device Pools: Create a peer-to-peer mesh of devices with encrypted Client-to-Client WireGuard tunnels, without deploying a Gateway. Policies control which groups can reach the devices in each pool. Learn more.
• Identity provider integration: Authenticate with Google Workspace, Okta, Microsoft Entra ID, or OIDC. Directory sync keeps users and groups aligned with your identity provider.
• Encrypted connectivity: WireGuard tunnels encrypt traffic between Clients and Gateways or between devices in a Device Pool. Direct connections reduce routing overhead; Relays carry encrypted traffic when a direct connection cannot be established.
• Distributed deployment: Deploy Gateways near your Resources across cloud and on-premises environments. Use multiple Gateways for load balancing and failover.
• Cross-platform access: Clients are available for Windows, macOS, Linux, iOS, and Android, with headless clients for automated workloads.
• Compliance: The managed service is SOC 2 Type II compliant. See the Trust Center.

See the architecture documentation for details on the control plane, data plane, and connection lifecycle.

Performance

Firezone is committed to achieving the fastest possible speeds on every platform. Its shared Rust data plane combines WireGuard encryption with platform-specific I/O optimizations to reduce system calls, task wake-ups, and per-packet overhead.

Throughput

Platform	Throughput (as tested)
iOS	2+ Gbps
Android	2+ Gbps
Windows	5+ Gbps
macOS	5+ Gbps
Linux	5+ Gbps on commodity VMs / 10+ Gbps on tuned hardware

Throughput varies with round-trip latency, packet loss, hardware, network capacity, and workload.

Platform-specific optimizations

Firezone combines packet batching with each platform's available offloads to process more packets with fewer system calls and wake-ups.

• macOS and iOS: kqueue-backed readiness through Tokio/Mio, with batched sendmsg_x / recvmsg_x calls for both UDP sockets and the utun interface. A cache of connected UDP sockets enables Darwin's fast send path and flow advisories for active peers.
• Windows: Batched packet transfer to and from WinTUN, with support for TCP coalescing before injection into its ring buffer. UDP sockets use segmentation offload (USO) and receive coalescing (URO) where supported.
• Android: UDP GSO/GRO where supported by the device's kernel.
• Linux: UDP GSO/GRO plus TCP and UDP segmentation and checksum offloads on the TUN interface.

Network path optimizations

The bandwidth-delay product means throughput is a function of round-trip latency. Firezone keeps network paths short to minimize that latency.

Direct peer connections form on demand through a custom NAT traversal system optimized for time to first byte. By piggybacking connection establishment on the WireGuard handshake, connections to new peers are typically ready in 200 ms or less.