Tailscale
Remote Access & VPNZero-config mesh VPN built on WireGuard
Replaces ZeroTier
Best SSO Remote Access & VPN for self-hosting
The 9 best SSO remote access & vpn you can self-host, ranked by community traction.
JumpServer
Remote Access & VPNOpen-source bastion host and PAM platform
Replaces CyberArk, Teleport
NetBird
Remote Access & VPNConnect devices into a secure WireGuard-based overlay network
Replaces Tailscale, ZeroTier
Teleport
Remote Access & VPNIdentity-aware access for infrastructure
Replaces Cisco AnyConnect, AWS Systems Manager
Firezone
Remote Access & VPNOpen-source secure remote access platform
Replaces Cisco AnyConnect, Tailscale
Pritunl
Remote Access & VPNEnterprise VPN server built on OpenVPN and WireGuard
Replaces OpenVPN Access Server
Defguard
Remote Access & VPNWireGuard VPN and identity platform with MFA
Replaces OpenVPN Access Server, Twingate
Kasm Workspaces
Remote Access & VPNContainerized desktop and browser streaming platform
Replaces Citrix, Amazon WorkSpaces
Neutrinet
Remote Access & VPNAuto renewal for the Neutrinet vpn-certificates
No apps match these filters.
At a glance
| App | Deploy effort | Difficulty | Min. RAM | License | ★ Stars |
|---|---|---|---|---|---|
| Tailscale | Read-the-docs project | Easy | 64 MB | BSD-3-Clause | 37,460 |
| JumpServer | Under-an-hour setup | Medium | 4,096 MB | GPL-3.0 | 31,769 |
| NetBird | Under-an-hour setup | Medium | 256 MB | BSD-3-Clause | 29,940 |
| Teleport | Under-an-hour setup | Hard | 1,024 MB | AGPL-3.0 | 20,989 |
| Firezone | Under-an-hour setup | Medium | 1,024 MB | Apache-2.0 | 9,114 |
| Pritunl | Under-an-hour setup | Medium | 1,024 MB | AGPL-3.0 | 5,031 |
| Defguard | Under-an-hour setup | Medium | 512 MB | Apache-2.0 | 2,868 |
| Kasm Workspaces | Under-an-hour setup | Medium | 4,096 MB | Proprietary | 1,231 |
| Neutrinet | Read-the-docs project | Medium | 50 MB | AGPL-3.0-or-later | — |
Quick picks
- Most adopted: Tailscale (37,460 GitHub stars).
- Lightest footprint: Neutrinet (from 50 MB RAM, against 4,096 MB for the heaviest here).
- Licensing: 2 of 9 use BSD-3-Clause; check the rest individually if you plan to modify and redistribute.
Every option here is open-source and self-hostable, tagged SSO within the remote access & vpn category. Deploy effort is graded from published container recipes, not vendor claims — see the methodology.