{"rid":"egress/firezone","card":{"rid":"egress/firezone","eid":"github-firezone","topic":"egress","slug":"firezone","provider":"Firezone","url":"https://github.com/firezone/firezone","domain":"github.com","category":"zero trust access built on WireGuard (private only)","tier":"free","verdict":"fails-egress","vorder":5,"grp":"rejected","confidence":"documented","binding":"none","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":2,"usd_month":null,"usd_per_tb_month":null,"summary":"'Firezone is a secure remote access platform built on WireGuard. Connect users to private applications, databases, servers, and subnets with granular policie...","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"firezone","provider":"Firezone","url":"https://github.com/firezone/firezone","category":"zero trust access built on WireGuard (private only)","tier":"free","free_tier":{"stated":"'Firezone is a secure remote access platform built on WireGuard. Connect users to private applications, databases, servers, and subnets with granular policies'. 'Sign up free' is offered with no number on the page read.","unit":"none","metered_on":"unstated","source_url":"https://github.com/firezone/firezone","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://github.com/firezone/firezone","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://github.com/firezone/firezone","notes":""},"egress":{"terms":"unverified: the pricing page renders client-side and its extracted text carries no plan numbers; ingress: none","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://github.com/firezone/firezone"},"interface":["cli"],"interface_detail":"Gateway deployment plus per-platform clients","tooling":"Firezone Gateway, the Firezone client (Apple, Android, Rust GUI), Docker","chaining":"a private access layer over a VPS; it publishes nothing, so it needs an ingress in front","limits":[],"limits_note":"","binding":"none","binding_note":"No published byte meter and no public listener. The design is the constraint: a Gateway 'in the network containing your Resources' answers authenticated Clients, not the internet.","identity_cost":{"kind":"email","detail":"app.firezone.dev sign-up","country":"None"},"reliability_note":"self-hosted production deployment is 'not officially supported'; published clients are only guaranteed against the managed service","confidence":"documented","confidence_note":"A rendered read of the pricing page would fill the missing numbers; it would not change the ingress verdict.","evidence":[{"url":"https://github.com/firezone/firezone","date":"2026-10-23","proved":"'a secure remote access platform built on WireGuard. Connect users to private applications, databases, servers, and subnets'; 'Gateways run in your infrastructure'"},{"url":"https://www.firezone.dev/pricing","date":"2026-10-23","proved":"the page returned 200 with an extraction that yields plan names only ('Starter: Free tier for small teams'), no numbers"}],"verdict":"fails-egress","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"The strongest WireGuard name that is still not an ingress: it is the same shape as Tailscale's private tailnet, not Funnel. Production self-hosting is explicitly unsupported, which matters if the plan was to run it on a free VPS.","extras":{"wg_path":"none","wg_detail":"WireGuard is the data plane but the client is the vendor's: 'WireGuard tunnels encrypt traffic between Clients and Gateways or between devices in a Device Pool'. No .conf export is documented.","ingress":"none","volume_tib_month":null,"volume_stated":"unverified: the pricing page renders client-side and its extracted text carries no plan numbers","bytes_transit":"yes","transit_note":"Client to Gateway over WireGuard, with Relays when a direct path fails"}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0,"unit":"TB","per":"month","currency":"USD","usd":0,"fx_date":null,"parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}