# Alternatives to innernet innernet is an open-source tool built by Tonari that wraps raw WireGuard to automate peer key exchange and IP address allocation for private mesh networks, similar in goal to Nebula and early Tailscale. It ships an innernet-server for the control plane plus a lightweight client, aimed at small teams and homelab operators who want a mesh network without a hosted SaaS control plane. It remains actively maintained with regular commits. innernet ranks #10 of 11 in Mesh VPNs, with an Alt Score of 62. It is licensed under MIT, free from Free and available on Linux and macOS. 11 of 12 checklist rows are verified against a public source. Source: https://altcatalog.com/alternatives/innernet/ Category: Mesh VPNs ## Overview - **Who it's for**: innernet is aimed at technical teams and individuals who want to run their own private WireGuard-based network rather than use a hosted mesh VPN provider. It suits organizations comfortable operating a Linux or macOS server and managing CIDR-based network structure themselves. - **What you get**: You get an MIT-licensed, self-hosted coordination server (innernet-server) and a matching CLI client (innernet) that together manage WireGuard keys, peer IP assignment, and CIDR-based groupings. Peers are onboarded via one-time invitation files, can be enabled or disabled, and get automatic /etc/hosts entries for name-based resolution of other peers. - **How it works**: An admin runs innernet-server to create a root network CIDR and an 'infra' CIDR containing the server itself, then adds further CIDRs (e.g. a 'humans' group) and peers. Peers in different CIDRs can only reach each other once their CIDRs are explicitly associated, giving CIDR-scoped access control on top of a standard WireGuard mesh; the server also tracks and shares each peer's internet endpoint so peers can connect to one another directly. ## Profile - **License**: MIT (verified 2026-07-30) - **Pricing model**: Free (verified 2026-07-30) - **Starts at**: Free (verified 2026-07-30) - **Platforms**: Linux, macOS - **Status**: active (verified 2026-07-30) ## Ranked alternatives | # | App | Alt Score | Licence | Platforms | |---|-----|-----------|---------|-----------| | 1 | [NetBird](https://altcatalog.com/alternatives/netbird.md) | 93 | BSD-3-Clause | Windows, macOS, Linux, iOS | | 2 | [ZeroTier](https://altcatalog.com/alternatives/zerotier.md) | 93 | MPL-2.0 | Windows, macOS, Linux, iOS | | 3 | [Firezone](https://altcatalog.com/alternatives/firezone.md) | 85 | Apache-2.0 + Elastic License 2.0 | Windows, macOS, Linux, iOS | | 4 | [Headscale](https://altcatalog.com/alternatives/headscale.md) | 81 | BSD-3-Clause | Windows, macOS, Linux, iOS | | 5 | [Netmaker](https://altcatalog.com/alternatives/netmaker.md) | 78 | Apache-2.0 | Windows, macOS, Linux, iOS | | 6 | [OpenZiti](https://altcatalog.com/alternatives/openziti.md) | 78 | Apache-2.0 | Windows, macOS, Linux, iOS | | 7 | [Tailscale](https://altcatalog.com/alternatives/tailscale.md) | 78 | BSD-3-Clause | Windows, macOS, Linux, iOS | | 8 | [Defguard](https://altcatalog.com/alternatives/defguard.md) | 70 | AGPL-3.0 (core), Proprietary (enterprise module) | Windows, macOS, Linux, iOS | | 9 | [Nebula](https://altcatalog.com/alternatives/nebula.md) | 70 | MIT | Windows, macOS, Linux, iOS | | 10 | [WireGuard](https://altcatalog.com/alternatives/wireguard.md) | 40 | GPL-2.0 | Windows, macOS, Linux, iOS | Alt Score = Verified coverage (90%) + Visibility (10%). See https://altcatalog.com/how-alt-score-works/ ## Feature comparison Legend: Yes / No / Partial / ? (not verified). | Mesh VPNs checklist | innernet | NetBird | ZeroTier | Firezone | Headscale | Netmaker | |---|---|---|---|---|---|---| | Pricing model | Free | OSS + paid hosting | Freemium | Freemium | Free | OSS + paid hosting | | Starts at | Free | Free | Free | $5/user/mo | Free | $2/connection/month | | License | MIT | BSD-3-Clause | MPL-2.0 | Apache-2.0 + Elastic License 2.0 | BSD-3-Clause | Apache-2.0 | | Platforms | Linux, macOS | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | Windows, macOS, Linux, iOS, Android | | WireGuard-based | Yes | Yes | No | Yes | Yes | Yes | | Self-hostable control plane | Yes | Yes | Yes | No | Yes | Yes | | NAT traversal | Yes | Yes | Yes | Yes | Yes | Yes | | Exit nodes | No | Yes | Yes | Yes | Yes | Yes | | ACLs / access rules | Yes | Yes | Yes | Yes | Yes | ? | | SSO integration | No | Yes | Yes | Yes | Yes | Yes | | Device limit (free tier) | ? | Yes | Yes | Yes | No | Yes | | MagicDNS-style naming | Yes | Yes | Yes | Partial | Yes | Partial | | Subnet routing | Yes | Yes | Yes | Yes | Yes | Yes | | Open source clients | Yes | Yes | Yes | Yes | Partial | Partial | | Audit published | No | ? | Yes | Partial | ? | ? | | Mobile support | No | Yes | Yes | Yes | Yes | Yes | ## Sources Sources for innernet. Each alternative is sourced on its own page. - **License**: MIT — (verified 2026-07-30) - Quote: “MIT License” - **Status**: active — (verified 2026-07-30) - Note: Latest release v2.0.0 tagged 2026-07-02 (marked 'Latest' on the releases page); repo has commits pushed as recently as 2026-07-28. Not dormant. - Quote: “strohel released this 02 Jul 07:49” - **Pricing model**: Free — (verified 2026-07-30) - Note: innernet is self-hosted OSS from tonarino with no commercial product or pricing page; there is no paid tier to compare against, only the MIT license grant. - Quote: “Permission is hereby granted, free of charge, to any person obtaining a copy of this software” - **Starts at**: Free — (verified 2026-07-30) - Note: No paid tier exists anywhere in the docs or repo; software is MIT-licensed and self-hosted only. - Quote: “Permission is hereby granted, free of charge, to any person obtaining a copy of this software” - **Platforms**: Linux, macOS — (verified 2026-07-30) - Note: OpenBSD support exists but is called 'experimental' and isn't in the platform vocabulary. No Windows, iOS, Android, Web, or browser-extension support is documented anywhere in the repo. - Quote: “`innernet` has only been officially tested on Linux and macOS. Experimental OpenBSD support has been added recently.” - **WireGuard-based**: Yes — (verified 2026-07-30) - Quote: “A private network system that uses [WireGuard](https://wireguard.com) under the hood.” - **Self-hostable control plane**: Yes — (verified 2026-07-30) - Quote: “Every `innernet` network needs a coordination server to manage peers and provide endpoint information so peers can directly connect to each other.” - **NAT traversal**: Yes — (verified 2026-07-30) - Note: The server also auto-detects each peer's internet-visible endpoint so peers can connect directly; see README section 'Specifying a Manual Endpoint'. - Quote: “normal peer endpoint/NAT traversal will be restored on the next call to 'innernet fetch'” - **Exit nodes**: No — (verified 2026-07-30) - Note: associated" with each other." — This section (and the rest of the README/source) describes only explicit CIDR-to-CIDR association for routing; no default-route/'send all traffic through one peer' exit-node concept is documented anyw - Quote: “In order for peers from one CIDR to be able to contact peers in another CIDR, those two CIDRs must be ” - **ACLs / access rules**: Yes — (verified 2026-07-30) - Quote: “turn your computer's basic IP networking into more powerful ACL primitives” - **SSO integration**: No — (verified 2026-07-30) - Note: Peer onboarding is invitation-file based (a WireGuard keypair exchange). No SSO/OAuth/SAML integration is mentioned anywhere in the README or source. - Quote: “This file contains just enough information for the new peer to contact the `innernet` server and redeem its invitation.” - **MagicDNS-style naming**: Yes — (verified 2026-07-30) - Note: This is /etc/hosts-based name resolution for peers, not a dedicated DNS service; can be disabled with --no-write-hosts. - Quote: “By default, innernet will write to your /etc/hosts file for peer name resolution.” - **Subnet routing**: Yes — (verified 2026-07-30) - Note: innernet's addressing/ACL model is built entirely on CIDR subnets and cross-CIDR associations (see 'Adding Associations between CIDRs'). This is internal network subnetting, not advertising an externa - Quote: “It's good to familiarize yourself with [network CIDRs](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) as a lot of innernet's access control is based upon them.” - **Open source clients**: Yes — (verified 2026-07-30) - Note: The whole repo, including the client/ crate that builds the innernet CLI client, ships under this MIT grant. - Quote: “Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files” - **Audit published**: No — (verified 2026-07-30) - Quote: “This has not received an independent security audit, and should be considered experimental software at this early point in its lifetime.” - **Mobile support**: No — (verified 2026-07-30) - Quote: “`innernet` has only been officially tested on Linux and macOS. Experimental OpenBSD support has been added recently.” --- Ranked by verified data, never by who paid. https://altcatalog.com/trust/