Alternatives to innernet
Private WireGuard mesh network manager with automated peer/IP management
innernet ranks #10 of 11 in Mesh VPNs, with an Alt Score of 62. It is licensed under MIT, free from Free and available on Linux and macOS. 11 of 12 checklist rows are verified against a public source.
innernet is an open-source tool built by Tonari that wraps raw WireGuard to automate peer key exchange and IP address allocation for private mesh networks, similar in goal to Nebula and early Tailscale. It ships an innernet-server for the control plane plus a lightweight client, aimed at small teams and homelab operators who want a mesh network without a hosted SaaS control plane. It remains actively maintained with regular commits.
innernet is aimed at technical teams and individuals who want to run their own private WireGuard-based network rather than use a hosted mesh VPN provider. It suits organizations comfortable operating a Linux or macOS server and managing CIDR-based network structure themselves.
You get an MIT-licensed, self-hosted coordination server (innernet-server) and a matching CLI client (innernet) that together manage WireGuard keys, peer IP assignment, and CIDR-based groupings. Peers are onboarded via one-time invitation files, can be enabled or disabled, and get automatic /etc/hosts entries for name-based resolution of other peers.
An admin runs innernet-server to create a root network CIDR and an 'infra' CIDR containing the server itself, then adds further CIDRs (e.g. a 'humans' group) and peers. Peers in different CIDRs can only reach each other once their CIDRs are explicitly associated, giving CIDR-scoped access control on top of a standard WireGuard mesh; the server also tracks and shares each peer's internet endpoint so peers can connect to one another directly.
Why people leave innernet
Dashed reasons are sourced facts; the rest are opinions. Vendors can dispute.
Sign in to add a reason — new reasons go through moderation before appearing.
Ranked alternatives
Ordered by Alt Score. Click any score to see the breakdown.
Firezone is an open-source, self-hostable remote access platform built on WireGuard that creates direct, encrypted peer connections between users and internal resources through lightweight gateways.
Headscale is an open-source coordination/control server that is API-compatible with the official Tailscale client apps, letting teams self-host their own control plane while keeping the same mobile an.
OpenZiti is an open-source, programmable zero-trust networking platform stewarded by NetFoundry that builds an overlay fabric of routers and identities instead of exposing listening ports on hosts.
Defguard is an open-source, Rust-built WireGuard VPN manager that adds multi-factor authentication, an identity/SSO gateway, and a web UI for managing peers, gateways, and access policies.
Nebula is an open-source peer-to-peer mesh networking tool originally built and battle-tested internally at Slack before being open-sourced.
Feature comparison
Rows come from the Mesh VPNs checklist (16 rows). Human-verified cells only. ? means the value has not been verified.
| Mesh VPNs checklist | innernet | NetBird | ZeroTier | Firezone | Headscale | Netmaker |
|---|---|---|---|---|---|---|
| Pricing model | ||||||
| Starts at | ||||||
| License | ||||||
| Platforms | ||||||
| WireGuard-based | ||||||
| Self-hostable control plane | ||||||
| NAT traversal | ||||||
| Exit nodes | ||||||
| ACLs / access rules | ||||||
| SSO integration | ||||||
| Device limit (free tier) | ||||||
| MagicDNS-style naming | ||||||
| Subnet routing | ||||||
| Open source clients | ||||||
| Audit published | ||||||
| Mobile support |
Every fact and feature listed for innernet is verified against its own pages. Each alternative is sourced on its own page.
-
License MIT verified 2026-07-30
MIT License
https://github.com/tonarino/innernet/blob/main/LICENSE -
Status active verified 2026-07-30
Latest release v2.0.0 tagged 2026-07-02 (marked 'Latest' on the releases page); repo has commits pushed as recently as 2026-07-28. Not dormant.
strohel released this 02 Jul 07:49
https://github.com/tonarino/innernet/releases/tag/v2.0.0 -
Pricing model Free verified 2026-07-30
innernet is self-hosted OSS from tonarino with no commercial product or pricing page; there is no paid tier to compare against, only the MIT license grant.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software
https://github.com/tonarino/innernet/blob/main/LICENSE -
Starts at Free verified 2026-07-30
No paid tier exists anywhere in the docs or repo; software is MIT-licensed and self-hosted only.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software
https://github.com/tonarino/innernet/blob/main/LICENSE -
Platforms Linux, macOS verified 2026-07-30
OpenBSD support exists but is called 'experimental' and isn't in the platform vocabulary. No Windows, iOS, Android, Web, or browser-extension support is documented anywhere in the repo.
`innernet` has only been officially tested on Linux and macOS. Experimental OpenBSD support has been added recently.
https://github.com/tonarino/innernet/blob/main/README.md -
WireGuard-based Yes verified 2026-07-30
A private network system that uses [WireGuard](https://wireguard.com) under the hood.
https://github.com/tonarino/innernet/blob/main/README.md -
Self-hostable control plane Yes verified 2026-07-30
Every `innernet` network needs a coordination server to manage peers and provide endpoint information so peers can directly connect to each other.
https://github.com/tonarino/innernet/blob/main/README.md -
NAT traversal Yes verified 2026-07-30
The server also auto-detects each peer's internet-visible endpoint so peers can connect directly; see README section 'Specifying a Manual Endpoint'.
normal peer endpoint/NAT traversal will be restored on the next call to 'innernet fetch'
https://github.com/tonarino/innernet/blob/main/client/src/main.rs -
Exit nodes No verified 2026-07-30
associated" with each other." — This section (and the rest of the README/source) describes only explicit CIDR-to-CIDR association for routing; no default-route/'send all traffic through one peer' exit-node concept is documented anyw
In order for peers from one CIDR to be able to contact peers in another CIDR, those two CIDRs must be
https://github.com/tonarino/innernet/blob/main/README.md -
ACLs / access rules Yes verified 2026-07-30
turn your computer's basic IP networking into more powerful ACL primitives
https://github.com/tonarino/innernet/blob/main/README.md -
SSO integration No verified 2026-07-30
Peer onboarding is invitation-file based (a WireGuard keypair exchange). No SSO/OAuth/SAML integration is mentioned anywhere in the README or source.
This file contains just enough information for the new peer to contact the `innernet` server and redeem its invitation.
https://github.com/tonarino/innernet/blob/main/README.md -
MagicDNS-style naming Yes verified 2026-07-30
This is /etc/hosts-based name resolution for peers, not a dedicated DNS service; can be disabled with --no-write-hosts.
By default, innernet will write to your /etc/hosts file for peer name resolution.
https://github.com/tonarino/innernet/blob/main/client/src/main.rs -
Subnet routing Yes verified 2026-07-30
innernet's addressing/ACL model is built entirely on CIDR subnets and cross-CIDR associations (see 'Adding Associations between CIDRs'). This is internal network subnetting, not advertising an externa
It's good to familiarize yourself with [network CIDRs](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) as a lot of innernet's access control is based upon them.
https://github.com/tonarino/innernet/blob/main/README.md -
Open source clients Yes verified 2026-07-30
The whole repo, including the client/ crate that builds the innernet CLI client, ships under this MIT grant.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files
https://github.com/tonarino/innernet/blob/main/LICENSE -
Audit published No verified 2026-07-30
This has not received an independent security audit, and should be considered experimental software at this early point in its lifetime.
https://github.com/tonarino/innernet/blob/main/README.md -
Mobile support No verified 2026-07-30
`innernet` has only been officially tested on Linux and macOS. Experimental OpenBSD support has been added recently.
https://github.com/tonarino/innernet/blob/main/README.md
FAQ
Yes. ZeroTier, Firezone and Headscale have a free tier or are fully free. Free-tier limits in the comparison table are verified and dated.
NetBird, ZeroTier and Firezone — every license claim links its source.