Readit News logoReadit News
Posted by u/jamilbk a year ago
Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
Hi HN! I'm Jamil Bou Kheir, founder of Firezone (https://www.firezone.dev), a remote access platform that is a replacement for legacy corporate VPNs. Built on WireGuard (a fast, modern VPN protocol), Firezone secures your team’s apps, networks and services using access policies synced with your identity provider. You deploy tiny, self-contained binaries into your infrastructure anywhere you need access, and your workforce uses our client apps to reach the resources they protect.

Here’s a demo: https://youtu.be/QEv7dJwKMvo.

Historically, the tool used to achieve this has been the corporate VPN. These work off a security model where you authenticate with the perimeter and gain access to the network behind it, which works when most workers are in office and resources on-prem. But as workers go remote and resources move to the cloud, the perimeter blurs, making it harder to secure.

I experienced this issue first-hand as a security engineer hunting for APT malware on Cisco's intranet. Malware often landed first on remote employee laptops, then spread from there to critical internal systems. Firewalls were somewhat effective at solving this problem, but they were clunky—it could take months for Infosec to approve requests to allow your team’s app or services through.

When Covid forced everyone to work from home, even Cisco struggled to grapple with the increased demand on its VPN concentrators. The perimeter defense model meant that we had to VPN into the intranet to get anything done, and if the speeds were really bad, we couldn't work that day.

One way to solve the above problems is to break up the single perimeter into many smaller ones, shifting them closer to the resources they protect. That way, compromising one perimeter does not gain you access to all others, and traffic is not bottlenecked through a single choke point. However, now you have many VPN tunnels instead of one, and most VPN protocols are too heavyweight for this.

If Cisco was facing these issues with remote access, I thought, others must be facing similar problems. So when WireGuard came along, I started Firezone.

WireGuard tunnels are so lightweight you can open thousands of them from an iPhone to whatever resources you need access to. Firezone builds on that and also handles NAT traversal, so you don’t need to change your firewall configuration to use it. Just deploy Gateways - small, statically-linked Linux binaries - where you need access, and Firezone’s homegrown STUN/TURN layer (we call “snownet”) handles the rest. If you need more throughput, just deploy more Gateways, and load is balanced across all of them.

WireGuard keys are distributed to peers only when access to a particular resource is authorized, and private keys never leave the device’s memory where they were generated. If a Gateway goes offline, Firezone will migrate connections from it to healthy ones within about 10 seconds, without user intervention. We lean heavily on Elixir/Phoenix and OTP’s awesome concurrency features to power all of this.

Firezone’s access control system is intentionally very simple. Policies define which user groups have access to which resources based on a default-deny system. More perimeters means more rules managing access to them, so we intentionally wanted to keep admins out of “ACL hell” as the number of controls grew.

One area we’re actively working to improve is our UI/UX - Firezone is a product built by engineers, for engineers, and at times, it shows! Expect refinements to come in this area over the coming months.

I’d love for you to give Firezone a try! You can spin up a demo instance at https://app.firezone.dev/try without signing up, and download clients from https://www.firezone.dev/kb/client-apps. And if you’re curious to learn more about how Firezone works, see for yourself - we build in the open at https://www.github.com/firezone/firezone.

Thanks for reading, and I look forward to your feedback!

jkelleyrtp · a year ago
Hey! I worked on WARP at Cloudflare. I believe Cisco has anyconnect and then there's zscaler.

I'm curious how you guys are competing with the other folks in the space. WARP was/is a really tough product to maintain (crossplatform networking is very difficult). CF was doing well with WARP mostly due to the distribution advantage. I imagine it's harder for startups to break into the space.

sho · a year ago
Oh man, I tried to use WARP for a project and it was the most confused, hard to understand product I've seen for a while. After a couple of hours of reading unhelpful support pages and trying increasingly random settings I simply gave up and used tailscale instead, which worked instantly.

I'm sure it wasn't the part of the product you worked on but the onboarding experience, wow, just terrible.

PLG88 · a year ago
Through OpenZiti into the mix too - https://openziti.io/. Its open source and was designed from the ground up with zero trust, SDN, and deny-by-default principles. It also includes SDKs to allow developers to embed ZTN as part of the SDLC. We also built zrok (https://zrok.io/) on top of it, as a demonstration of a 'ziti-native' app, and being a better Ngrok.
hardwaresofton · a year ago
OpenZiti looks so enticing but it is certainly a completely different world.

Are there many big installations of it? With the vast majority of stuff being written for regular networks I do wonder if the amount of proxies/sidecars becomes unreasonable. Probably not though

RsmFz · a year ago
Oh so that allows it to run in-process?

That's cool, I did that for an HTTP forwarding thing a while back.

illumiN8i · a year ago
As a WARP user that has experienced a lot of problems, I'm glad that Cloudflare is allowing WARP users to switch from wireguard to MASQUE. I'm hopeful this will solve a lot of our issues.
RsmFz · a year ago
Hm, is Wireguard getting blocked by middleboxes or something?
jamilbk · a year ago
Ah yes, don't get me started on all the fun edge cases involved in supporting cross platform network stacks and all their subtle tunnel API differences :-)

We're trying to stay focused on keeping policies easy to define and manage so that access management is... manageable as you scale. That and the fact data doesn't go through the cloud / intermediary have been a couple of the reasons customers say they prefer us.

Definitely an exciting space to be building in!

gchamonlive · a year ago
At my last job, I implemented Firezone on AWS and it worked like a charm.

It was before the refactoring and the move to zero trust, so back then it was a simple admin panel. It was maybe mid 2022 I implemented it.

There was a terraform module I created for setting up the basic infrastructure, but there is no way the module supports the current state of the product. I guess it moved way quicker than I was able to follow LOL. The module was accepted in the Firezone group but later discontinued, for obvious reasons. I wish I had the time to contribute to the project supporting an official module for it, but I guess life happens to everyone haha

Good luck with the project! This is really good and very needed, the only other alternative being Tailscale, which is all closed source.

gargan · a year ago
Sounds like you had a cool experience with Firezone back in the day. Since you mentioned alternatives, have you checked out Netmaker? It's another open-source option (note I work there)
xyst · a year ago
Wow, a product that hasn’t shoehorned AI/LLM into their offerings. Will be following.

Love that you are using rust!

igorguerrero · a year ago
We use it a work, didn't know you guys were fresh in the biz, our dev ops guy switched us to you guys, I had no problem, I love that it uses wireguard, our previous provider was a PITA :)
jimmar · a year ago
In the spirit of constructive feedback, spend the time and effort to record your product demonstrations in a more professional environment. Or generate a fake background at a minimum.
dang · a year ago
In the spirit of sheepish confession: that is my fault. I always tell founders to make raw, unprofessional videos for their Launch HNs. In fact, here is my standard blurb about it:

"What works well for HN [demo video] is short and direct, with zero production values. Skip any introductions and jump straight into showing your product doing what it does best. It should take only a few seconds before we see it in action, doing something cool. Voiceover is good, but no marketing slickness—no fancy logos or background music or anything like that!"

I can see how maybe this could be counter-grain for some enterprise products.

mrbluecoat · a year ago
I'm probably in the minority, but I actually really liked the scrappy, you-can-trust-us-because-I'm-not-wearing-a-tie vibe :D
jamilbk · a year ago
Appreciate the feedback! Will certainly plan to take the product demos up a notch going forward.
imor80 · a year ago
I'd have definitely liked if the demo video was at least 1080p.
cedws · a year ago
I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks very reasonable. Wishing your product much success.
indianmouse · a year ago
Second that.

I have tried to use Headscale with Tailscale clients and have been fairly successful in achieving a private P2P VPN. Since I have a lot of spare servers, was able to setup a GUI, Headscale server and configure Tailscale clients across different OS flavors. But it is not for the faint of heart or non-technical folks or for enterprise use. What I have implemented was for personal use and it has it's own pitfalls / troubleshooting stuff which actually consumed a lot of time and effort.

Is there an open source option with Firezone where I could try it out to have a head to head comparison (or if a comparison that already exists) or a guide that could be used for setting up one's own server and client apps for a self-hosted and self-managed solution using Firezone?

Please recommend / respond with the opinion of whether the thought process is worth it? Thanks.

jamilbk · a year ago
We have a few intrepid users self-hosting the entire Firezone stack, but we don't have documentation to support it (yet), and wouldn't recommend it for production. It's something we'd like to write and maintain eventually, even if only for smaller / hobby deployments.

We do have a self-hosted community support channel on Discord if you are feeling adventurous: https://discord.gg/DY8gxpSgep

I would recommend starting here with a local development cluster:

https://github.com/firezone/firezone/blob/main/docs/CONTRIBU...

dotBen · a year ago
Do you think purchasers within enterprises especially care if it's a proprietary or commercially-supported FOSS offering?
alemanek · a year ago
Anecdotal but the company I work for does. But, not for the reasons the wider community cares.

Strong FOSS projects tend to have multiple options for commercial support. So, if a hostile company acquires your commercial support provider, looking at you Broadcom, you have some options to move to someone friendlier for support.

So, for my employer it is about having options.

PLG88 · a year ago
They do if they are building it into their product/commercial offering. Less so if its a direct and internal usage.
otabdeveloper4 · a year ago
Yes. A shitload of legal nuance depending on what you choose here. (Software supply chain issues are increasingly important nowadays, and executives usually care about this stuff more, because it can carry huge risks.)
jdironman · a year ago
Those with purchasing 'influence' might. Accounts payable? No.
jamilbk · a year ago
Thanks for the support!
Terretta · a year ago
This comment sounds like a promo for Tailscale. It's actually a suggestion to Firezone to model after what Tailscale are getting right. We need competition in this space, but tooling non-SV businesses can leverage. Tailscale is pulling this off well.

Tailscale is building a remarkable moat at extraordinary pace: capabilities real commercial use needs, on pricing that doesn't penalize the security-minded startup.

One key difference with their platform is the recognition so often missed inside the HN bubble that most B2B and B2C are on M365 and Entra, not Google like 3 devs in a cafe. Tailscale seems to understand the difference, but rather than going "enterprise" brings the startup ways into the business context, letting a business be like a startup while still complying with "requirements" such as sound patterns for tying into legacy internal and third party systems and networks.

A related difference is emphasis on "everything as code" from config to policy, enabling gitops of course, but also easier integration and automation.

That said, Firezone's choice to let groups flow from IdP and map resources to groups, can be a competitive advantage, since the only thing better than everything as code is no-code, meaning, no moving parts. For instance, with Firezone, you can make systems automatically accessible to Microsoft Teams, team by team. Adding someone to a team or kicking them from a team, can give them access or remove their access. That's a massive security gain and overhead reduction.

But the biggest differentiation seems to be solving corner cases that come up in real world use and rolling those out faster than firms can come up the curve in their own Zero Trust implementation. Tailscale must have an excellent forward-deployed product sensing practice, to either discover or listen to these problems from commercial users then tackle them and get it rolled out for all customers. Their docs are also use-case focused and self-service empowering: https://tailscale.com/kb/1300/production-best-practices with a clear understanding of how devs spend their time https://tailscale.com/kb/1360/developer-tools and generally organized by the "Diataxis" systematic approach to technical documentation authoring: https://diataxis.fr/

Finally, contrary to popular practice here, Tailscale don't have predatory pricing for SSO, no “SSO tax”.

The $0 plan includes SSO. Even if you're a one person shop, there's no reason not to get SSO going for yourself, every future SaaS you integrate with, and every future onboarding/offboarding will thank you. Switching to this later is far more costly than adopting it early, and we should all be supporting one another to make SSO (or Oauth2+OIDC) the norm instead of an "Enterprise Call Us" pricing discriminator.

It's great to see Firezone including OIDC in the starter plan, as that brings most of what anyone needs from "SSO", without most of the headaches. And this benefits Firezone too, they can't leak user passwords.

"Zero Trust" (such a terrible name for a pattern that actually means "enable trust on everything that matters") is a big deal, and more focus on this space is huge. It's worth building in this ecosystem, and worth paying attention to what overachievers are getting right.

vinckr · a year ago
I prefer "End to End Security" or "Continuous Verification" to the Zero Trust term. But it seems the Zero Trust term is so ingrained now that everyone who has a product to sell will use it.
nmadden · a year ago
I don’t really get the threat model of these “zero trust” appliances and how they are really different from a VPN. Can someone explain it to me? It still looks very much like a perimeter.
tptacek · a year ago
It's a "virtual" or "overlay" central reference monitor for the whole network --- imagine collapsing an entire campus network down to a single firewall --- which makes it really easy to draw arbitrary internal perimeters. The real customers for these products all tend to have group-based policies.

If you remember NAC products from back in the day (policy-driven 802.1x and filtering, all designed to deal with the "chewy center" problem), this is like the overlay network version of that, and because it's all software it's much easier to deploy and manage.

PLG88 · a year ago
I would add, doing Zero Trust Networking properly means deny by default (VPNs are open by default), service based access (not whole host or network), microsegmentation (not whole network), and least privilege. You should also use posture checks to ensure the end device is compliant and personally I prefer 'authenticate before connect' with outbound only connections from source and destination.

Note, I am biased though as I work on an open source zero trust networking project - https://openziti.io/.

nmadden · a year ago
Oh ok. I’ve been reading a lot of zscaler zpa docs at work and didn’t come away with that impression at all. (The Zscalar docs are awful though).
gargan · a year ago
Zero trust actually goes way beyond traditional VPNs. A key difference is granular access control and continuous verification. With zero trust, you're not only punching a hole through a firewall - you're creating dynamic, context-aware access policies for each user and device.

This helps contain breaches and lateral movement much better than VPNs. Plus, it plays nice with cloud and hybrid environments where traditional network perimeters get blurry.

nmadden · a year ago
Sure, zero trust implies those things, but I was asking specifically about these kinds of all-in-one “zero trust appliances”. For me, as an AppSec specialist, I’d say ZT is primarily about making sure all your apps enforce authN/Z regardless of whether the users are on an internal network or not.

One way to do that is to stick a simple reverse proxy in front of every app that does OIDC to your central IdP, and then arrange your network so that you cannot bypass that (eg using (micro)segmentation or something like IAP’s signed headers). My impression from reading Zscaler’s docs was that it was really just an over-complicated version of this without even doing the segmentation for you, but it sounds like it does do that bit too.

mwest217 · a year ago
How does this compare with e.g. Tailscale?
jamilbk · a year ago
Good question! The main difference is how access is managed. Instead of configuring ACLs, you define policies which are a 1:1 mapping between a user group (manually created or synced from your IdP) and the resource you want to allow access for. Another difference is how our load balancing / failover system works - it's automatic across all the Gateways in a particular Site.
SeriousM · a year ago
For me as very simple customer with a few devices, is that a benefit? I didn't configured any acls in my little vpn town.
mrbluecoat · a year ago
There's a chart on the homepage comparing to Tailscale and Twingate.

One difference not listed is MDM support. https://www.firezone.dev/kb/deploy/clients#provision-with-md... just tells you where to find the app but there's no parameters for configuring Firezone via zero-touch.

It's also not clear if Gateways can serve as Exit Nodes for egress clients (like a traditional VPN).

Lastly, Firezone Clients support only DNS over UDP/53 at this time. DNS-over-TLS and DNS-over-HTTPS upstream servers are not supported yet.

jamilbk · a year ago
We don't support full-tunnel yet, but it's just around the corner. Track this issue if you're interested in its progress: https://github.com/firezone/firezone/issues/2667