DOCSEARCHbyAlgolia
Submit Docs

Firezone Documentation

website·Indexed 35 days ago

https://www.firezone.dev/docs

Open-source networking and security platform featuring a client-gateway architecture. Documentation covers version 1.0 GA, DNS-based traffic routing, Terraform provider integration, security advisories (FZ-2026 series), and technical implementation details using Rust, Tauri, and sans-IO patterns.

Tokens
98.5K
Snippets
205
Records
689
Agent score
72%

What's inside Firezone

  1. Overview of Tauri for desktop application development

    Tauri is a framework used to build small, fast binaries for major desktop platforms. Unlike Electron, which bundles Chromium and Node.js, Tauri uses the OS's native webview and a Rust backend. This results in significantly smaller download sizes (typically under 100 MB) and reduced resource overhead.

  2. Overview of Secure Remote Access and Zero Trust

    Secure remote access is a framework of solutions, platforms, and policies designed to prevent unauthorized network access and limit potential damage in the event of a breach. In a zero-trust environment, this involves reducing the attack surface and ensuring that remote and hybrid employees can access organization networks, data, and systems from any device without compromising security. It is distinct from Remote Desktop Protocol (RDP).

  3. Overview of Firezone Device Trust

    Device Trust adds a cryptographic check to Firezone access. At connection time, the Client presents an X.509 certificate issued by an MDM or enterprise PKI and proves possession of the corresponding private key. Firezone validates this identity before allowing access via a Policy that requires attestation. This ensures that a valid user session alone is not enough to access sensitive resources; the request must originate from a trusted, managed device. Note that Device Trust validates identity, not posture (e.g., OS version or disk encryption); use Device Posture for those checks.

  4. Overview of Firezone Flow Logs

    Flow Logs record network flows between Clients and Resources, capturing the actor, the authorizing Policy, start/end times, network paths, and data volume. They are the primary tool for incident response and forensic analysis.

    Key Behaviors:

    • Default State: Enabled by default for all Policies except those targeting Internet Resources (which must be enabled explicitly).
    • Exclusions: DNS queries are not tracked by Flow Logs.
    • Reporting: Both the initiator (Client) and responder (Gateway or another Client) report the flow independently to ensure data integrity via cross-checking.
    • Minimum Versions: macOS 1.5.19, iOS 1.5.19, Android 1.5.13, Windows GUI 1.5.16, Linux GUI 1.5.16, Windows Headless 1.5.11, Linux Headless 1.5.11, and Gateway 1.6.0.

  5. Overview of Firezone Architecture

    Firezone's architecture is split into two categories: Firezone-managed components (hosted and operated by Firezone in their cloud environment) and User-managed components (deployed and operated by the customer within their own infrastructure).

  6. Overview of Firezone and its relationship to WireGuard

    Firezone is an open-source access broker built on top of WireGuard. While WireGuard provides the core high-performance VPN building blocks, it requires manual automation for key distribution, user management, and routing table configuration. Firezone automates these administrative tasks, providing a management layer to deploy and manage WireGuard-based VPN servers for securing private networks.

  7. Overview of Firezone Device Posture

    Device posture (available on Enterprise) allows administrators to add device security requirements to Firezone Policies. It ensures that a device meets specific security criteria—such as disk encryption, firewall status, or OS updates—before granting access to a Resource. Firezone achieves this by syncing records from MDM (Mobile Device Management) and EDR (Endpoint Detection and Response) providers and matching them to Clients using the strongest available identifier (Certificate-attested MDM ID > Certificate-attested hardware serial > Client-reported hardware serial).

    It is strongly recommended to configure Device Trust and enable 'Require attestation' on Policies first. Without attestation, device posture records are matched using only Client-reported fields, which is less secure.

  8. Overview of Firezone Log Sinks

    Log Sinks (available on Enterprise) provide push-based delivery of Audit Logs to SIEM or log management platforms without requiring agents or pipelines. Supported destinations include Amazon S3, Datadog, Elastic, IBM QRadar, Microsoft Sentinel, New Relic, Splunk, and Generic HTTP (for JSON over HTTPS). Log Sinks are managed in the admin portal under Settings > Log Sinks.

  9. Overview of Firezone Zero-Trust Access

    Firezone is an open-source VPN replacement built on WireGuard® designed to protect resources using zero-trust principles. It provides a fast, lightweight alternative to OpenVPN (claiming 3-4x better performance) and features automatic load balancing and failover when two or more Gateways are deployed. It uses hole-punching technology to hide resources from the public internet and minimize the attack surface.

  10. Overview of Firezone Audit Log Streams

    Firezone captures four distinct audit log streams to track account activity. These are available on Starter, Team, and Enterprise plans:

    • Change Logs: Tracks who changed account configuration and when.
    • Session Logs: Tracks who connected, their location, and their device.
    • API Request Logs: Tracks every request made by API tokens.
    • Flow Logs: Tracks actual traffic flow between Clients and Resources.

  11. Overview of Firezone Okta Directory Sync

    Firezone allows Enterprise users to automatically synchronize users and groups from one or more Okta tenants. This removes the need for manual user management. The sync requires an API service app in Okta for read-only access to users, groups, and applications, as well as an event hook for real-time updates.

    Prerequisite: Okta authentication must be configured in Firezone before enabling directory sync.

  12. Overview of Firezone Zero Trust Network Access (ZTNA)

    Firezone is an open-source Zero Trust Network Access (ZTNA) solution built on the WireGuard® protocol. Unlike traditional VPNs that often grant access to an entire network, Firezone provides fine-grained access controls that authenticate users and verify authorization before granting access to specific resources. It operates at layer 3 of the networking stack, supporting all application protocols without modification.