Top all-time · #5983
Firezone
Company blog · firezone.dev/blog · on HN as jamilbksecuritysystemsprogramming
Firezone is the company blog at firezone.dev, writing about security, systems and programming. Since 2022, 13 different Hacker News readers have linked it 25 times, most often “FireZone – Open-source VPN server and firewall”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link Firezone's site mostly as a WireGuard-based zero-trust access product and its open-source boringtun fork. Its blog is valued for a sans-io article on Rust async design.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Replace your VPN with Firezone, an open-source zero trust access platform built on WireGuard®. Connect users to anything, anywhere. Try free today.
Most-linked posts?
- FireZone – Open-source VPN server and firewall5 people · 5 mentions · first linked 2022-05-27
- Sans-IO: The secret to effective Rust for network services5 people · 5 mentions · first linked 2024-07-04
What Hacker News says?
I have a task to investigate https://www.firezone.dev
Comment linking /
on “CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows”Submitted FireZone – Open-source VPN server and firewall as a story · 246 points
HN discussionThere is also https://github.com/firezone/boringtun which is a fork by https://www.firezone.dev/
Comment linking /
on “GotaTun – Mullvad's WireGuard Implementation in Rust”Submitted Sans-IO: The secret to effective Rust for network services as a story · 233 points
HN discussionThe recent ones I've seen are these: * NetBird ( https://netbird.io/ ) * Firezone ( https://www.firezone.dev/ )
Comment linking /
on “Add ability to choose a custom coordination server”Submitted Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust as a story · 160 points
HN discussionNote that this same concept is "sans io" and was previously discussed for it's use in Rust: https://www.firezone.dev/blog/sans-io https://sans-io.readthedocs.io/ https://news.ycombinator.com/item?id=40872020
Comment linking /blog/sans-io
on “Zig's New Async I/O”Submitted Building reliable (and fast) directory sync as a story · 23 points
HN discussionI've got a vanilla Wireguard host that terminates connections for my local network but I've been thinking about trying out firezone [0] as it appears I can better segment (with firewall policy) those connections terminating to the host within one UI. [0] https://www.firezone.dev/
Comment linking /
on “ESPHome – Connect ESP32 with Sensors to HomeAssistant”Submitted Finding bugs you didn't think to test for as a story · 8 points
HN discussionFirezone's DNS-based routing is able to manage access to multiple services independently, even if they share the same IP address. So you could for example allow access to gitlab.company.com but not jira.company.com even if they were on the same webserver / loadbalancer. It took a couple iterations to get it right - lots of fun edge cases involved. We ended up having to build automatic NAT64 and 46 for DNS resources…
Comment linking /kb/deploy/policies
on “Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard”Submitted How DNS Works in Firezone as a story · 6 points
HN discussionThere's a chart on the homepage comparing to Tailscale and Twingate. One difference not listed is MDM support. https://www.firezone.dev/kb/deploy/clients#provision-with-md... just tells you where to find the app but there's no parameters for configuring Firezone via zero-touch. It's also not clear if Gateways can serve as Exit Nodes for egress clients (like a traditional VPN). Lastly, Firezone Clients support only D…
Comment linking /kb/deploy/clients
on “Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard”Submitted Using Tauri to build a cross-platform security app as a story · 2 points
HN discussionThe article provides a very detailed exploration of all of the fun challenges you can face designing FFIs with Rust, but there's a good chance you can "get away" with simpler approaches if you think ahead a bit. In our case, we call into Rust from Kotlin using JNI [0] and Swift using swift-bridge [1]. Thankfully our use case for the FFI [2] is for non-performance-critical calls and the data structures are fairly sim…
Comment linking /kb/architecture/tech-stack
on “Crossing the impossible FFI boundary, and my gradual descent into madness”Submitted Manage Firezone as code with Terraform as a story · 1 points
HN discussionThere is work happening on keyword generics[0], which would let a function be generic over keywords like `async` and `const`. For now the best option to write code that wants to live in both worlds is sans-io. Thomas Eizinger at Fireguard has written a good article about this[1] pattern. Not only does it nicely solve the sync/async issue, but it also makes testing easier and opens the door to techniques like DST[2]…
Comment linking /blog/sans-io
on “Async Rust never left the MVP state”Submitted Firezone REST API generally available as a story · 1 points
HN discussionFun write-up. Good stuff, very nice contribution to to compio of compio-ws. Looks like the Iggy switched to thread-per-core compio back in July. https://github.com/apache/iggy/pull/1960 One thing I saw mentioned in the 0.5.0 release notes (which happened shortly after migrating to compio): trying to switch to a Sans-IO model design (but maybe just for clients?). It feels like there's similar ownership concerns that…
Comment linking /blog/sans-io
on “Show HN: Building WebSocket in Apache Iggy with Io_uring and Completion Based IO”Submitted WireGuard-Native NAT Traversal as a story · 1 points
HN discussionI've tried Tailscale, Headscale, Nebula, Netmaker, OpenZiti, wg-easy, and a few other niche overlay network and VPN tools. Each time I still end up using Firezone [1] when I need a simple wrapper over Wireguard. [1] https://www.firezone.dev/
Comment linking /
on “Tailscale vs. Narrowlink”Submitted The enterprise identity crisis: Who's Alice? as a story · 1 points
HN discussionSubmitted Sans-IO: The secret to effective Rust for network services (2024) as a story · 1 points
HN discussionSubmitted Improving reliability for DNS Resources as a story · 1 points
HN discussion
