FAQ
Some of the most frequently asked questions about the Firezone product and service.
General
What is Firezone?
Firezone lets organizations manage secure remote access to their most sensitive Resources. We’re an open source zero trust network access (ZTNA) solution that’s built on WireGuard®, a modern protocol that’s up to 4-6x faster than OpenVPN. See the architecture overview for a deeper look at how Firezone works.
What is zero trust network access?
Zero trust network access (ZTNA) starts with the premise that users who want to access a resource on a network are untrusted. This means that any attempt to access a resource must be denied until a user 1) verifies their identity (authentication), and 2) the platform confirms that the user is allowed to access the resource (authorization). For how this principle shapes Firezone’s design, see key design principles.
How is Firezone different from a VPN?
While Firezone is built on WireGuard®, a VPN protocol, it differs from a traditional VPN by providing access controls that authenticate users and verify access before providing access to a specific resource. Traditional VPNs usually give users access to the entire network, and do not distinguish between different resources or access requests. For the full list of differences, see what’s different about Firezone?
How does Firezone work?
For a complete description of how Firezone works, our architecture, and how it can help you manage access to infrastructure or shared services, check out our architecture docs.
Where does Firezone run?
Firezone runs on your own infrastructure in just about any public, private, or cloud network. Most of our customers use Firezone to access resources in public cloud providers like AWS, Azure, Google Cloud Platform, and Digital Ocean, or on-premise networks. Because Firezone operates at layer 3 of the networking stack, it supports all application protocols without modification.
Deploying Firezone
How long does it take to set up Firezone?
Firezone can be set up in less than 10 minutes, and Gateways can be added by running a simple Docker command. Check out the Quickstart Guide for step-by-step instructions.
Do I have to be technical to run Firezone?
No, deploying Firezone doesn’t require any specialized networking expertise. If you know how to run a Docker container or Linux-based VM in your network, then you should be able to deploy Firezone (check out the Quickstart Guide for step-by-step instructions).
Do I need to make any changes to my infra to run Firezone?
No. While Firezone can be deployed as you build out a network, it’s also an overlay network that can provide fine-grained access control to resources in an existing network. All you need to start giving users secure access to resources in a network, is to install a Firezone Gateway on a server or VM in that network. Gateways can also be deployed at scale using Terraform.
Do I need to disable my VPN to use Firezone?
No, you can run Firezone alongside your existing VPN, and switch over whenever you’re ready. There’s no need for any downtime or unnecessary disruptions.
Can I self-host Firezone?
Firezone uses a split control plane and data plane architecture to allow for things like key distribution, user authentication, and policy enforcement to happen out-of-band with the hot data paths. The data plane components such as the Clients and Gateway are specifically designed to be self-hosted, but the control plane, due to its reliability, security, and persistence requirements, is not. See the tech stack for why the control and data planes are built and operated differently.
That said, Firezone's product is 100% open source and can be found at our main repository. Our license does not prevent you from self-hosting Firezone without limits for your organization, but Firezone provides no support or documentation for self-hosted deployments, and in general we only recommend it for hobby or educational purposes at this time.
How do I get Firezone on an end-user device?
Users can install the Firezone Client here. After installing the Client, users simply need to enter their account ID and sign in using their email or SSO to start accessing the Resources that you (an Admin) has given them permission to access in the Firezone admin portal.
Can Firezone connect to my identity provider (IdP)?
Yes. Firezone integrates with any OIDC-compatible identity provider, including Google Workspace, Azure AD, Okta, and OneLogin. Firezone does not store or handle end-user credentials like passwords.
Where should I run my Gateway(s)?
Gateways are released as self-contained binaries for Linux that we package as a Docker image or systemd unit, which you can run on any Linux-based server or VM (e.g. on AWS, GCP, Azure, or on-premise). You only need a single Gateway in each Site to provide secure remote access to Resources associated with that Site. However, we recommend deploying two or more Gateways for load-balancing and automatic failover.
What is a service account?
Service accounts facilitate secure connections from a server, VM or container to a Resource. Because service accounts do not involve a user, they can’t fulfill 2FA requirements, and use the Firezone Client in a non-interactive way (headless mode).
Performance
Does all my traffic go through Firezone?
Network traffic is always end-to-end encrypted, and by default, routes directly to Gateways running on your infrastructure. In rare circumstances, encrypted traffic can pass through our global relay network if a direct connection cannot be established. Firezone, Inc. can never decrypt or see the contents of your traffic.
Can Firezone support more traffic as my company scales up?
Scaling Firezone to support your rapidly growing organization is as simple as deploying additional Gateway servers. See our Terraform deployment examples for an idea of how to automate this process.
What protocol does Firezone use to encrypt traffic?
Firezone uses WireGuard® to encrypt all data plane traffic and TLS to encrypt all control plane traffic.
What happens if I add the same Resource to more than one Site?
The Firezone Client will automatically select the nearest Gateway, and route traffic to/from that Resource.
What happens if Firezone goes offline?
You will not be able to access the Firezone Admin Console, or make changes to your account via the API. Existing connections should remain active for approximately 5 minutes before being disconnected.
Users
How do end users get Firezone?
Windows and Linux users can download the Client from here. macOS, iOS, iPadOS, Android, and ChromeOS users can download the Client from their device’s app store.
Do users need to interact with the Firezone Client?
The Firezone Client is designed to be unobtrusive, and once a user signs in with their credentials, it should run in the background without the need for additional interaction. Users may find it helpful to click on the Firezone app to see a list of available resources, but the app is always on and doesn’t need to be toggled. Always-on split tunneling means that accessing anything other than Firezone resources should be unaffected when using Firezone.
Admins
How can I limit access to resources?
Firezone lets admins set access control using a combination of Policies and User Groups. This means that admins can establish role-based, or any other logical group at a fine-grained Resource level.
Can I change my account slug?
Yes, on the Team plan and higher. An admin can change the account slug from Settings -> Account in the admin portal. Click Edit, enter the new slug, and save. On the Starter plan the slug is read-only.
A slug can contain lowercase letters, numbers, and underscores. It has to be at
least 3 characters long. A slug that another account uses, or used in the past,
is not available, and neither are common words such as admin or support.
When you change the slug:
- Your old slugs keep working. Any link that uses an old slug redirects to the new one, so existing bookmarks and sign-in links do not break. No other account can claim a slug you used before.
- Your account ID always works in place of the slug, for example
https://app.firezone.dev/<your-account-id>. - Users who sign in from the Firezone Client with the old slug are redirected to the new one. They do not need to sign in again.
You can pick up to 3 new slugs every 30 days. A switch back to a slug you used before does not count toward this limit.
Billing
How do you charge for Firezone?
Starter is free and does not require a credit card. Team and Business are self-serve subscriptions with monthly or annual billing. Team costs $5 per seat per month or $50 per seat per year. Business costs $8 per active seat per month or $80 per active seat per year. Annual subscriptions are charged upfront. Enterprise pricing and annual billing are arranged with sales. See the pricing page for plan features and limits.
Team and Business support credit card or ACH payments. Enterprise also supports wire transfers and annual invoicing. Business does not offer invoiced payment terms.
To cancel or change a Team or Business subscription, go to Settings → Account in your admin portal. For Enterprise, contact your account manager. To delete your account, cancel your subscription first, then schedule account deletion from Settings → Account.
How many seats do I need?
Team uses static seats: every user or service account present in your account counts as a billable seat, whether or not they sign in.
Business and Enterprise use active, or floating, seats: each unique user or service account that signed in from a Firezone Client during the previous 30 days counts as one seat. Multiple client sign-ins by the same user or service account count as one seat. Syncing a user from your directory does not by itself make that user a billable seat.
For example, an account with 100 users and no service accounts needs 100 seats on Team. If only 40 of those users signed in from a Client in the previous 30 days, that is 40 active seats on Business or Enterprise.
Enterprise accounts are never locked or suspended for exceeding their seat count.
How do seat changes affect billing?
Increases take effect immediately, and the prorated amount for the added seats is invoiced immediately for the remainder of the current billing cycle. Decreases take effect at the end of the current monthly or annual billing cycle. Seats already paid for remain available until renewal.
Security
What firewall ports do I have to open to use Firezone?
None. The Firezone control plane propagates connection information like public keys across your network, so Gateways and Resources don’t need to listen for inbound connections from the public internet. This means that your network remains inaccessible from the internet, with no visible entry points.
How can I be sure Firezone is secure?
Firezone helps improve organizations’ cybersecurity posture by offering a modern approach to securing access to sensitive resources in their private network.
Read our security disclosure policy
Need help? See all support options.