# wg-easy / Firezone

A VPN you host. wg-easy is AGPL-3.0; Firezone is Apache-2.0 — NordVPN without the commercial VPN seat. Headscale stays the Tailscale-shaped mesh.

**Replaces:** NordVPN

**Tier:** Easy

## Problem

NordVPN is a commercial VPN: internet egress through someone else's network. You wanted WireGuard peers you control. wg-easy is AGPL-3.0 (WireGuard + a web UI). Firezone is Apache-2.0 if you want that access-platform. Headscale is the Tailscale-compatible mesh on /replace/tailscale — private networking, not a Netflix-unblocking VPN. This is not Nord's threat-protection SKU or every streaming-region trick.

## Stack

- [wg-easy](https://github.com/wg-easy/wg-easy) — AGPL-3.0 WireGuard VPN plus a web admin UI
- [Firezone](https://www.firezone.dev) — Apache-2.0 WireGuard access platform if you want that stack

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| NordVPN (household) | $1,200 | wg-easy or Firezone on a VPS |

**About $1,200 / year** on a small team, before you count lock-in.

## Deploy on Railway

Placeholder: wg-easy (WireGuard + UI) needs NET_ADMIN/privileged networking that Railway often will not give you — a VPS is the honest path. Firezone is a fuller access box. Headscale stays /stacks/headscale-vpn. No one-click template in this repo yet — Start on Railway.

[Start on Railway](https://c17.io/go/railway/wg-easy-vpn?from=%2Fstacks%2Fwg-easy-vpn.md)

[Headscale if this is a Tailscale mesh, not a commercial VPN off-ramp](https://c17.io/stacks/headscale-vpn)

## AGENT_PROMPT

```
Replace NordVPN with wg-easy (preferred small box) or Firezone.

- WireGuard needs a public UDP port and usually NET_ADMIN. A VPS is the default; do not assume Railway can pass that through.
- Issue one peer, connect one laptop. Do not claim Nord's streaming-region or threat-protection products.
- Mesh devices without internet egress stay on /stacks/headscale-vpn. Write AGENT_PROMPT.md.
```

## FAQ

### wg-easy or Headscale?

wg-easy/Firezone if you want a VPN exit you control (the NordVPN-shaped job). Headscale if you want a Tailscale-compatible mesh (/replace/tailscale). Different job.

### Will this unblock Netflix?

No promise. You get WireGuard to a server you run. Region catalogs are a vendor product, not this stack.

Source: https://c17.io/stacks/wg-easy-vpn