Replacing a corporate VPN with open source zero trust access

Use the identity provider your workforce already signs in to, and connect the ZTNA control plane to it over OpenID Connect or SAML. Keycloak, authentik and ZITADEL are open-source options that can serve as the directory-facing IdP, and an enterprise IdP such as Microsoft Entra ID or Okta can be federated into them. A self-hosted NetBird deployment includes an embedded Dex identity provider that can add external SSO providers, so confirm whether you want it as the primary login path or only as a bridge. Pomerium lists Keycloak, Okta, Microsoft Entra ID, Google and others among its supported identity providers. Settle group mapping first, because access policies in both NetBird and Pomerium depend on the groups and claims the IdP returns. Confirm MFA enforcement at the IdP, since the ZTNA layer usually inherits it.

Posture checks need a source that reports device health, such as an MDM profile or an EDR agent, and a way for the ZTNA policy engine to read it. NetBird lists device posture checks as part of its feature set, but the posture controls such as device approvals, MDM and EDR device controls, and posture checks sit on its Business tier according to its pricing page. Pomerium reserves external data integrations such as FleetDM device posture for its Enterprise edition. Confirm which posture attributes your MDM or EDR can export, how often they refresh, and what the policy does when a signal is missing. Decide early whether an unmanaged device gets no access or a limited clientless path.

Send authentication, policy decision and session logs from the ZTNA control plane and proxy to a central pipeline, then forward them to your SIEM. Wazuh is an open source XDR and SIEM platform with a GPL-2.0 licensed core, so it can receive and correlate these events on your own infrastructure. NetBird lists activity and traffic event logging, and its Team tier adds audit event logging, while Business adds traffic logging and streaming. Pomerium Zero plans include access and audit logs, and session recording for SSH is an Enterprise feature. Define the fields you need, such as user, group, device, destination, decision and timestamp, and test that they arrive with the time synchronization your regulator expects.

A self-hosted NetBird control plane needs a Linux virtual machine with at least 1 CPU and 2 GB of memory, a public domain, Docker with the Compose plugin, and specific ports open. According to the NetBird self-hosting quickstart, TCP ports 80 and 443 and UDP port 3478 must be reachable. That host runs management, signal, relay and STUN from one combined configuration, a dashboard container and a Traefik reverse proxy that uses Let's Encrypt by default. The quickstart states that backups, upgrades and scaling are the operator's job. Plan the host in a DMZ or a dedicated network segment, restrict administrative access, and confirm that your firewall team accepts the public exposure before the pilot starts.

Relays carry traffic when two endpoints cannot establish a direct path, so place them where both sides can reach them over outbound connections. In NetBird, the relay is part of the combined self-hosted stack, and the README notes relay fallback when peer-to-peer connectivity fails. In OpenZiti, private edge routers make only outbound connections, so no inbound firewall rules are needed inside the private network, and public routers serve as entry points. Place at least one relay or router in each network zone that has restrictive egress, and measure latency from the regions where users work. Ask the vendor or partner how relay traffic is encrypted and what metadata a relay can observe.

Keep the legacy VPN running during migration as a fallback for applications and users that have not moved yet, but restrict it to a shrinking list of routes. Running both paths lets you migrate application by application, roll back a single app without an outage, and keep emergency access while the new control plane matures. Set an explicit retirement date for each group of applications and track which users still rely on the VPN. Review whether the fallback path still gives broad network reach, because a VPN left wide open defeats the purpose of the migration. Document the criteria for removing it, and ask the implementation partner to test rollback before the first production cutover.

Cost falls into a few components: the software license or subscription, the infrastructure that runs the control plane and relays, the integration work with the identity provider, MDM or EDR and SIEM, and the per-application migration effort. Open-source core editions such as NetBird's self-hosted stack and Pomerium Core carry no license fee, but cloud tiers are priced per user and per machine. NetBird's published pricing lists Team at 6 euros and Business at 12 euros per user per month, with custom Enterprise pricing, and Pomerium Zero Business at $9 per user per month billed monthly. Infrastructure and staff time recur, while integration and migration are largely one-time. Ask for a quote built from a written scope that names the applications, identity sources and posture signals in use.

The cost follows the scope: how many applications and app types move, how many identity providers and posture sources connect, and what infrastructure you host yourself. The software itself is open source, so the main costs are infrastructure to run the control plane and relays, integration work per application, identity provider and posture connections, and the parallel running period while the VPN stays on. Each application that uses SSH, RDP, databases or UDP needs its own policy and testing, so a long list of mixed app types costs more than a short list of web apps. Ask any quote to itemize these components separately so you can see which ones shrink as the migration progresses.

Before the work starts, your team needs to provide a complete inventory of internal applications, the network ranges they use, the users and groups who reach them, and the devices that must be managed or checked. You also need administrators for your identity provider who can add clients, groups and claims, and a named owner for each application who can confirm behavior during testing. Plan change windows for DNS, firewall and identity provider changes, and agree on how the VPN will be retired. Missing inventory is the most common reason migrations take longer than planned, so treat it as a deliverable rather than a formality.

Internal teams can do this if they have people with networking, identity and application ownership skills and enough time to run a parallel migration. Both NetBird and Pomerium publish their source code and self-hosting documentation, so the software is accessible without a license purchase. The harder parts are usually the non-web applications, device posture integration and the cutover plan, where a mistake can lock users out. Many organizations split the work: internal staff own applications and users, while a partner handles architecture, hardening and the runbook. Compare the skills you have against the app inventory before deciding.

Duration depends on the number of applications, their types, the number of identity providers and posture sources involved, and how many change windows your organization allows. No supplied figure sets a general timeline, so the length is set by the written plan agreed before work begins. A fixed-scope engagement lists the applications in each wave, the acceptance tests and the dates for each stage. Ask for the plan to show how many applications move per wave, what testing each wave includes, and what happens if an application fails testing. Fast starts often come from a small pilot group with a few web apps, while the full cutover waits for the non-web apps.

NetBird's cloud pricing page lists a Free plan for up to 5 users and 100 machines, a Team plan at 6 euros per user per month and a Business plan at 12 euros per user per month with 100 machines included plus extra machines at 0.50 euros each, with custom Enterprise pricing. Team adds SSO and MFA with an enterprise identity provider, SCIM provisioning and audit event logging, while Business adds device approvals, MDM and EDR device controls, posture checks and traffic logging. Pomerium's pricing page lists Zero Business at $9 per user per month billed monthly or $7 billed annually, with Enterprise at custom pricing and a self-hosted control plane. These are managed subscription prices, so compare them with the infrastructure and staff time of a self-hosted design, and check the current pages before budgeting.

After go-live, the recurring work includes upgrades, backups, monitoring, access reviews, policy changes for new applications and support for users and devices. NetBird's documentation states that self-hosted operators handle backups, upgrades and scaling themselves. Expect regular release updates to the overlay or proxy, the identity provider and the client software, each of which needs testing before rollout. Recurring costs therefore include infrastructure, staff time and any support retainer you choose. DeployOpen offers ongoing support, upgrades and continuous testing as retainers, which can cover this work for the client's own infrastructure, with scope agreed in writing.

One-time costs include the application inventory, architecture and design, initial deployment, identity provider and posture integration, migration of each application, and the cutover itself. Recurring costs include infrastructure for the control plane and relays, subscription fees if you choose a managed plan, upgrades, backups, monitoring and access reviews. Parallel running sits between the two: the VPN and the new access path both cost money until the last application moves and the VPN is retired. Ask for quotes that separate these categories so you can see the monthly cost after cutover.