Firezone vs SoftEther VPN (2026): which should you pick?

Pick Firezone if

• Fits if you are a team of 6 or fewer that wants access tied to a sign-in
• Works for teams that already use Okta, Entra ID or Google Workspace

Look elsewhere if

• Tight if you grow past 6 users, 10 service accounts or, on Team, 500 users
• Pricey if you need directory sync or device posture checks, which are on Business at $80 a seat a year
• Skip it if you want to self-host for production, because the GitHub page says that is not officially supported
• Watch out: the Enterprise trial is 30 days and only on request through sales
• Watch out: prices are for Firezone Cloud US, in dollars, with an EU region announced

Pick SoftEther VPN if

• Fits if you want one server that accepts several VPN protocols
• Works for people who need to bridge networks at the Ethernet layer

Look elsewhere if

• Skip it if you want a hosted VPN with provider servers
• Not for you if you want a vendor to call: support is a forum and the community
• Watch out: the news items on the project page are dated 2019
• Watch out: the page lists a 2019 security advisory for the Windows local bridge driver
• Watch out: the project's own client list also includes Windows Mobile, an old platform

Firezone

• Starter is capped at 6 users and 10 service accounts; Team at 500 users.
• Directory sync and device posture checks need Business at $80 per seat / year.
• The GitHub page says production self-hosting is not officially supported; Firezone Cloud is the supported way to run it.
• Prices are for Firezone Cloud US, in US dollars; a Cloud EU region was announced on the pricing page.

SoftEther VPN

• It is software to host yourself, not a VPN service with provider servers.
• Clients are listed for Windows, Linux, Mac, Android, iPhone and iPad; the project's own native client list also includes Windows Mobile.
• The project page's news items shown are dated 2019, and the page lists a 2019 security advisory for the Windows local bridge driver.
• Support runs through a project forum and community, not a vendor with paid support.

Firezone

WireGuard with a Rust data plane

The site says it combines WireGuard with a Rust data plane tuned per operating system, and lists throughput figures from 2 Gbps on mobile to 7 Gbps and up on Linux, as tested.

Outbound-only gateways

Gateways only make outbound connections and never listen for traffic from the internet, so no firewall ports are opened.

Identity-provider sync

Syncs users and groups from Okta, Entra ID and Google Workspace on Business, so deactivating a person there signs them out of every device.

Device trust and posture checks

Checks a device certificate from an MDM and can use checks such as disk encryption and OS version, drawn from over 380 parameters from supported MDM and EDR tools.

Conditional policies

Policies can require a sign-in provider, location or time of day before a group reaches a resource.

SoftEther VPN

VPN over HTTPS

SSL-VPN tunneling on HTTPS passes through NATs and firewalls.

Many protocols on one server

The server also supports OpenVPN, IPsec, L2TP, MS-SSTP, L2TPv3 and EtherIP, so built-in clients on phones and computers can connect.

OpenVPN clone function

A clone of the OpenVPN server lets existing OpenVPN clients connect, which the project pitches as a way to migrate.

Layer-2 Ethernet bridging

Supports LAN-to-LAN and cloud-to-LAN bridge VPNs built on an Ethernet-based design.

Admin tools and API

Server, client and bridge manuals, a command-line utility, and a JSON-RPC API with an HTML5 admin console.

Firezone

• Starter$0

  Up to 6 users and 10 service accounts, native clients, email and OpenID Connect sign-in, resource-level policies, audit logs, a REST API and community support.

• Team$50

  per seat / year ($5 per seat / month billed monthly)

  Up to 500 users, full-tunnel routing, conditional access policies, a custom account slug and priority email support. Self-serve, no contract.

• Business$80

  per seat / year ($8 per seat / month billed monthly)

  Directory sync for Google, Entra ID and Okta, device posture checks, log sinks and SIEM integrations; up to 1,000 users, 200 service accounts, 200 sites. Per active seat.

• EnterpriseCustom

  Unlimited users, service accounts and sites, SOC 2 and pentest reports, a 99.9% uptime SLA, dedicated Slack or Teams support and white-glove onboarding.

SoftEther VPN

• SoftEther VPN$0

  Free to download and run yourself; the server runs on Windows, Linux, FreeBSD, Solaris and Mac OS X.

Firezone

• Annual discount

  Save 17% with annual billing

  The pricing page shows $50 per seat a year for Team against $5 a month, and $80 against $8 for Business.

SoftEther VPN

No public discounts listed.