2026-06-05
Action required: pick your OpenVPN replacement
#vpn #openvpn #tailscale #wireguard #security #migration
As part of our roadmap of finding VPN alternatives we’re deprecating OpenVPN. It no longer meets our and our customers’ needs. We’re offering two replacements: Tailscale (full-featured, recommended) and a WireGuard-based setup (basic alternative). A GitHub issue has been created in your GitHub repository to open up the conversation and find the right fit together.
What’s changing
Moving forward, we have 2 new options to cover your VPN needs:
- Tailscale (recommended) for teams that want SSO, per-user and per-device access control, an audit log, and zero infrastructure to manage. Tailscale builds on WireGuard but adds a full control plane on top. This is a paid option.
- WireGuard is our most basic offering. It is a good solution if your VPN needs are limited and don’t mind doing some manual user management.
A side-by-side comparison lives in the VPN overview.
Why we are deprecating OpenVPN
- SSO and identity-provider integration. OpenVPN’s user model does not integrate with Google, Okta, Azure AD, etc. Onboarding and offboarding require manual cert/credential work.
- Operational overhead. Managing OpenVPN users and certificates is fully manual and scales poorly with team size.
- Modern foundations. Both replacements are built on WireGuard, which is faster, simpler, and easier to audit than OpenVPN.
What you need to do
We’d like to have a conversation with you to understand your setup and find the right fit together. We can do this over a short call. Reach out to your Customer Lead to set up a time or comment on the GitHub issue we’ve opened in your repository and we’ll follow up. Feel free to leave your thoughts on the topic there too, it’s useful prep if we end up on a call.
We’d like to move on this soon. The new setup simplifies user management for you and operations for us and the sooner you migrate the sooner those benefits land.