FerrumGate: Open-Source Zero Trust Access for Modern Networks

For decades, VPNs and firewalls were the foundation of secure remote access. The model was simple: create a secure tunnel into a private network, and once authenticated, users had access to everything inside.

But this “castle-and-moat” approach is showing its age. Once someone gets past the perimeter, whether they are an insider or an attacker who stole credentials, they can often move laterally across the network. This is why VPNs have become a common attack vector for ransomware, data theft, and espionage.

Organizations, self-hosters, and even hobbyists now need something smarter. This is where Zero Trust Network Access (ZTNA) comes in.

What is Zero Trust Network Access?

Zero Trust flips the traditional model on its head. Instead of assuming users inside the network are trusted, Zero Trust assumes nobody is trusted by default. Every access request,whether from inside or outside the network,must be verified in real time.

A Zero Trust system enforces policies based on:

• Who is requesting access (identity)
• What device they’re using (device posture)
• Where they’re coming from (location, country, network type)
• When they’re connecting (time-based policies)
• What resource they’re trying to reach (granular access control)

This ensures that even if credentials are stolen, attackers cannot move freely.

Enter FerrumGate

FerrumGate is an open-source Zero Trust Access platform that implements these principles in a way that’s flexible, transparent, and self-hostable. It’s designed to replace generic VPNs with fine-grained, identity-aware access.

Unlike many commercial ZTNA providers (like Zscaler, Twingate, or Cloudflare Access), FerrumGate gives you the freedom to deploy it in your own environment,whether on-premises, cloud, or hybrid.

Core Features of FerrumGate

• Identity-first access: Works with Active Directory, Azure AD, Google Workspace, Okta, and more.
• Multi-factor authentication (MFA) and passwordless access support.
• Device posture checks: Ensure devices meet requirements (antivirus, OS patching, etc.).
• Granular policies: Define who can access what, when, and from where.
• Multiple tunneling protocols: SSH, SSL, and WireGuard tunnels.
• Analytics and insights: Monitor every connection, log every request, detect anomalies.
• Open source: Transparent, auditable, and community-driven.

FerrumGate is especially appealing for self-hosters and organizations that want enterprise-grade security without giving up control to a third-party cloud.

Use Cases

1. Remote Workforce Security

Instead of giving employees a flat VPN tunnel, FerrumGate grants access only to approved resources,such as internal dashboards or file servers,based on identity.

2. Cloud and SaaS Protection

Secure SaaS applications like Office 365 or custom web apps without exposing them to the open internet.

3. Privileged Access Management

Limit and monitor admin access to critical infrastructure. Every action can be logged and audited.

4. IoT and Edge Devices

IoT deployments often have weak security. FerrumGate ensures that only authorized devices can communicate with the network.

5. Self-Hosting & Homelabs

For enthusiasts running Nextcloud, media servers, or home automation, FerrumGate provides secure, policy-driven access from anywhere without the risks of a traditional VPN.

Amateur Radio and FerrumGate

Amateur radio is increasingly digital. Operators run APRS gateways, SDR receivers, logging servers, repeater controllers, and more. Many of these services are connected to the internet for remote collaboration, but security is often an afterthought.

FerrumGate can help here in several ways:

• Club servers: A radio club can expose its logging database or contest server to members only, with policies tied to their callsign-based accounts.
• APRS and packet gateways: Gateways can be protected so only verified devices forward traffic.
• Remote station control: Operators running remote HF or VHF stations can lock down access by identity, device type, or even geolocation so only club members in Malaysia, for example, can connect.
• Experimentation with Zero Trust for Ham projects: Ham operators often lead innovation in networking. Deploying FerrumGate in a ham environment could be a practical experiment in extending Zero Trust concepts to radio-linked networks.

By adopting tools like FerrumGate, amateur radio communities can continue to innovate while protecting systems from unwanted intrusion.

Why Choose FerrumGate Over a VPN?

For many users, FerrumGate offers the same simplicity as a VPN client but with the security model of Zero Trust.

Community and Open Source

Being open-source means FerrumGate isn’t a black box. You can inspect the code, contribute features, and join the community. This transparency is a strong selling point compared to closed, SaaS-only ZTNA vendors.

Final Thoughts

FerrumGate is more than a VPN replacement. It’s a full-featured Zero Trust platform that balances usability with security. Whether you’re an enterprise protecting sensitive systems, a small business enabling remote work, a homelabber self-hosting apps, or even an Amateur radio operator experimenting with digital infrastructure, FerrumGate is a flexible and trustworthy solution.