AmneziaWG is free. The coordination plane, key lifecycle, ACL engine, and on-call rotation are not.
Generating and exchanging keys for every device, securely, forever. One stale key is an incident.
Hand-assigning addresses, writing per-peer config files, tracking which peer is which human.
STUN/TURN-style relaying when peers can't punch through — you run the relays too.
AmneziaWG is all-or-nothing per interface. Per-resource access means iptables art on every box.
SSO, SCIM offboarding, group sync — the part every DIY mesh eventually fails an audit on.
Upgrades, revocation lists, monitoring, and the person who owns it all leaving the company.
| DIY AmneziaWG mesh | OpenVLAN | |
|---|---|---|
| Time to working mesh | Days–weeks (first time) | Minutes |
| Adding a device | Key exchange + config edit + restart | Login |
| Revoking access | Manual, every affected host | IdP offboard, automatic |
| Per-resource ACLs | DIY firewall rules | Policy as code |
| Behind hard NAT | Run your own relays | Automatic fallback |
| Audit trail | Whatever you build | Flow logs + session recording |
Laptop-to-server for yourself? Plain AmneziaWG is perfect. Add a third human and reconsider.
Air-gapped or sovereign requirements where you must own every byte — see our self-hosted coordination docs.