Valenius has grown a lot. So this page starts with the six things you won’t get anywhere else, then one table that settles what’s free and what’s paid — and the full technical detail is underneath, folded away until you want it.
Plenty of tools put a web panel in front of WireGuard®. These six are the reasons teams pick Valenius instead — and the first five are things the free panels structurally cannot do.
A privileged system service owns the tunnel; the user only talks to a tray app. Staff connect with one click on a locked-down laptop — no UAC prompt, no sudo, no shared admin password, and no private key a standard user could ever read.
Technical detail →Approve a device in the panel and it gets a key pair, a preshared key, an IP from the subnet and a finished config — nobody edits a .conf file, nobody restarts an interface. Delete the device and the peer disappears from the server too.
Your server also answers on UDP 443 — the port hotel Wi-Fi and guest networks leave open because HTTPS lives there. Both ports stay live at once and the client retries on the fallback automatically. The “the VPN doesn’t work from here” ticket stops arriving.
Technical detail →Not just on the admin panel — on the VPN. A user’s session carries traffic only after a verified second factor, enforced server-side, per group, with push-to-approve as an alternative to typing a code. Machine-to-machine links are never interrupted.
Technical detail →Every admin action is scriptable over 50+ scoped REST endpoints with a public OpenAPI 3.1 spec, and the same surface is exposed as an MCP server. Ask an assistant to kill the tunnel on a stolen laptop; it becomes an ordinary, audit-logged API call.
Technical detail →
Valenius runs on your own servers: keys, device data and logs never leave the company, because there is no vendor cloud to leak from. The core is AGPLv3, so your security team can read exactly what it does — and the vendor behind it is an EU GmbH, not a US CLOUD Act subject.
Security & trust →Two more things that surprise people: the Community edition is genuinely free — no device limit, no trial clock — and Valenius manages the WireGuard® server you already run, from day one. No rip-and-replace, no migration project.
Wondering how that stacks up against wg-easy, WGDashboard, WireGuard Portal or WireGuard WebAdmin? See the feature-by-feature comparison →
Community is the full platform: unlimited devices, all five client apps, central management, security and monitoring. Pro adds the server-side automation layer. Cloud is Pro with the server run by us.
| Capability | Community | Self-hosted Pro | Cloud by Stranto |
|---|---|---|---|
| Clients & end-user experience | |||
| Windows, Linux, macOS, Android & iOS client apps | Yes | Yes | Yes |
| One-click connect without administrator rights | Yes | Yes | Yes |
| Verified-connectivity check through the tunnel | Yes | Yes | Yes |
| Simultaneous multi-VPN on desktop, QR pairing on mobile | Yes | Yes | Yes |
| Automatic fallback on UDP 443 for restrictive networks | No | Yes | Yes |
| Central management | |||
| Unlimited devices, users and customers | Yes | Yes | Yes |
| Live presence, remote config push, per-device settings | Yes | Yes | Yes |
| Audit log, connection history, redacted remote log collection | Yes | Yes | Yes |
| Encrypted backup & restore of the whole deployment | Yes | Yes | Yes |
| Automatic client updates served from your own backend | Yes | Yes | Yes |
| Per-customer pre-configured installers (silent / MDM) | Yes | Yes | Yes |
| Server-side liveness detection & remote Kill Tunnel | No | Yes | Yes |
| Per-client traffic statistics & dashboards | No | Yes | Yes |
| Server automation | |||
| Manages an existing WireGuard® server (manual config upload) | Yes | Yes | Yes |
| Zero-touch peer provisioning via the Pro sidecar | No | Yes | Yes |
| Automatic key, preshared-key and IP allocation | No | Yes | Yes |
| Several isolated customers on one WireGuard® host | No | Yes | Yes |
| One-click connectivity self-test, handshake-confirmed | No | Yes | Yes |
| Zero-downtime appliance updates, auto-rollback, rollout rings | No | Yes | Yes |
| Security & access control | |||
| Config encryption at rest + system-only file permissions | Yes | Yes | Yes |
| OIDC + TOTP sign-in for the admin panel | Yes | Yes | Yes |
| Fleet-wide remote API-key rotation | Yes | Yes | Yes |
| AGPLv3 source you can audit yourself | Yes | Core | Core |
| mTLS + internal CA between backend and WireGuard® servers | No | Yes | Yes |
| Server-enforced MFA for VPN access (TOTP / push-to-approve) | No | Yes | Yes |
| Monitoring & integrations | |||
| Prometheus metrics endpoint + official Zabbix template | Yes | Yes | Yes |
| Per-gateway metrics — peers, handshake age, CPU, memory | No | Yes | Yes |
| Management REST API + public OpenAPI 3.1 spec | No | Yes | Yes |
| Built-in MCP server for AI assistants | No | Yes | Yes |
| Operations, licence & support | |||
| Where the backend runs | Your infrastructure | Your infrastructure | Stranto’s EU cloud |
| Hosting, updates and backups handled by Stranto | No | No | Yes |
| Licence | AGPLv3 | AGPLv3 core + commercial Pro licence | Included in the subscription |
| Support | Community, via GitHub | Included with the licence | Included |
| Price | Free, forever | Contact us | from €3.00 / endpoint / month |
Cloud by Stranto contains every Pro capability — the only difference is who operates the server. See full pricing and volume tiers →
Ten capability areas, each with its architecture and its specs. Nothing has been cut; it is simply folded away so the page stays readable.
A privileged system service owns the WireGuard® tunnel; users talk to it through a tray app over a local IPC channel that authenticates the calling user. No UAC prompts, no sudo, no shared admin password — and per-user profile separation built in.
After the tunnel comes up, Valenius probes your server through the tunnel and only flips to a green checkmark once the probe succeeds — so “connected” means verified end-to-end, not just “interface up”.
The Android and iOS apps share one codebase, so they get the same connect/disconnect flow and the same verified-connection checkmark as the desktop clients — the app keeps showing your VPN profiles even through a brief connectivity blip, instead of flashing an error.
New devices are activated by scanning a QR code — no typing configs on a phone keyboard.
Every client maintains a heartbeat plus a long-poll channel to your backend. A device shows online seconds after the user opens the tray app — and offline the moment they quit it, because the client actively signs off instead of waiting for a timeout.
The actual admin panel — live fleet overview
Clients check your backend — not a vendor server — for updates and install them automatically within the hour. Need it now? “Force update” in the panel triggers an immediate one-shot rollout on the next heartbeat. Every download is checksum-verified before a single byte is installed.
Pro appliances go further: the update agent starts the new version next to the running one, health-checks it repeatedly, swaps production only on success, and keeps watching afterwards — rolling back automatically if the new version misbehaves.
A lightweight sidecar runs next to your WireGuard® interface and gives the backend a management API. Approve a device in the panel — it gets a key pair, an IP from the interface subnet, and a complete config, without anyone touching a .conf file.
Setup is one enrollment token: the sidecar generates its own private key, sends a signing request to your backend, and receives its certificate automatically. The token is one-time and consumed on use.
Before you tell a customer their VPN is live, the admin panel can verify it for you. “Check ports” tests every inbound port the WireGuard® host needs — the UDP ports are confirmed with a real WireGuard® handshake, not a ping, so a pass proves the port is reachable, the server’s key matches, and peer provisioning actually works.
“Run test” goes further and has the server inspect itself: IP forwarding, NAT, firewall forwarding rules, upstream routing, and configuration drift. That catches the single most confusing VPN failure — a tunnel that connects, shows as connected, and carries no traffic at all. Nothing observed from outside the server can detect that.
Every Pro-managed WireGuard® server can also answer on UDP 443 — the port that hotel Wi-Fi, guest networks, and locked-down corporate firewalls almost always leave open, because it’s where HTTPS lives. Both ports stay live at once, with a per-customer toggle in the admin panel, and clients retry automatically on the fallback port the moment a connection attempt is blocked — no manual profile edit, no support ticket.
It’s a resilience layer most WireGuard®-based competitors simply don’t offer, because it takes a real management plane on the server side to run two ports safely and hand a client the right one automatically. For your users, a restrictive network stops being a reason to call IT.
Every call between your backend and your WireGuard® servers is mutually authenticated TLS: the backend runs its own internal certificate authority, and a server without a valid client certificate gets nothing but a health endpoint.
On end-user machines, configs are locked to the system account and encrypted at rest on every platform — in both editions. Standard users can connect, but can never read a private key; even direct disk access doesn’t expose one.
Pro can also gate the tunnel itself: server-enforced multi-factor authentication means a user’s VPN session only carries traffic after a verified second factor — a direct building block for NIS2-style access controls.
MFA is per-group, not all-or-nothing — stronger checks for admins, lighter for everyday staff. Instead of typing a code, users can approve a connection with a tap and Face ID/fingerprint on a second device. And it’s scoped to user access only: machine-to-machine and site-to-site connections are never interrupted.
Anything an administrator can do in the panel, Pro can also do over a scoped REST API: create and edit clients and customers, provision peers, connect or force-disconnect a device, set MFA policy, mint QR pairing codes, pull traffic and audit data. The OpenAPI 3.1 specification is served openly from your own backend, so Visual Studio, Postman, n8n or an RMM can import it from the URL and generate a typed client — no token needed just to read the spec.
The same surface is also exposed as an MCP server — the protocol Claude, Gemini, OpenAI and Mistral use to call external tools. Point an assistant at your backend and ask it in plain language: “which clients haven’t checked in this week?”, “kill the tunnel on that stolen laptop”, “onboard a new customer called Acme”. Underneath, every request is an ordinary API call — same token, same permissions, same audit entry.
Access is yours to shape. A token carries only the scopes you tick, so a triage assistant can be allowed to look at the fleet without being able to change a single thing; adding the right to act is a deliberate, separate decision. Bind a token to one customer and it can never see the others. Revocation is immediate, and every action is recorded under that token’s name in the audit log.
Valenius exposes a Prometheus-compatible metrics endpoint, so the monitoring system you already run can watch the VPN the same way it watches your servers — is the backend up, is the database reachable, how much license runway is left, how many devices are online. It ships in both editions: observability is part of the open-source core, not a Pro upsell.
For Zabbix there is a finished, official template. One HTTP agent item polls once a minute and Zabbix’s own Prometheus preprocessing derives everything else from that single payload — around twenty control-plane and license items, plus per-gateway items and triggers that low-level discovery finds on its own. No agent on the backend, no script on the Zabbix server, and one request per minute no matter how large the fleet gets.
curl checkGET /api/v1/metrics, Prometheus text exposition formatmonitoring:read scope, optional CIDR allowlistValenius by HTTP, import-verified on Zabbix 7.4, declares 7.0The Community edition is free, self-hosted, and has every feature you just read about except the Pro automation.