Self-hosting WireGuard or OpenVPN looks cheap on the licence line, and for a small, single-site team with no compliance obligations it genuinely can be the right call. Past the NIS2 50-employee threshold, the picture flips. The hidden costs, no control plane, fragile PKI, a Franken-VPN of bolt-on components, no device posture, and a heavy audit-evidence burden, push the five-year total cost of ownership to about €332,388, versus roughly €148,953 for a managed platform, a 55% gap. For a compliance-bound European mid-market team, a managed, sovereign SASE like Jimber is the better buy.
Key takeaways
- WireGuard is a fast tunnel protocol with no control plane, so identity, MFA, key distribution and posture are all yours to build and maintain.
- OpenVPN’s PKI carries a silent failure mode: an expired Certificate Revocation List rejects every connection at once, taking the whole remote workforce offline.
- Matching a managed platform means assembling a “Franken-VPN” of SSO, MFA, firewall and database components, and owning all the integration debt.
- At 500 users over five years, DIY runs about €332,388 against €148,953 managed, driven mostly by 60 engineer-hours a month at Belgian loaded rates.
- DIY suits under 50 users with no compliance; above that, CyFun maturity-3 evidence and NIS2 obligations make a managed sovereign platform the practical choice.
What self-hosting actually involves at scale
WireGuard is a minimalist, high-performance protocol, roughly 4,000 lines of kernel code, with excellent throughput. It was designed as pure point-to-point encryption, though, and deliberately has no control plane. Scale it to a few hundred users and the operational load appears:
- Key management. WireGuard uses static Curve25519 key pairs with no dynamic configuration protocol, so IT generates and distributes config files by hand. Integrating keys with Active Directory tends to produce brittle, error-prone scripts.
- Split-tunnel DNS. On systems using systemd-resolved, or on macOS and iOS, the WireGuard client’s DNS settings often override the local resolver entirely, which breaks access to local resources or stalls internet resolution.
- NAT traversal. Behind restrictive firewalls or double NAT, the UDP handshake can fail, forcing teams to stand up UDP relays through socat or extra VPS “bouncer” nodes, which adds fragile infrastructure.
- FIPS. WireGuard is hard-coded to ChaCha20-Poly1305 and Curve25519, so it cannot be FIPS-certified without changing the source, which rules it out where FIPS-approved cryptography is legally required.
OpenVPN is more flexible but demands a full PKI, usually via Easy-RSA, and carries a notorious silent failure: the Certificate Revocation List. The EASYRSA_CRL_DAYS value (30 to 180 days by default) sets the CRL’s validity, and if no certificates are revoked in that window it expires quietly. Because OpenVPN and OpenSSL check the CRL strictly on every renegotiation, the server then rejects all connections with “VERIFY ERROR: CRL has expired”, an acute, total outage for the whole remote workforce that needs manual command-line intervention to fix. OpenVPN Community is also CLI-only; the commercial Access Server adds a web UI but reintroduces per-connection licensing from about $7 to $14 per concurrent connection.
The “Franken-VPN” and the security gap
To close the gaps of a raw tunnel, a self-hosted setup has to integrate and maintain a patchwork: something like Defguard or Firezone for an OIDC/SAML control plane and MFA, a tool like NHAS/wag for device registration and MFA-gated routes, iptables or firewalld on the gateways for segmentation, and a MySQL or PostgreSQL cluster for high availability. Now IT owns the patching, securing and monitoring of a stack of databases, auth proxies and firewall scripts, where any update or misconfiguration can open a hole or take the network down.
Even fully assembled, the core weakness remains implicit trust. Once the handshake completes, the device gets an IP on the internal segment, which means lateral movement if it is infected, no check of device posture (firewall on, disk encrypted, no active malware), and no inline threat inspection, SWG or DLP. A managed SASE closes this by never placing the user on the network and inspecting traffic once as it crosses the edge.
Build versus buy, side by side
| Dimension | Self-hosted VPN (WireGuard / OpenVPN) | Managed SASE / ZTNA (Jimber) |
|---|---|---|
| Access control | Network-level; broad access to the destination subnet | Application-level microsegmentation by identity |
| Operational effort | Very high; manual keys, MFA scripting, server upkeep | Minimal; central cloud console, automated onboarding |
| Security features | Transport encryption only; no SWG, DLP or threat inspection | Converged SWG, browser isolation, posture, inline inspection |
| Compliance (NIS2/CyFun) | Manual syslog correlation and segmentation proof | Native, exportable identity-aware audit logs |
| High availability | Manual clustering, DB replication, DNS round-robin | Native active-active redundancy across an edge network |
| Data sovereignty | Depends on the VPS provider’s jurisdiction | EU vendor, storage and processing inside the EU |
The five-year TCO, quantified
Using a representative Belgian scenario of 500 users across 5 sites in 2026, and a senior network/systems engineer’s average gross salary of €104,670 loaded at 1.4x for a €70.45 hourly rate, the picture is clear once engineering time is counted.
| Cost item (500 users, 5 years) | Self-hosted VPN | Managed SASE platform |
|---|---|---|
| Cloud & hosting | €25,200 | €0 (included) |
| Software & licences | €3,000 | €120,000 |
| Implementation labour | €10,568 (150 hrs) | €2,818 (40 hrs) |
| Operational management | €253,620 (60 hrs/month) | €21,135 (5 hrs/month) |
| Compliance & audit evidence | €40,000 | €5,000 |
| 5-year TCO | €332,388 | €148,953 |
The managed platform is roughly €183,435, or 55.2%, cheaper over five years. The DIY licence looks almost free, but 60 engineer-hours a month of senior time, plus the manual compliance burden, dominate the real cost. For the wider migration-cost picture, see our hidden costs of a SASE migration and the SASE pricing models guide.
When DIY is fine, and when it is not
This is a genuine trade-off, so it deserves a clear line. A self-hosted VPN is a good fit for fewer than 50 active users, a single site, a homogeneous fleet of managed devices, no NIS2 or DORA obligations, and ample in-house DevOps capacity. A managed SASE becomes necessary above 50 users, where the NIS2 size-cap rule pulls you into supervision and audit duties, and for multi-site or hybrid-cloud estates, a mix of BYOD, externals and partners, formal compliance, or a lean IT team that needs to focus on the core business. CyFun’s requirement to demonstrate maturity level 3, with formally approved, evidenced processes for nearly every network activity, is close to impossible to sustain on a self-hosted VPN without a full-time compliance hire, whereas a managed platform generates that evidence continuously from one console. Our NIS2 compliance checklist shows what that evidence looks like.
A managed sovereign platform such as Jimber consolidates ZTNA, SWG, SD-WAN and FWaaS into one cloud-native service, adds Remote Browser Isolation so web threats never reach the endpoint, and secures agentless OT and legacy devices with the NIAC, all under EU jurisdiction. That is the level of protection and provable compliance a raw self-hosted tunnel cannot reach.
Count the engineer-hours, not just the licence
DIY VPN is cheap until you add senior time and audit evidence, at which point a managed sovereign platform is both cheaper and stronger for a compliance-bound mid-market team. Book a Jimber demo to see converged ZTNA, browser isolation and the NIAC in one EU-sovereign console, or compare flat-rate pricing against the true cost of self-hosting.
Frequently asked questions
Why does split tunneling on WireGuard often cause DNS problems?
WireGuard is a network-layer protocol with no dynamic DNS integration. In a split tunnel you must define the corporate DNS server in the client config to resolve internal hostnames, and on modern operating systems that setting often overrides the local resolver entirely. If the corporate DNS then cannot resolve public domains, the user loses normal internet browsing even though the tunnel is up.
What is the operational impact of OpenVPN’s CRL expiration?
The Certificate Revocation List lists revoked certificates and has a validity window (often 30 to 180 days). If it expires with no changes in that period, it lapses silently, and because OpenVPN and OpenSSL check the CRL strictly on every renegotiation (typically hourly), the server immediately refuses all connections. That is an acute, organisation-wide outage requiring manual regeneration to resolve.
Can a self-hosted WireGuard install be FIPS-certified?
No. FIPS requires approved algorithms such as AES-GCM and SHA-2, and WireGuard is hard-coded to use ChaCha20-Poly1305 and Curve25519. Those are cryptographically strong, but they disqualify a standard WireGuard install for organisations legally required to use FIPS-certified cryptography.
What does OpenVPN Access Server cost at mid-market scale?
Access Server is free for up to two concurrent connections; beyond that it uses a paid model priced per concurrent connection. Reference rates put 10 concurrent connections at about $90 per month ($9 each) and 25 at around $225 per month, and hardware and management costs sit on top, so the price advantage over modern ZTNA erodes at scale.
How does Jimber secure agentless devices like printers or OT systems?
Devices such as PLCs, SCADA systems and printers cannot run agents. Jimber uses the Network Isolation Access Controller (NIAC), a local hardware or software connector that isolates the agentless device from the wider network and permits only strictly defined, identity-aware flows managed from the central console, so a compromised IoT device cannot move laterally.
When is a self-hosted VPN still the right choice?
For small startups or homogeneous engineering teams under 50 users, on a single site, with in-house infrastructure skills and no NIS2 or DORA obligations, a self-hosted WireGuard or OpenVPN setup can be appropriate and cost-effective. Past the 50-employee threshold, or with multi-site, BYOD, external partners or compliance requirements, a managed SASE becomes the more sustainable choice.
