Pritunl Review 2026: $0, $10 or $70 Per Host and Unlimited Users

Pritunl at a glance

Pritunl is a self-hosted VPN server for companies. You install it on your own Linux machines, it stores its state in MongoDB, and it speaks OpenVPN and WireGuard to clients and WireGuard or IPsec between sites. Pritunl, Inc, a small company in Seattle, sells licences for it. It does not run any VPN servers for you.

That makes it a very different product from a consumer privacy VPN. There are no server locations to pick, no no-logs promise to weigh and no streaming unblocking. The question this review answers is narrower: is Pritunl a good way for an IT or DevOps team to give staff remote access and link networks together, and what does it really cost?

• Best for: teams replacing OpenVPN Access Server, or running site-to-site and multi-cloud VPC links, who are comfortable running Linux and MongoDB themselves.
• Price model: per host per month - Community $0 (one host), Premium $10, Enterprise $70. Users, connections and devices are unlimited on every plan.
• Main strengths: very low cost per user at scale, WireGuard at no extra charge, clustering with no single point of failure, broad SSO on Enterprise.
• Main catches: you run, patch and monitor it yourself; no official mobile app; no published third-party audit or SLA; a custom licence that does not match the site's "open source" wording.

Pricing: $0, $10 or $70 per host

Pritunl's headline is "Simple per-server pricing with unlimited users and connections on every plan." The pricing table sits on the homepage (pritunl.com/#pricing). There is no separate pricing page.

Community - free

"Single host with unlimited users." One Pritunl instance, with no cap on VPN servers on that host, users created, users connected or devices per user. The free tier is limited by the number of hosts, not by headcount, which is unusual and generous.

Premium - $10 per host per month

"Each Pritunl host is billed at $10/month." It adds port forwarding to VPN clients, gateway links and failover gateway links, bypass of secondary authentication, Chromebook (ChromeOS) profiles, configuration sync, emailing user keys and extra themes.

Enterprise - $70 per host per month

"All Premium features plus single sign-on, failover and site-to-site links." This is the plan most businesses will end up on. It adds SSO ("SAML, Google Apps, Duo Security and Radius" on the pricing card), TPM and Apple Secure Enclave device authentication, automatic failover, replicated servers, VXLan, AWS VPC routing integration, site-to-site VPN, NAT and DNS controls, InfluxDB monitoring, advanced auditing, bridged mode, multiple administrators, user PIN policy, Python plugins, a REST API with multiple keys, IPsec links via pritunl-link, multi-cloud VPC peering and automated link failover.

What it costs in practice

OpenVPN, WireGuard and the clients

The homepage calls Pritunl an "Enterprise Distributed OpenVPN WireGuard and IPsec Server". Users connect with OpenVPN or WireGuard. WireGuard and IPsec are used for site-to-site links and VPC peering between datacenters.

WireGuard is not a paid feature. It is a setting on each server, and the docs say "WireGuard connections have the same features as an OpenVPN connection", including client automatic failover ("approximately 13 seconds after server failure"), replicated servers, every secondary authentication method and IPv6. The one gap: site-to-site link connections still use OpenVPN.

Desktop clients

"Pritunl supports all OpenVPN clients." For full functionality, including WireGuard, the vendor points you to its own Pritunl Client for macOS, Windows and Linux. It is free, pitched as an "alternative to Viscosity", and ships as a macOS .pkg, a Windows .exe, a Flatpak and Linux repo packages. It also has a terminal interface for headless servers and SSH sessions. ChromeOS gets OpenVPN profiles on Premium and above.

Phones and tablets

"An official Pritunl client is not available on mobile devices but any OpenVPN client can be used to connect to Pritunl." That works, but it means mobile users get a third-party app and a different experience. Server v1.34.4763.45 (September 27, 2026) added "OpenVPN mobile sso support", which closes part of the gap for SSO-based setups.

Single sign-on and security

SSO is an Enterprise feature. Pritunl's SSO page lists Google Workspace, Okta, OneLogin, Microsoft Entra, Auth0, JumpCloud, Duo, YubiKey, Slack, RADIUS, a plugin option and Active Directory through RADIUS. The pricing card names a shorter set, so check your provider on the SSO page rather than the card.

On security, the vendor says Pritunl is "the only VPN server to offer up to five layers of authentication. Including a user certificate, six digit user pin, two-factor authenticator, single sign-on and mobile push authentication." That is the vendor's own claim. The same page lists SELinux policies, TPM and Secure Enclave device authentication and auditing.

Audits and vulnerabilities

The security page mentions no third-party audit, and we found none published. NVD lists seven Pritunl CVEs. The only one from 2023 to 2026 is CVE-2025-43917 (CVSS 8.2): "In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product." Older entries include CVE-2022-25372, a local privilege escalation in the Windows client reported by Rhino Security Labs, and CVE-2020-25200, a username enumeration issue the vendor disputes.

More recently, client 1.4.4777.90 (October 11, 2026) lists "Fix WireGuard privilege escalation" in its release notes, with no CVE assigned that we could find. The current client is 1.4.4791.77 (October 25, 2026). If you deploy Pritunl Client, keep it on the latest build. Vulnerabilities go to [email protected].

Release cadence

The server is actively maintained. 2026 releases include 1.34.4627.67 (May 14), 1.34.4646.94 (June 2), 1.34.4649.96 (June 5), 1.34.4681.89 (July 7) and 1.34.4763.45 (September 27), which added mobile SSO, local OTP for admin logins, IP pool fixes and routing options.

Clustering, scaling and cloud links

This is where Pritunl stands out. "All servers operate as equal peers with no single point of failure." Every host in a cluster connects to the same MongoDB database, which carries all server communication. You can replicate one VPN server across several hosts to scale out, and Pritunl manages VXLan for replication across availability zones. The vendor links a "20k Concurrent Clients Test" from its infrastructure page.

Pritunl Link builds WireGuard or IPsec site-to-site links across AWS, Google Cloud, Azure, Oracle Cloud, Pritunl Cloud and Hetzner, and can "automatically update cloud provider routing tables using native APIs when a link failure is detected." All of this sits on the $70 Enterprise plan now that Enterprise+ is gone.

Installation and what you have to run

"Pritunl is built on MongoDB." A single host can run MongoDB on the same machine. A cluster needs a shared MongoDB that every host can reach, and the install snippets use the MongoDB 8.0 repository. Running and backing up that database is your job.

The homepage lists 16 install targets: Arch Linux, Amazon Linux 2023, AlmaLinux 8, 9 and 10, Oracle Linux 8, 9 and 10, Rocky Linux 8, 9 and 10, Debian 12 and 13, and Ubuntu 22.04, 24.04 and 26.04. The docs are more selective. "All development and testing of Pritunl software is done on Alma Linux and it is the recommended distribution", and "it is recommend to only use AlmaLinux, Rocky Linux or Red Hat Enterprise Linux for Pritunl servers." They also warn that "future support with Ubuntu installations is not tested or guaranteed."

Is Pritunl really open source?

The website says yes. Its meta description is "Free open source enterprise distributed VPN server", it carries an "Open Source Enterprise VPN Server" badge, and it calls itself an "open source low cost alternative to OpenVPN Access Server".

The licence file in the server repository says something narrower. It states "Non-commercial use only", that "Source-code or binary products cannot be resold or distributed", and that you "can modify source-code but cannot distribute modifications (derivative works)". It defines commercial purposes as "a 3rd party has to pay in order to access Software or that the Website that runs Software is behind a paywall." GitHub reports the licence as "Other", not a recognised open source licence.

The fairest description is source-available. You can read the code, audit it and run it on unlimited servers, but you cannot fork and redistribute it. If you plan to charge others for access, read the licence with your own counsel. The Python server repository has about 5,000 GitHub stars and dates back to September 2013. The client, Zero, Cloud and Link are written in Go.

Support

Support is by email and community forums. There are three addresses: [email protected] for "general billing and low priority issues", [email protected] for "priority issues requiring faster response" and [email protected] for "issues causing service outages".

No SLA, response times or per-plan support terms are published for the VPN plans. For a product that sits between your staff and your network, that matters. Plan to be your own first and second line of support.

Pritunl Zero and Pritunl Cloud

Pritunl, Inc sells two other products that sometimes get mixed up with the VPN. Pricing for both is separate from the VPN plans.

• Pritunl Zero: a zero trust server for authenticated access to web apps and SSH, with an SSH certificate authority, SSO (Azure, Google, Authelia, Authentik, Okta), WebAuthn keys and automatic Let's Encrypt certificates. Community is free with no limits on servers or users. The Zero plan is $50 per month with a free 7 day trial and adds SSO, Geo-IP data and email support.
• Pritunl Cloud: a "KVM based alternative to Kubernetes" with declarative deployments. Community is free. The Cloud plan is $50 per month with a free 7 day trial, adds multi-tenant support, and "has no additional per-user or per-host charges."

Pros and cons

Pros

• Unlimited users, connections and devices on every plan, including free.
• Per-host pricing makes large teams very cheap per user.
• WireGuard included, with the same failover and authentication features as OpenVPN.
• Peer clustering with no single point of failure and replication across zones.
• Site-to-site and multi-cloud links across six providers on Enterprise.
• Works with any OpenVPN client, plus a free desktop client with a terminal mode.
• Active release cadence through 2026.

Cons

• Fully self-managed: Linux hosts, MongoDB, patching and monitoring are on you.
• No official mobile app, and the dynamic firewall blocks third-party clients.
• SSO only on the $70 Enterprise plan.
• No published third-party audit, SLA or support response times.
• No published refund or cancellation policy, and no current VPN trial.
• "Open source" marketing does not match a non-commercial, no-redistribution licence.
• Ubuntu support is offered but not guaranteed by the docs.

Alternatives worth comparing

Pritunl's closest rival is the one it names: OpenVPN Access Server, covered in our OpenVPN review. If you want another free self-hosted server, see our SoftEther VPN, Outline VPN and Amnezia VPN reviews. If you would rather not run servers at all, the managed zero trust services in our Tailscale, Twingate, Cloudflare Zero Trust and GoodAccess reviews charge per user but take the hosting off your hands. Our WireGuard protocol guide explains the protocol Pritunl now offers alongside OpenVPN.

Frequently asked questions

How much does Pritunl cost?

Pritunl costs $0, $10 or $70 per host per month. Community is free for one host, Premium is $10 per host and Enterprise is $70 per host. Users, connections and devices are unlimited on all three, so you pay for servers, not seats.

What are the limits of the free Community plan?

The only limit is one host. You can run unlimited VPN servers, users and devices on that host. Failover, replication, SSO and site-to-site links need Enterprise.

Is there a free trial or a refund policy?

Not for the VPN, as of November 2026. The paid VPN tiers no longer list a trial, and Pritunl publishes no refund or cancellation terms. The free Community tier is the way to test. Pritunl Zero and Pritunl Cloud do include a free 7 day trial.

Does Pritunl support WireGuard?

Yes, on every plan. WireGuard is enabled per server and has the same features as OpenVPN connections, including failover and secondary authentication. Site-to-site links still use OpenVPN, and multi-cloud links use WireGuard or IPsec.

Is there a Pritunl app for iPhone or Android?

No. There is no official mobile client. Phones connect with any standard OpenVPN app, and server v1.34.4763.45 added mobile SSO support for OpenVPN. If you enable the dynamic firewall, only the Pritunl Client can connect, which rules out phones.

Can I use Pritunl commercially if it is open source?

Pritunl is source-available rather than open source in the usual sense. Its licence says "Non-commercial use only" and defines commercial purposes as a third party paying to access the software or the site running it being behind a paywall. It also forbids distributing modified versions. Read the licence yourself before building a paid service on it.

Do I need MongoDB to run Pritunl?

Yes. Pritunl is built on MongoDB and uses it for all server communication. A single host can run MongoDB locally, while a cluster needs one shared MongoDB that every host can reach.

Is Pritunl a privacy VPN like NordVPN or Proton VPN?

No. Pritunl is software you host yourself to give your team access to private networks. Pritunl, Inc does not operate servers for you, so there are no locations, no no-logs policy and no streaming features to compare.

Key takeaways

• Pritunl charges per host, not per user: $0 Community (one host), $10 Premium and $70 Enterprise per host per month, with unlimited users on every plan.
• Enterprise+ ($100) has been retired and its site-to-site, IPsec and multi-cloud link features now sit in the $70 Enterprise plan.
• WireGuard is free on every plan, but there is no official mobile app and SSO requires Enterprise.
• You run everything yourself on Linux plus MongoDB; AlmaLinux, Rocky or RHEL are the supported choices.
• The licence is non-commercial and forbids redistributing modifications, so treat Pritunl as source-available, not open source.
• No third-party audit, SLA, VPN trial or refund policy is published - test on the free tier first.