VPNnet
Zero trust networking. On an instance that's yours alone.
VPNnet connects your people, servers, and sites in a private WireGuard mesh with zero trust access controls, built on the open-source NetBird platform. The difference: every company gets its own dedicated instance. A separate company control plane, with access policies for your network. VPNnet is in Alpha; deployment scope is agreed with us.
- laptop · jane@acme connected
- hq-fileserver connected
- plant-2 gateway connected
- contractor · temp access expires in 6 days
- policy: finance → erp only enforced
Every device authenticated. Every connection encrypted. Every rule yours.
Current Alpha / Planned services
Alpha by arrangement
Controlled evaluation now. Instant company provisioning is not yet available.
Home / Hobby, planned
A simple scope without VPNnet-managed backups or daily snapshots. Client settings export/import is planned.
Business options, planned
Backup and controller availability options start at Small Business and are selected separately.
The Problem
The VPN you have. The SaaS you're offered.
A traditional VPN often routes access through one or more gateways. It can be secure and tightly controlled. The right design depends on the traffic paths, identity controls and resources you need.
A shared mesh-VPN service is another option. VPNnet is developing a dedicated-controller offering for organizations that want a separate company control plane and an agreed operating scope.
Zero trust shouldn't stop at your devices. It should include your control plane.
How it works
An agreed Alpha deployment, step by step.
-
1. Discuss your requirements
Tell us what you need to connect, where your users are located, and any hosting-provider constraints.
-
2. Agree the evaluation scope
We agree hosting and setup responsibilities before arranging a dedicated controller. Instant self-service company provisioning is not available.
-
3. Enroll devices and set policy
Laptops, servers, cloud VMs, site gateways. They form an encrypted peer-to-peer mesh, and your access policies decide exactly who reaches what.
-
4. We keep it running
Upgrade, monitoring and support responsibilities are agreed explicitly. Planned backup and availability options are separate choices, not included promises.
Link your networks
Full mesh between sites. No static IPs to rent.
The old way to connect offices meant business-class circuits, a static IP at every site, and tunnels hair-pinned through headquarters. VPNnet retires all three.
A suitable customer-owned device can act as a gateway. It needs installation and configuration for the networks, routes and access policies you intend to use. A VPNnet-provided gateway appliance is planned and is not available. Routing peers initiate outbound connections, but your existing router, firewall and network requirements still need to be checked.
Your controller coordinates permitted peers, which try to connect directly to one another over encrypted WireGuard tunnels. A relay can provide a fallback path. Access that uses a headquarters gateway still depends on that gateway and its network.
Because every connection starts outbound, ordinary internet service is enough: cable, fiber, LTE, satellite, whatever each site happens to have, from any provider. Dynamic IPs are fine, since peers find each other through your instance, not at a fixed address. No static IPs to lease, and no business-class circuit requirement.
The honest fine print: on the rare connection where NAT is too hostile for a direct path (some carrier-grade NATs), traffic falls back to an encrypted relay. Still end-to-end encrypted, still policy-controlled. We just don't pretend otherwise.
What you get
The networking foundation.
WireGuard mesh
Encrypted peer-to-peer paths where the network permits them, with encrypted relay fallback when a direct path is unavailable.
Zero trust access
Identity-based policies per user, group, and resource. Access to what's allowed, nothing else.
Dedicated instance
Your own control plane, not a shared tenant. Isolation by architecture, not by promise.
Open-source foundation
Built on NetBird and open protocols. Migration is subject to validation of the target deployment, supported settings and secure key handling; uninterrupted migration is not guaranteed.
Managed for you
An agreed operating and support scope during Alpha. Future backup, availability and recovery services are planned options.
Works everywhere
Supported NetBird clients and suitable customer-owned routing devices. A custom VPNnet appliance is planned, not available.
Why dedicated
Multi-tenant is their architecture. Not yours.
A dedicated controller separates your company’s management state and administration from other companies. The underlying hosting provider and infrastructure can still be shared dependencies. A dedicated virtual instance does not imply dedicated physical hardware.
It also means real answers to the questions your auditors and customers ask: where the data lives, who can touch it, and what happens when you want to leave.
Be first on the list.
VPNnet is in controlled Alpha testing. Tell us about your network and we will discuss evaluation fit, availability and responsibilities.