Our business is trying to improve its security posture. We currently run open-source OpenVPN, where servers authenticate with certificates, but users authenticate only through an OpenVPN profile provided by DevOps. There is no MFA, which is a concern. I'm researching OpenVPN's enterprise and cloud offerings as well as alternative Zero Trust or ZTNA products. I'd appreciate feedback on solutions that are secure, manageable, and reasonably cost-effective, especially for a company where licensing costs are closely scrutinized.
5 Answers
Fortinet is another route if you already use or are willing to deploy FortiGate appliances. FortiClient and its ZTNA stack work together as a commercial solution. OpenVPN also has Zero Trust-oriented offerings, so it may be worth comparing those against the cost and operational effort of switching vendors.
Cloudflare’s Zero Trust platform is another popular option. It can be free for smaller deployments, reportedly up to 50 users, with per-user pricing once you exceed that threshold. It includes application access and tunnel capabilities, and some users find its Windows client and management features especially convenient.
NetBird is worth looking at if you want something low-cost and self-hostable. It is built around WireGuard, supports a range of environments, and is relatively straightforward to configure while still offering a more modern access model than distributing static VPN profiles.
If you prefer a commercial, integrated security stack, options include Twingate, Cato, Perimeter 81, Timus, and Todyl. Todyl in particular combines ZTNA and SASE features with controls for both north-south and east-west traffic, plus optional endpoint detection, cloud SIEM, and managed response services.
You may not need to replace OpenVPN immediately. It can integrate with a RADIUS provider, which allows you to add MFA while keeping much of your existing setup. That could be a practical first step before evaluating a larger platform.
Agreed. The Windows-side configuration and tuning are particularly useful if most of the workforce uses Windows machines.