We're trying to improve our company's security posture and are evaluating alternatives to our current open-source OpenVPN setup. At the moment, servers authenticate with certificates, but employees essentially use VPN profiles distributed by DevOps, with no MFA required. That arrangement doesn't feel strong enough, so I'm researching managed OpenVPN offerings and other Zero Trust VPN or ZTNA products. I'd appreciate firsthand experience, recommendations, and practical advice—especially options that provide solid security without being prohibitively expensive for a company that often favors free software.
5 Answers
If you want a broader managed SASE or ZTNA platform, products such as Twingate, Cato, Perimeter 81, Timus, and Todyl are alternatives to investigate. Todyl in particular combines network access controls with options such as endpoint detection, cloud SIEM, and managed monitoring, although the cost and complexity will be higher than a self-hosted tool.
You may not need to replace OpenVPN immediately. It can support MFA through a RADIUS integration, so users can authenticate with something like an identity provider or MFA server in addition to their certificates. That could improve the existing setup while you evaluate longer-term alternatives.
NetBird is worth a look. It’s built around WireGuard, can be self-hosted, and has a relatively low-cost option if you want to avoid a large licensing bill. It’s flexible enough for different environments without being too difficult to operate.
Cloudflare’s Zero Trust platform is another practical option, particularly for smaller deployments. The entry-level offering covers up to 50 users, and it combines access policies, tunnels, and other security controls. The pricing changes once you go beyond that threshold, so make sure to model the total cost for your expected user count.
FortiGate appliances paired with FortiClient and the vendor’s ZTNA features can work well when you already use that ecosystem. It’s a more enterprise-oriented approach, but OpenVPN also has Zero Trust-related offerings, so compare the identity integration, device posture checks, logging, and licensing before deciding.
It also has useful Windows client and policy features, which can make rollout and endpoint configuration easier.