What Zero Trust VPN or ZTNA solutions have worked well for your organization?
Asked by
MellowPine47
We're trying to improve our company's security posture and are evaluating alternatives to our current open-source OpenVPN setup. At the moment, servers authenticate with certificates, but employees essentially use VPN profiles distributed by DevOps, with no MFA required. That arrangement doesn't feel strong enough, so I'm researching managed OpenVPN offerings and other Zero Trust VPN or ZTNA products. I'd appreciate firsthand experience, recommendations, and practical advice—especially options that provide solid security without being prohibitively expensive for a company that often favors free software.
Answers
FortiGate appliances paired with FortiClient and the vendor’s ZTNA features can work well when you already use that ecosystem. It’s a more enterprise-oriented approach, but OpenVPN also has Zero Trust-related offerings, so compare the identity integration, device posture checks, logging, and licensing before deciding.
Reply to this answer
Cloudflare’s Zero Trust platform is another practical option, particularly for smaller deployments. The entry-level offering covers up to 50 users, and it combines access policies, tunnels, and other security controls. The pricing changes once you go beyond that threshold, so make sure to model the total cost for your expected user count.
Reply to this answer
NetBird is worth a look. It’s built around WireGuard, can be self-hosted, and has a relatively low-cost option if you want to avoid a large licensing bill. It’s flexible enough for different environments without being too difficult to operate.
Reply to this answer
You may not need to replace OpenVPN immediately. It can support MFA through a RADIUS integration, so users can authenticate with something like an identity provider or MFA server in addition to their certificates. That could improve the existing setup while you evaluate longer-term alternatives.
Reply to this answer
If you want a broader managed SASE or ZTNA platform, products such as Twingate, Cato, Perimeter 81, Timus, and Todyl are alternatives to investigate. Todyl in particular combines network access controls with options such as endpoint detection, cloud SIEM, and managed monitoring, although the cost and complexity will be higher than a self-hosted tool.
Reply to this answer
Add your answer
Answers are reviewed before publication.
SilverAcorn6: It also has useful Windows client and policy features, which can make rollout and endpoint configuration easier.