Remote access VPN

A remote access VPN lets people reach a private network from wherever they are. Each user runs a VPN client that opens a tunnel to a VPN server or gateway at the edge of the network, and once connected, the device can reach resources behind the gateway as if it were in the office.

The gateway is the weak point. All traffic detours through it, even when the user and the server they need are close together, and its capacity limits everyone. It has to be reachable from the internet, which makes it a target. And once a device is connected, it can often reach far more of the network than the person needs.

Remote access with Managed Nebula

Managed Nebula has no gateway. People install DNClient Desktop on Mac or Windows, or Mobile Nebula on Android or iOS, and their device connects directly to each server it’s allowed to reach, wherever that server runs.

With endpoint SSO, people join from DNClient Desktop by signing in through your OIDC provider, and their device gets the role you picked for SSO enrollments. Sessions last 16 hours by default. What each device can reach is set by firewall rules on roles and tags, down to specific hosts and ports, rather than the whole network.

Only traffic for the overlay and its routes goes through Nebula. Everything else uses the device’s normal connection (split tunneling), and since hosts connect outbound, the services they protect never face the internet (see Port forwarding).

When someone leaves, block their device in the admin panel. Within 60 seconds, the rest of the network stops trusting it.

For access by identity more broadly, see ZTNA and Zero trust networking.