ZTNA (zero trust network access)
Zero trust network access (ZTNA) gives people and devices access to specific resources based on who they are, instead of handing them the whole network once they connect. It’s the access side of zero trust networking, and it’s usually pitched as a replacement for the remote access VPN.
Most products sold as ZTNA broker access to individual applications through a proxy or connector, and many check device posture as well. Managed Nebula gets to the same place differently: it connects hosts directly and controls access per host and port.
Zero trust access in Managed Nebula
Section titled “Zero trust access in Managed Nebula”Every host proves who it is with a certificate during the handshake. Being on the office network or in the same VPC counts for nothing on its own.
Access starts closed. A new role allows only ICMP, and reaching anything else takes a firewall rule that names the roles or tags allowed to connect and the ports they can use. People enroll their devices by signing in through your OIDC provider with endpoint SSO, and each device gets the role you chose.
Hosts only make outbound connections and get through NAT with NAT traversal, so the services they protect never face the internet (see Port forwarding). Blocking a host cuts it off from every other host within 60 seconds.
How it compares to ZTNA products
Section titled “How it compares to ZTNA products”| Typical ZTNA product | Managed Nebula | |
|---|---|---|
| Unit of access | An application, through a proxy or connector | A host and port, over a direct tunnel |
| Traffic path | Through the vendor’s proxy or connector | Directly between hosts, or through a relay you or Defined Networking run |
| Protocols | Often web apps first, other protocols through a connector | Any TCP, UDP, or ICMP traffic |
| Device posture | Often built in | Not checked; pair with an endpoint management tool |
For comparisons with specific products, see Managed Nebula vs Twingate and Managed Nebula vs Cloudflare Tunnel.