Private networking for modern infra.
Secure site-to-site and client VPN across WireGuard, OpenVPN, and IPSec — plus L2TP, SSTP, and more. Connect your infrastructure privately across regions, clouds, and on-premise networks with zero-config mesh, zero-trust access, and sub-5ms overhead.
Every major protocol — and the networks & identity providers you already run
Not just WireGuard
Any protocol, any client — from one control plane
We run managed WireGuard, OpenVPN, and IPSec servers — and bridge the long tail of legacy and restricted-network protocols so every device can connect, no matter how old or locked-down.
WireGuard
Modern, lean, kernel-mode tunnels with 0-RTT roaming and the lowest overhead — our default for mesh and device access.
OpenVPN
Battle-tested client/server access over UDP or TCP/443. Managed OpenVPN servers for road-warrior users and restrictive networks.
IPSec / IKEv2
Standards-based tunnels to existing firewalls and appliances — Cisco, Fortinet, pfSense, strongSwan, and cloud VPN gateways.
L2TP / IPSec
Built-in client support on older Windows, macOS, and mobile fleets — connect with no extra software to install.
OpenConnect
SSL VPN compatible with Cisco AnyConnect clients — TLS-based access that traverses strict corporate firewalls.
SoftEther
Multi-protocol server that bridges and tunnels over HTTPS where everything else is blocked.
SSTP
TCP/443 SSL tunnel that sails through corporate proxies — first-class on Windows endpoints.
Headscale mesh
Self-hosted control plane for WireGuard mesh, compatible with Tailscale clients — no vendor lock-in.
…and more. Need a protocol or appliance we have not listed? Ask us — we almost certainly support it.
Choose how you run it
Flexible deployment options
Pick where the control plane lives and how much of the operations you want us to own. Switch later as your network grows.
Cloud-managed mesh
Multi-tenant, auto-peering, zero-config
- Spin up a mesh in under five minutes from the dashboard
- Global control plane in US/EU/APAC with regional anchors near your nodes
- Per-user, per-device, and per-service policies enforced at the edge
- SSO via Okta, Azure AD, Google, JumpCloud — no shared keys to rotate
Self-hosted gateway
Single-tenant control plane in your VPC
- Helm chart deploys the controller into your existing Kubernetes cluster
- Connects to your IdP, SIEM, and PKI without leaving your network boundary
- BYO keys: Vault Transit, AWS KMS, or HSM-backed root certificates
- Air-gapped install option for SCIF and classified environments
Hybrid hub-and-spoke
Your data center plus our managed edge
- On-prem hub keeps regulated traffic local; spoke nodes use the managed mesh
- Predictable egress: hairpin sensitive flows through your DC firewall
- Inherits compliance posture of your existing data-center controls
- Useful for FSI, healthcare, and government workloads in transition
Concierge networking
Hands-on rollout for distributed orgs
- Network architect designs the topology, IP plan, and policy hierarchy
- White-glove migration from legacy IPSec, OpenVPN, or MPLS circuits
- Custom integrations: ServiceNow tickets, NetBox sync, Splunk dashboards
- Quarterly resilience drills with documented failover evidence
Built for production
Enterprise-grade networking with zero complexity
Multi-protocol engine
WireGuard, OpenVPN, IPSec/IKEv2, L2TP, SSTP and more from one control plane. WireGuard by default for raw speed; OpenVPN and IPSec for compatibility and legacy gear.
Mesh Networking
Create point-to-point or full mesh topologies between any combination of cloud regions, data centers, and on-premise networks. Every node can communicate directly.
Multi-Region Peering
Privately connect VPCs across AWS, GCP, Azure, and other providers without exposing traffic to the public internet. Encrypted tunnels with sub-5ms overhead.
Zero Trust Access
Authenticate every connection with identity-aware policies. Integrate with your SSO provider (Okta, Azure AD, Google) for role-based network access control.
Traffic Visibility
Real-time flow logs, bandwidth monitoring, and connection analytics. See who is connecting, from where, and how much data is flowing through every tunnel.
Always-On Connectivity
Automatic reconnection, keepalive probes, and failover routing keep your tunnels up. Built-in health checks detect and reroute around failures in seconds.
Up and running fast
Set up in three steps
Create a VPN network
Define your network CIDR, choose the topology (hub-spoke or mesh), and select which regions to peer.
Add peers & servers
Add WireGuard peers, OpenVPN servers, or IPSec site-to-site tunnels. Each gets a secure config file or QR code.
Connect & route
Tunnels establish automatically. Define routing rules to control which traffic flows over the VPN and which stays local.
One CLI · every protocol
Deploy WireGuard, OpenVPN, or IPSec — then watch it live
vxcli vpn is the source of truth. Create a network, add a WireGuard mesh peer, stand up an OpenVPN server, or wire an IPSec site-to-site tunnel — the CLI generates the server and client configs for you, then streams every tunnel's health.
- Generate wg-quick, .ovpn, or IKEv2 configs — file or QR
- SSO, mTLS, certificates, or PSK auth per server
- Secrets sealed in Vault — keys are never printed
- vxcli vpn monitor --watch streams RTT, throughput & failovers
1# One CLI, every protocol. vxcli generates the server + client configs for you.2 3# 1) Create a private network (pick a CIDR + topology)4vxcli vpn network create --name prod-mesh --cidr 10.80.0.0/16 --topology mesh5 6# 2) WireGuard mesh peer — fastest path, automatic key exchange7vxcli vpn peer add prod-mesh --name aws-use1 \8 --protocol wireguard --route 10.80.1.0/249 10# 3) Stand up an OpenVPN server for client / road-warrior access11vxcli vpn server deploy --name road-warrior \12 --protocol openvpn --port 1194/udp \13 --auth sso:okta --push-route 10.80.0.0/1614 15# 4) IPSec / IKEv2 site-to-site to a legacy firewall16vxcli vpn tunnel add --name dc-nyc \17 --protocol ipsec-ikev2 --peer 203.0.113.10 \18 --local 10.80.0.0/16 --remote 192.168.10.0/24 --psk @vault:dc-nyc19 20# 5) Hand a client its config — file or QR, any protocol21vxcli vpn client config aws-use1 --format wg-quick22vxcli vpn client config road-warrior --format ovpn --qr23 24# 6) Watch every tunnel live25vxcli vpn monitor prod-mesh --watchSpin up a VPN from a sentence
vxcli vpn new "site-to-site from the London office to AWS eu-west-2" — picks the protocol, generates the server and client configs, and opens the tunnel.
Measured on real traffic
Fast tunnels, fast recovery
WireGuard's lean design means tunnels add almost nothing to your latency budget and recover from network drops before most apps notice — with OpenVPN and IPSec held to the same SLOs.
Where teams get stuck
Common networking challenges — solved
Challenge
Legacy IPSec and OpenVPN setups break under packet loss, drop mobile sessions, and need painful manual reconnects.
How VxCloud VPN solves it
WireGuard kernel-mode tunnels reconnect in under one second after network interruptions, survive NAT changes, and roam cleanly between Wi-Fi and cellular — while we keep your OpenVPN and IPSec endpoints for compatibility.
Challenge
Bastion hosts and shared SSH keys grant flat, hard-to-revoke access and leave audit gaps for compliance teams.
How VxCloud VPN solves it
Identity-aware tunnels tie every connection to a person and device. Revoking access takes one click; every flow is logged with user, device, and policy attribution.
Challenge
Multi-cloud teams pay for VPC peering, transit gateways, and cross-region egress that still leaves traffic on the public internet.
How VxCloud VPN solves it
Encrypted overlay routes traffic privately between AWS, Azure, GCP, Linode, and on-prem with sub-5ms overhead. One bill, one policy, one observability surface.
Challenge
Network changes require a ticket-and-wait dance with the platform team, slowing every product launch.
How VxCloud VPN solves it
Self-service network policies via API and UI with guardrails: developers request access; policy engine auto-approves low-risk patterns and routes the rest for review.
Where it earns its keep
From connecting offices to multi-cloud architectures
Site-to-Site VPN
Connect your office networks to cloud infrastructure with permanent, encrypted tunnels. Replace expensive MPLS circuits with software-defined networking over the internet.
Remote Team Access
Give developers and operators secure access to private infrastructure from any device. No need to expose services to the public internet or manage SSH bastion hosts.
Multi-Cloud Networking
Unify networking across AWS, GCP, Azure, and on-premise environments. Services in different clouds communicate as if they were on the same local network.
Compliance & Data Isolation
Meet regulatory requirements by ensuring sensitive data never traverses the public internet. Create isolated network segments for PCI, HIPAA, and SOC 2 workloads.
Industrial & Edge Sites
Reach factory-floor controllers, retail POS, and oil-rig sensors over flaky links. Tunnels survive packet loss and reconnect automatically when connectivity returns.
Database & Internal API Access
Reach private RDS, Postgres, Redis, and internal admin panels without IP allowlists or exposed bastions. Identity-aware policies replace shared SSH keys.
Technical specifications
Security first
Talk to the networking team
Map your network and get a tailored topology
Send us a sketch of your sites, clouds, and regulated workloads. Our network architects respond within one business day with a recommended topology, protocol choice, IP plan, and migration path.
- Architecture review covering sites, clouds, IdP, and compliance scope
- Protocol recommendation — WireGuard, OpenVPN, IPSec, or a mix
- Migration plan from IPSec, OpenVPN, or MPLS — zero downtime
- Compliance evidence packet (SOC 2, ISO 27001, PCI DSS, HIPAA BAA)
Secure your network today.
Start free — no traffic limits on the starter plan. WireGuard, OpenVPN, and IPSec included; upgrade for mesh networking and multi-cloud peering when you are ready.