Network Design StudioPublic beta

Engineering tools / Remote connectivity

VPN & zero-trust access planner

Choose the right access pattern before choosing a tunnel. A guided, read-only planning tool with reasons, alternatives, security checks and capacity assumptions.

Browser-only · no configuration changesGuided + advanced

Step 1 of 3 · Your goal

What are you trying to access?

Start with the resource, not a vendor or protocol. You can change any answer later.

Protocol comparison explained

Application-level zero-trust access (Application access)

Grant access to a specific supported application rather than exposing a subnet. Per-app policies can reduce unnecessary network reachability. Not every application or non-HTTP protocol is supported; examine connector/data-path requirements.

Read official source ↗
WireGuard (Network tunnel)

Lightweight key-based encrypted network links between approved peers. Small protocol footprint and flexible routing for managed endpoints. Peer enrollment, access policy, audit, MFA and revocation need an additional management design.

Read official source ↗
IKEv2/IPsec (Network tunnel)

Standards-based connectivity common in interoperable network gateways. Broad gateway compatibility, especially for site-to-site. Negotiation, identifiers, certificates, routes and NAT-T require agreement at both ends.

Read official source ↗
OpenVPN (Network tunnel)

Configurable remote-access VPN with many existing client deployments. Flexible client/server authentication and transport configuration. Performance varies by versions, data-channel offload, configuration and hardware.

Read official source ↗
Identity-managed WireGuard overlay (Identity-managed overlay)

Managed peer onboarding with a control plane and policy features. Convenient management and connectivity for distributed approved devices. Check trust in the control plane, device posture, relays, exit-node routing and account ownership.

Read official source ↗

Common questions

Which VPN is always the fastest?

There is no reliable universal winner. Measure CPU, cipher support, path quality, packet size, device acceleration and the same workload on comparable endpoints.

Is zero trust a replacement for all VPNs?

No. It is an authorization architecture. Application-level access may not support some site-to-site or non-HTTP workflows.

Why is L2TP/IPsec not recommended?

It remains relevant for legacy compatibility but introduces more layers and is generally not the preferred starting point for new designs.

Do I still need MFA and firewall policies?

Yes. Encryption alone does not validate identity, device trust or access to specific resources.

Research & limitations

Based on NIST SP 800-207, Netgate VPN selection, WireGuard and OpenVPN vendor documentation. This is a comparison and preflight planner, not a configured VPN, live speed test, security audit or vendor compatibility certification. Never paste keys, IP secrets or user credentials into public planning tools.

NIST 800-207 ↗Netgate VPN choices ↗WireGuard ↗OpenVPN DCO ↗