Zero Trust on WireGuard
Every connection is authenticated and authorized over a modern, fast WireGuard VPN tunnel enforced by the sdwan overlay transport module.
- WireGuard/IPsec/OpenVPN tunneling with cluster and client orchestration in the sdwan module.
- No implicit trust based on network location — every request is authenticated and authorized independently.
- Headends register with the core API as clusters carrying a region and datacenter label, authenticated by a per-cluster API key and tracked by heartbeat — so the same overlay spans a public cloud region, your own datacenter, or both, under one central policy.
- Full tunnel is the default for new clients, giving the headend complete visibility to inspect and filter traffic.
- Split tunnel lets selected trusted destinations bypass the VPN, with every route validated (domain, wildcard, IPv4/IPv6, CIDR) before acceptance.