Zero Trust on WireGuard
Every connection is authenticated and authorized over a modern, fast WireGuard VPN tunnel enforced by the sdwan overlay transport module.
- WireGuard/IPsec/OpenVPN tunneling with cluster and client orchestration in the sdwan module.
- No implicit trust based on network location — every request is authenticated and authorized independently.
- Full tunnel is the default for new clients, giving the headend complete visibility to inspect and filter traffic.
- Split tunnel lets selected trusted destinations bypass the VPN, with every route validated (domain, wildcard, IPv4/IPv6, CIDR) before acceptance.