VPN Access
When you need network-level access, OnePAM includes a WireGuard VPN with policy-driven controls — who connects, to which networks, and for how long.
What You Get
Policy-Driven Network Access
WireGuard-powered VPN with native client support on all platforms
Per-user encrypted tunnels with individual key management
Network access policies — allow or deny connections by user, team, IP, and platform
CIDR-based route restrictions — control which networks peers can reach
Dynamic policy re-evaluation — peer access updated instantly when policies change
Split tunneling with policy enforcement — exit node routing controlled by policy
Per-user peer limits enforced by plan and policy (most restrictive wins)
Custom DNS configuration per tunnel for internal name resolution
CGNAT IP allocation — no conflicts with existing network ranges
Full audit trail — policy denials, peer revocations, and restriction changes logged
Automatic peer expiration with policy-driven session duration limits
One-click config download for WireGuard native clients
VPN Access Architecture
WireGuard Tunnel Flow
Deploy in Under 5 Minutes
Three Steps to Secure Access
1. Sign Up With SSO
Connect your identity provider — Okta, Azure AD, Google Workspace, or any SAML/OIDC provider. Your team logs in with existing credentials.
2. Add Your Resources
Register servers, databases, Kubernetes clusters, and web apps. Define who can access what with role-based policies.
3. Access Securely
Your team accesses resources through the browser — identity-verified, session-recorded, and audit-logged. No VPN, no exposed ports.
Try VPN Access — Free for 14 Days
From signup to your first secure session in under 5 minutes. No infrastructure changes, no credit card, no sales call.