Private Access · ZTNA
Reach your own systems, and only those.
A VPN puts a device on the network and trusts it from then on. Fowlguard grants each person the systems their groups allow, at the moment they connect, so a compromised laptop reaches two subnets, not the whole network.
| Group | Can Reach | Action |
|---|---|---|
ENEngineering | 10.20.0.0/16 | Allow |
FIFinance | ledger.internal | Allow |
COContractors | git.internal | Approve |
Access that follows the person.
Granted explicitly, checked on every connection, and removed when it is no longer needed.
Direct paths
The shortest route the network allows, with a relayed one where it refuses. A hostile network slows you down; it does not shut you out.
The device can't widen its access
What a device may reach is decided from your policy. A tampered client cannot grant itself more.
One machine, one entry
Devices are recognised across reconnects, so the fleet list stays a fleet list.
Routers for whole networks
Turn on Router for a system and it becomes a way through to the addresses, subnets and names behind it.
Access that expires
Grant access for a stated time. The grant is removed when the clock runs out.
Groups from your directory
Grant by group, and SCIM keeps membership in step with your identity provider.
Nothing is reachable until you say so.
A person or group is granted a system and reaches nothing else. Where two Routers advertise the same subnet, clients use whichever answers fastest.
- Grant a single host, a subnet or a name
- Scope by group or by person
- Device posture checked before access
| System | Type | Advertises |
|---|---|---|
| build-01 | Host | — |
| office-gw | Router | 10.20.0.0/16 |
| ledger.internal | Name | — |
Standing access is the thing you are trying to fix.
Most breaches start with a key somebody was given for one afternoon and nobody took back. A request says how long; the approver sets the duration; the clock closes it.
- The approval writes the grant
- Nobody edits the rulebase by hand
- A record of who asked and who approved
- Who
- Sam Reyes · Contractors
- Wants
- git.internal
- For
- 4 hours
- Reason
- Release branch review
Private Access works with the rest.
Free for up to 10 users on Personal. Small is $5 and Medium $10 per user per month. Servers behind the tunnel are never charged.
Asked often.
How is this different from a VPN?
A VPN admits a device to the network. Private Access admits a person to named systems, decided when they connect, and nothing else is reachable.
What happens on a network that blocks peer-to-peer?
The connection falls back to a relay. It may be slower, but it still works.
Do I pay for servers?
No. Servers behind the tunnel are never charged. Each tier includes a number of servers, and extras are $1 per month.
Can access expire on its own?
Yes. Just-in-time grants carry a duration and are removed when it runs out. Just-in-time access is on the Medium plan.