Outcome · Private Access
A stolen laptop reaches two subnets, not the whole network.
A legacy VPN puts a device on the network and trusts it from then on. Fowlguard works out what a person's groups allow at the moment they connect, and opens only that.
| Group | Can Reach | Action |
|---|---|---|
| Engineering | 10.20.0.0/16 | Allow |
| Finance | ledger.internal | Allow |
| Contractors | git.internal | Approve |
| Everyone Else | anything | Deny |
What changes on day one.
With a legacy VPN
- A device joins the network and is trusted from then on
- Every request detours through a gateway
- Access is a firewall change somebody has to remember to undo
- Nobody can say who reached that server in March
With Fowlguard
- Each group reaches only the systems it is granted, and nothing else
- Peer-to-peer paths, with a relay only where the network refuses
- Access can be granted for a stated time and expire on its own
- Every connection and every block is in the access log
Access decided per person, every time they connect.
Grant systems to groups, not networks to devices.
A person or group is granted a system and reaches nothing else. A system with Router switched on advertises the addresses, subnets and names behind it.
- What a group may reach is decided when the person connects
- A tampered client cannot widen its own access
- Devices are recognised across reconnects, so each machine counts once
| Group | Can Reach | Action |
|---|---|---|
| Engineering | 10.20.0.0/16 | Allow |
| Finance | ledger.internal | Allow |
| Contractors | git.internal | Approve |
| Everyone Else | anything | Deny |
Check the machine before it connects.
Devices report disk encryption, antivirus and whether they are managed. Each shows as Compliant, Failing or Not Reported, and the row says which check failed.
- Run posture in Report first, then enforce
- Fix the machine, let it check in, and the row clears
| Device | Owner | Failing Check | State |
|---|---|---|---|
| HP-FIN-014 | Maria Okafor | — | Compliant |
| MBP-ENG-022 | Lena Park | Disk encryption off | Failing |
| LNX-OPS-003 | Sam Reyes | — | Not Reported |
Know who reached what.
Every connection and every block is filterable by user, device and host, so an audit question is a search, not a project.
| Time | Person | Device | Host | Result |
|---|---|---|---|---|
| 14:02 | Maria Okafor | HP-FIN-014 | ledger.internal | Allow |
| 13:58 | Sam Reyes | LNX-CON-011 | db-prod | Deny |
| 13:51 | Lena Park | MBP-ENG-022 | git.internal | Deny |
Off the VPN in three steps.
Run both side by side while people move over.
Connect your identity
Sign up, verify your domain and connect Google, Microsoft or your own SSO. SCIM brings in your groups.
identity.fowlguard.comPublish your systems
Install the server agent on a machine inside each network and switch Router on to advertise its subnets.
servers are never chargedGrant groups, then switch over
Write access by group, install Fowlguard Connect on laptops and retire VPN profiles one team at a time.
Windows · macOS · Linux
Can we run it alongside our current VPN?
Yes. Fowlguard only routes the systems you grant, so a team can move over while everyone else stays on the VPN.
What happens when the network blocks a direct path?
Connections go peer-to-peer where the network allows and fall back to a relay where it refuses. A hostile network slows you down; it does not shut you out.
How is it priced?
Per user, per month. Private Access Personal is free for up to 10 users, and servers behind the tunnel are never charged.