Compare
Four ways to build a private network.
We compare shapes rather than logos. Every team solving this is really choosing between a concentrator, a cloud proxy, a mesh they run themselves, and a managed mesh — and the trade-offs belong to the shape, not to whose name is on it.
The shapes
What each one is good at.
Including ours, and including the parts that are not flattering. A comparison that only lists the other approaches’ weaknesses is an advertisement, not a comparison.
VPN concentrator
An appliance or cloud VM terminates every tunnel. Clients dial it; it routes them onward into the network behind it.
- Pick it when
- Well understood, and it puts one box in the path where you can inspect, shape, and log everything. If a compliance regime demands a single inspection point, this is the shape that gives you one.
- What it costs you
- Every packet detours through one place, so latency is governed by distance to the concentrator rather than distance to the peer. It is a scaling bottleneck, a patching obligation, and a single failure domain. Access is granted by network position — once you are on, the concentrator largely decides reachability by subnet, not by who you are.
Cloud access proxy
A vendor-hosted broker sits between users and applications. Connectors dial out from your network; users reach apps through the vendor edge.
- Pick it when
- No inbound ports, identity-aware from day one, and genuinely quick to deploy for HTTP applications. Strong fit when the thing you are publishing is a web app and the audience is browser-based.
- What it costs you
- Traffic transits infrastructure the vendor operates and, for TLS-terminating deployments, can decrypt. Non-HTTP protocols are often second-class. You are buying a permanent dependency in the data path, and the pricing usually follows the traffic.
Self-hosted mesh
You assemble peer-to-peer tunnelling yourself and run the coordination, key distribution, and NAT traversal in-house.
- Pick it when
- Maximum control and no third party anywhere. Nothing about your topology is anyone else’s business, and the running cost is servers rather than seats. For a small, stable, expert-run estate this is a legitimate answer.
- What it costs you
- The hard parts are the ones you inherit: NAT traversal against symmetric NATs, relay fallback, key rotation, membership reconciliation, and an audit trail somebody will eventually ask for. These are not weekend problems, and they surface as outages rather than as tickets.
Peerlify
A managed control plane coordinates membership and policy; the data plane stays peer-to-peer and end-to-end encrypted, with a relay only as fallback.
- Pick it when
- Traffic takes the shortest path that works and is encrypted end to end regardless, so the relay is a route rather than a trust boundary. Access is decided by identity from your OIDC provider, not by network position, and every decision is auditable.
- What it costs you
- You depend on a control plane we operate for membership and policy. Every machine you want to reach needs the client installed on it today. And the mesh model assumes you can install software on endpoints — where you cannot, it is the wrong tool.
Side by side
The structural differences.
Properties that follow from the architecture, so they hold no matter which product implements the shape.
| Dimension | VPN concentrator | Cloud access proxy | Self-hosted mesh | Peerlify |
|---|---|---|---|---|
| Traffic pathWhere the packets actually go | Hub and spoke, always | Through the vendor edge | Peer to peer | Peer to peer, relay fallback |
| Who can read the payload | The concentrator, by design | The vendor, where TLS terminates | Only the endpoints | Only the endpoints |
| Inbound ports on targets | One public endpoint to defend | None | Depends what you built | None |
| Access modelWhat a grant is actually written against | Network position and subnets | Identity, per application | Keys and hand-kept config | Identity, tags, and roles |
| Non-HTTP protocols | First class | Often second class | First class | First class |
| Scaling bottleneck | The appliance itself | Vendor edge, priced per traffic | Your coordination service | None in the data path |
| If the control plane is down | All connectivity stops | All connectivity stops | Depends what you built | Established sessions continue |
| Offboarding a person | Directory plus device cleanup | Remove in the IdP | Rotate and redistribute keys | Remove in the IdP |
| Operational burden | Patch, size, and fail over the box | Low; it is someone else’s | You own every hard part | Client rollout and policy |
| Who runs the control planeThe honest column for us | You do | The vendor | You do | We do |
Green marks a structural advantage, amber a real trade-off, grey a structural cost. The “who runs the control plane” row is the one where we are not the best answer — if that matters more than everything above it, a self-hosted mesh is your shape.
Don’t buy this
When Peerlify is the wrong tool.
Four situations where we would tell you to use something else. Finding out in month three is worse for both of us.
You cannot install software on the endpoint
Unmanaged contractor laptops, customer browsers, an appliance you do not control. A mesh needs a client on the machine. A browser-based proxy is the right shape for that audience.
You are publishing one web app to the public
If the audience is "anyone with a login" and the protocol is HTTPS, a reverse proxy with an identity gateway is simpler and cheaper than enrolling devices.
A regulator requires one inspection point
End-to-end encryption between peers is the feature, which means there is no midpoint that can lawfully intercept. If your controls depend on inspecting decrypted traffic centrally, a concentrator is doing something we deliberately do not.
You need to reach whole subnets without enrolling hosts
Subnet routers are on the roadmap and not in the current client. Until they ship, every machine you want to reach needs the client on it. If that is a blocker today, it is a blocker.
Still the right shape?
The free plan is a real network, not a demo. Enrol two machines and see which path they negotiate.