Two zero-trust takes: connectors that broker access versus a mesh where peers connect directly. The differences compound at scale.
| OpenVLAN | Twingate | |
|---|---|---|
| Architecture | AmneziaWG mesh, peer-to-peer first | Connectors brokering to resources |
| Resource definition | Any IP:port via ACLs | Resources defined per DNS/IP in console |
| Non-HTTP protocols | Any protocol, any port | TCP/UDP, some constraints |
| Device-to-device traffic | First-class (nodes are peers) | Limited — designed user-to-resource |
| Connectors to run | None required (optional subnet routers) | One or more per network/VPC |
| SSH session recording | Built in | Available |
| Infrastructure as code | ACLs + Terraform provider | Terraform provider |
| Free tier | Up to 100 devices, 3 users | Limited users/resources |
You want pure user-to-resource access with per-resource definitions in the console and don't need device-to-device networking.
You also want machines, servers, and homelab/dev boxes to reach each other — identity, not topology, decides the path.
Twingate users who added CI runners, Kubernetes clusters, or site-to-site needs consolidate on OpenVLAN and drop connector fleets.