Modern Alternatives to SSL VPNs. What’s Actually Working Long Term?

That's what we've built Defguard - open source, enterprise grade remote access/VPN solution that implements ZT/ZTNA. It enables organisations to switch from legacy SSL to WireGuard, which is more secure, faster and reliable. Defguard does it by providing identity management (internal and external IdP integrations as well) paired with MFA (on connection-level) and enterprise grade on-prem deployments. Where is does fit your use case only partially: \- on appliance-based VPN but with extra hardening - Defguard fits extra hardening well through unique architecture, Rust as language and total transparency, BUT we do not offer appliance YET! We're working on that at the moment and the plan is to have it next year. Where it fits your needs 100%: \- can be fully on ZTNA or SDP : YES thanks to firewall integration (OPSense, MicroTik, Linux) and Access Control Lists allowing for granular user/group based access control. \- peer-to-peer or identity-based : Once Defguard does it's job the communication is based on WireGuard p2p with identity being verified by MFA each time user connects \- less open ports/inbound exposure : that's exactly how Defguard in engineered, more in [https://docs.defguard.net/about/about-defguard#how-is-defguard-built](https://docs.defguard.net/about/about-defguard#how-is-defguard-built) \- that plays nice with both corporate and BYOD devices : YES - Defguard is hardware/OS (as long as it's Linux) agnostic, so you can run it in whatever environment/equipment you want. Look into deployment strategies [https://docs.defguard.net/deployment-strategies/setting-up-your-instance](https://docs.defguard.net/deployment-strategies/setting-up-your-instance) Hope that helps. For full disclosure I'm co-founder of Defguard. You can get a broader overview of Defguard at [https://defguard.net](https://defguard.net)