An Exit Node is where your VPN traffic leaves the private network and accesses the internet. It's how remote users appear to come from a known, consistent IP address (your "office IP").

All plans include one exit node. Additional exit nodes can be added for regional routing, redundancy, or to separate traffic by team or function.

Routes decide which internal networks a user can reach over the VPN—for example a specific subnet containing file servers, a lab network, or a cloud VPC.

• Per-group access to subnets (e.g. Finance vs Engineering)
• Split tunnelling where appropriate
• Clear separation between internal access and internet egress

Policies define what is allowed. Groups keep management simple by applying those policies to a set of users (and optionally devices).

• Role-based access: "Support", "Developers", "Contractors"
• Time-limited or project-limited access
• Auditable change history (who got access to what, and when)

Instead of "VPN gives you the whole network", we can allow only the specific ports needed. For example: SSH to a bastion, RDP to a jump host, or HTTPS to an internal app.

• Reduce blast radius and lateral movement
• Align access with compliance requirements
• Supports safer third-party/contractor access

Posture checks are rules about the device's security state—used to allow, restrict, or block access. Typical checks include: OS version, disk encryption, endpoint protection, and device enrolment.

This is where zero trust becomes practical: a user can be valid, but access can still be limited if the device doesn't meet your baseline.