the END of VPNs?!

About this video

The creator argues that a traditional VPN gives anyone who connects far too much access to an entire network, and demonstrates Twingate as a zero-trust replacement he used to give his editors access only to specific machines and ports while travelling. Twingate has four parts — client, connector, controller and relay — but setup only touches two: creating an account on the cloud controller, and deploying a Docker connector inside the target network. He says deployment took about five minutes, needs no firewall changes or port forwarding, works through CGNAT, and is free for up to five users, with a 14-day business trial that falls back to a free starter plan. Resources are deny-by-default: he adds his NAS by private IP and restricts it to TCP port 5000 only, blocking UDP and ICMP, then shows that adding port 22 instantly enables SSH and nothing else is reachable. The explainer section covers how the connector and client each authenticate to a relay with tokens, how the relay performs NAT traversal (acting as a STUN server) by exchanging public IP and NAT port information so the two can form a direct, end-to-end TLS tunnel with pinned certificates, and that the connector effectively acts as a secure proxy. He credits the QUIC protocol, built on UDP, for one-round-trip connections, multiplexing and connections that survive a move from Wi-Fi to 5G, and notes split tunnelling is on by default so only resource traffic crosses Twingate. Later sections cover device-security policies (blocking an OS, requiring screen lock, biometrics, disk encryption or third-party endpoint tools), MFA policies, DNS-based resources resolved through the connector, invented aliases for services such as Plex, wildcard resources, and headless clients for servers and automation.

Key takeaways

• Zero-trust access grants per-resource, per-port permissions instead of the all-or-nothing network access a VPN tunnel provides
• Twingate setup is a cloud controller account plus one Docker connector inside the network, with no port forwarding or firewall configuration required
• Relays solve NAT traversal by introducing client and connector, after which traffic flows over a direct TLS tunnel and the relay is out of the path
• QUIC and default split tunnelling make connections faster to establish, resilient to network changes, and limited to only the traffic destined for defined resources
• Device posture, MFA, groups, DNS resources, aliases and headless service clients extend the same model from laptops and phones to servers and automation

Episode details: published April 28, 2023 · 28:49 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: stop giving your passwords to hackers · Next: CPU, GPU…..DPU? →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube