Zero Networks Connect: remote access without exposed ports

What Zero Networks Connect is

Internet-facing VPN gateways are among the most attacked systems any organisation runs. They have to listen for connections from anywhere, so a vulnerability in one is reachable by anyone who finds it, and once a user is connected a traditional VPN often gives far broader access than the job needs.

Zero Networks' core product is automated, agentless microsegmentation (see Zero Networks on our cloud security site). Connect applies the same thinking to remote access. Zero Networks describes it as combining the speed of a VPN with the security of ZTNA, and the design has four parts:

• Closed and invisible: the remote access service has no open ports on the internet, so it does not show up in port scans
• MFA first: no connection is granted until the user has passed multi-factor authentication
• User-specific, time-limited: once the user is validated, a port opens that only that user's IP address can use, for a specified time, and it stays invisible to everyone else
• Limited access: policies allow each user or role access to all applications or only to a pre-approved list

Connect is for employees and third parties alike, so suppliers and contractors can be brought under the same MFA and segmentation rules instead of being handed a VPN account.

How Connect differs from cloud ZTNA

Most ZTNA services send user traffic through the vendor's cloud, where a broker decides what the user can reach. Zero Networks takes a deliberately different route, and it is worth understanding the trade-offs before you choose:

Zero Networks says the direct tunnel avoids the cost and latency of routing traffic through a ZTNA vendor's cloud and keeps user IPs visible. The flip side is that Connect does not try to be a secure web gateway, so if you also want web and SaaS protection for remote users, look at ZTNA vs SASE and the SASE providers we supply.

Connect and segmentation: one policy

The real distinction of Connect is what it is attached to. Remote users connect into a network that Zero Networks already segments:

• Network Segmentation learns how devices really communicate, builds least-privilege rules and enforces them through the host firewalls already on your machines, with network-layer just-in-time MFA in front of admin ports such as RDP, SSH and WinRM
• Identity Segmentation restricts admin and service accounts to the machines and logon types they need

So a remote user who connects through Connect is not simply "on the network"; they are subject to the same rules as someone at a desk. That addresses two of the NCSC's ZTNA design requirements directly: minimise exposure of applications (nothing listening on the internet) and limit the impact of compromise (no free lateral movement once connected). It also avoids the NCSC anti-pattern of keeping a legacy access route that bypasses the policy engine, provided the old VPN is switched off afterwards.

For the background on segmentation itself, read network segmentation vs microsegmentation. For remote desktop specifically, compare the options on secure remote desktop access.

Moving from VPN to Zero Networks Connect

1. Inventory: list who uses remote access today, including suppliers, and what each group actually connects to.
2. Identity and MFA: confirm how MFA will be delivered through your identity provider, so users sign in the way they already do.
3. Policy: define application access by role, with tighter policies for third parties, and decide whether segmentation should be in place first.
4. Pilot: install the lightweight client for a small group and test the applications they rely on.
5. Migrate in waves: move teams across, then suppliers, adjusting policy as you go.
6. Close the door: retire the old VPN and close its internet-facing ports so it cannot be used to bypass the new controls.

We check supported client platforms and deployment components against Zero Networks' current documentation during scoping, rather than assuming. For a vendor-neutral version of this plan, see VPN replacement and how to implement zero trust network access.

Third-party and supplier access

Supplier access is where a traditional VPN is weakest. An IT support company, a software vendor or a maintenance contractor is usually given a VPN account that lands them on the network, and it is rarely reviewed once the job is done. Zero Networks positions Connect specifically for limiting and protecting third-party access:

• MFA on every connection, so a supplier's leaked password is not enough on its own
• Custom policies per role, so a supplier sees only the systems they support, not the whole network
• Visibility, because user IP addresses are preserved and connections can be audited, so you know which third party accessed what and when
• Segmentation behind the connection, so even an approved supplier cannot move sideways from the system they support

This lines up with the NCSC's advice to use multiple signals and enforce policy before granting access, and it gives you something concrete to show an auditor or insurer who asks how supplier access is controlled. If your suppliers mostly need browser-based access to a web application, agentless ZTNA is worth comparing too.

Who Connect suits

Zero Networks Connect is a strong candidate when:

• An exposed VPN appliance is the worry, whether because of patching pressure or a cyber insurer's questions about remote access
• Suppliers and contractors need access, and you want MFA and tight application limits on every connection
• You already use, or plan, Zero Networks segmentation, so remote users fall under the same least-privilege rules
• You need user IP addresses preserved for firewall rules, logging or detection tools
• Performance matters and you would rather not route internal traffic through a third-party cloud

It is a weaker fit if the main goal is web filtering and SaaS control for remote staff, where an SSE platform does more, or if your people only reach a desktop, where an RDP broker such as TruGrid SecureRDP can be simpler. See all options on ZTNA providers.

Licensing and how we help

Connect is licensed per Connect licence, sized to the people who need remote access, including any third parties, and billed monthly. It can be bought on its own or alongside Network Segmentation and Identity Segmentation. Prices depend on the mix, so ask us for a quote; the detail is on Zero Networks Connect licensing.

Forever Systems can scope the change from your current VPN, set up Connect and its policies, migrate users in waves and help you decommission the old gateway. If segmentation is part of the plan, we can review Zero Networks' proposed rules with you before anything is enforced. Scope and timescales are confirmed at quote. Contact us to talk about your remote access.