Private WireShark VPN

Available now, built into your workspace

This is not an application you install from the catalogue. It is a platform feature every Node workspace includes: open the Private network tab in your portal, press the button, and your network exists. Add your first device from the same screen and you are connected before the kettle boils. Billing starts only when devices connect and move traffic, so switching it on to look around costs you the base fee and nothing else.

Your apps are already at the other end

Every other managed VPN asks you to install and maintain a connector next to whatever you want to reach: a daemon on a server you have to patch, monitor and keep alive. If your apps run on Node, there is nothing to install: we run both ends. Your Nextcloud, your Home Assistant, your Mosquitto broker get private addresses inside your own range, and you decide which devices can reach which ports.

That control is a self-service Layer 4 allow-list in your portal: pick an app, tick the ports, done. Elsewhere in this market, per-service access rules are usually a paid-tier feature.

Join whole networks, not just devices

A peer does not have to be a laptop. Put the WireGuard client on a capable router or firewall (MikroTik, OPNsense, pfSense, UniFi and OpenWrt all ship it) and the whole site behind it can join: the office, the workshop, the warehouse, a home lab. One peer, one config file, and the site is on your private range.

Traffic is controlled in both directions. Devices on the site reach the apps and ports you have allowed, and, where you switch it on, your hosted apps can reach back into the site's subnet: the ERP that polls a warehouse label printer, the monitoring stack that scrapes a rack of sensors, the document system that pulls from an office scanner. Nothing reaches anything until a rule you created says so.

Layer 4 rules by default, Layer 3 routing when you need it

The network starts closed. Every path across it exists because you created a rule, and the rules live in your portal, not in a ticket queue:

• Layer 4 allow-lists (the default). Pick an app or a device, tick the TCP or UDP ports, save. The rule resolves to a stable private address your devices can dial, and it names exactly one destination and port set; there is no "allow all" shortcut to regret later.
• Layer 3 routes (opt-in). When a whole subnet should be reachable, a route makes it so: a site's address range published to your network, or your network published to a site. L3 stays off until you turn it on, per subnet, because a routed network is a bigger surface than a port allow-list and we would rather you choose it than inherit it.
• Changes apply in about a minute, are enforced at our concentrator rather than trusted to client configuration, and every rule you add, change or delete is recorded in your audit log.

If you never touch Layer 3, you have a tightly scoped per-port network. If you need site-to-site plumbing, it is one switch away, and it is still deny-by-default underneath.

One price, every device

Most business VPNs charge per user, so the contractor's laptop, the shared workshop PC and the office NAS each add to the bill; roughly 80% of this market bills per seat. We charge per network, not per seat.

What	Rate
Network base	£5 per month
Connected device time	£0.001 per device, per hour connected
Traffic	£0.01 per GB moved

All figures come from our published rate card, ex VAT, on the same monthly invoice as your apps. What that means in practice (assuming devices left connected around the clock; devices that are off cost nothing):

• One person, home lab: 3 always-on devices moving 20 GB ≈ £7.39/month.
• Small business: 25 always-on devices moving 100 GB ≈ £24.25/month, against a market where 25 devices typically costs £35–£65 on per-seat plans.
• Idle network: ≈ £5/month. "Pay for what you use" as a fact, not a slogan.

Your tenant gets a dedicated /24: a real, private address range of your own, not a slice of a shared pool. That is what keeps your app addresses stable, and it is why the ceiling is a specific number rather than a marketing "unlimited": 198 device addresses, 54 reserved app addresses, all yours, with no seat counting on any of them.

WireGuard, because it's the sensible one

We did not invent a VPN protocol, and you should be suspicious of anyone who did. WireGuard is about 4,000 lines of code against OpenVPN's hundreds of thousands: small enough to actually audit, which is how it earned review and merge into the mainline Linux kernel (5.6, 2020). It runs in the kernel, so it is fast without flattening a laptop battery. It uses one modern cipher suite (Curve25519, ChaCha20-Poly1305, BLAKE2s) with no negotiation, so there is no downgrade dance to misconfigure and no "which of these 40 options is correct" decision to get wrong.

Practically: a connection survives moving from wifi to mobile because it is keyed on the device's key, not its IP: shut the laptop, open it on another network, still connected. It is silent when idle, which is why it is viable on phones and metered links. And the client is the first-party WireGuard app on every platform you already own, not our software.

Set up in about a minute

Add a device in the portal and its keypair is generated on your own machine; the private key never reaches our servers. Download the .conf or scan the QR code with the WireGuard app and you are connected. No CLI, no key wrangling, no config files to hand-edit.

Per-device revocation is one click in the same place, and every issue and revocation is recorded in your audit log.

Big enough for the business, small enough for the home lab

The same network runs a 40-person company with locked-down per-app access rules, or one person joining a home lab, a test rig and a phone. Because nothing is billed per seat, the Raspberry Pi, the NAS, the two mini-PCs and the phone all just join, and an idle network bills about £5 a month.

UK, end to end

The concentrator your devices connect to runs in our own UK datacentre, on hardware we own, operated by the same engineers who run your apps. One supplier, one bill, one support queue, one incident owner, and UK jurisdiction for the whole path, not a US control plane with a UK exit. Every mainstream alternative in this market (Cloudflare, Tailscale, Twingate, Zscaler, ZeroTier) operates a US-controlled control plane.

What it is not, so you can hold us to what it is

It is not a mesh. Your devices connect to our UK concentrator, and traffic between two of your devices passes through it. Peer-to-peer mesh products (Tailscale, ZeroTier, NetBird) send device-to-device traffic directly and will be faster for that, especially far from the UK. Our shape exists because the thing most of our customers connect to is their Node-hosted apps, and those are in the same datacentre as the concentrator.

It is not "zero trust". It is network segmentation with per-app, per-port allow-lists you control. If you need per-request identity-aware access to individual applications, that is a different product category, and we would rather name it than borrow its vocabulary.

It is not unlimited. It is a dedicated /24: 198 devices, 54 reserved app addresses. We think a specific number you can plan against beats an "unlimited" that bills you per person.

Technical specification

Protocol	WireGuard over UDP, Linux kernel implementation on our side; first-party WireGuard apps on yours
Cryptography	Curve25519 key agreement, ChaCha20-Poly1305 authenticated encryption, BLAKE2s hashing; one fixed suite, no cipher negotiation, automatic rekeying with forward secrecy
Key handling	Device keypairs generated on the device itself at enrolment; private keys never transmitted to or stored by Node; the portal holds public keys only
Addressing	Dedicated private /24 per network: 198 device addresses, 54 fixed app addresses; yours alone, not shared
Access model	Deny by default. Self-service Layer 4 allow rules (per destination, per TCP/UDP port set); opt-in Layer 3 subnet routes for site-to-site
Rule enforcement	At the Node concentrator, independent of client configuration; rule changes converge in about a minute
Clients	Linux, macOS, Windows, iOS, Android; router/firewall peers on MikroTik, OPNsense, pfSense, UniFi, OpenWrt
NAT and roaming	Works behind NAT without inbound firewall changes on your side; sessions survive IP changes (wifi to mobile) because peers are keyed, not addressed
Provisioning	Portal self-service: QR code or .conf download per device; no CLI required
Revocation	Per device, one click, enforced at the concentrator in about a minute
Concentrator	UK datacentre, hardware we own, operated and monitored by our engineers
Metering	Per device: connection time (hourly) and traffic volume (per GB), visible in your portal
Billing	Base fee per network + metered usage from the published rate card; no per-seat charges; a disconnected device accrues nothing
Audit	Device enrolments, revocations and rule changes recorded per network

How it compares

	Per-seat VPN services	Private WireShark VPN by Node
Billing unit	Per user per month (~80% of the market)	Per network + metered usage
A new person's device	Adds a seat fee	Costs only the traffic it moves
The far end	A connector you install, patch and monitor	Your Node apps; we run both ends
Access rules	Often a paid-tier feature	Self-service L4 allow-lists included
Control plane	Predominantly US-controlled	UK, on hardware we own
Device-to-device speed	Peer-to-peer mesh is faster	Traffic transits the UK concentrator
Device ceiling	"Unlimited", billed per person	198 per network, no seat counting

Published prices as of July 2026, for shape rather than a like-for-like total: Tailscale moved to per-seat billing in April 2026 at $8–$18 per user per month; Twingate bills $5–$10 per user per month; NetBird $6–$12 per user per month; ZeroTier is per device, $18 per month for the first 10 then $2 per device. Cloudflare's Zero Trust tier is free up to 50 users; if you are a small team happy with a US control plane and running your own connector, that is genuinely hard to beat on price, and we would rather point at it than pretend otherwise. A 10-person, 25-device business typically lands at $48–$84 (~£35–£65) per month across the per-seat vendors.

How Node runs it for you

Deployment: self-service from your portal: your network, address range and first devices in minutes, with keys generated on your own device.

Upgrades and maintenance: we run and patch the concentrator and the platform underneath it; your side is the official WireGuard app, updated from your device's app store.

Monitoring and metering: connection state and usage are metered per device and visible in your portal, on the same bill as everything else we run for you.

Support: when a device will not connect, our engineers can see the platform end of the path, and they are the same people who run the apps you are connecting to.

---

Open source provenance

Private WireShark VPN is GPL-2.0-only software maintained upstream (source, ref v1.0.20210914). Node provides managed hosting, configuration and support. We are not the publisher.

• Hosting for paying customers: permitted under this licence.
• Trademark: "WireGuard" is a registered trademark of Jason A. Donenfeld. We describe the product as "managed WireGuard" (accurate, descriptive use) and never brand it as a WireGuard product. Product name is "Private Network" (#868).

Read more about how we work with the open source projects we host. Licence register last synced 2026-07-20.

Frequently asked questions

What can I connect?

Anything that runs the official WireGuard app, which today means Linux, macOS, Windows, iOS, Android and most capable routers, including MikroTik, OPNsense, pfSense, UniFi and OpenWrt. Add a device in the portal, download its config file or scan the QR code, and it joins your network. The other side of the network is your Node tenant, so your hosted apps are reachable on stable private addresses without exposing them to the public internet.

How many devices, and why 198 rather than "unlimited"?

198 devices, and we don't count seats. Every customer gets a whole private /24: a real, dedicated address range, not a slice of a shared pool. That is what makes your app addresses stable and predictable, and it is why the ceiling is a specific number rather than a marketing "unlimited": 198 addresses for devices, 54 reserved so your apps keep fixed addresses. The vendors advertising unlimited devices bill per user, so every device that belongs to a new person costs money. Ours don't: a contractor's laptop, a shared workshop PC and a rack of Raspberry Pis all cost the same: whatever traffic they actually move.

Do you see my traffic or hold my keys?

We never hold your device private keys: when you add a device, the keypair is generated on the device itself and the private key never reaches our servers. Traffic between your devices and your apps is WireGuard-encrypted to our concentrator, which runs in our UK datacentre; like any hub-based VPN service, traffic transits that concentrator, and we record the volume your devices move (for billing) but do not inspect or retain the contents. If your threat model requires that no provider ever carries your traffic, a self-hosted mesh is the honest answer, and we will say so.

How is it billed?

Three lines, all from our published rate card: a flat base per network per month, a small per-hour rate for each device while it is actually connected, and a per-GB rate for traffic. There are no per-user charges and no tiers to outgrow. An idle network costs about the base fee and nothing more; devices that are switched off cost nothing. Everything lands on the same monthly Node invoice as your apps.

How is this different from Tailscale or Cloudflare?

Honestly: they are different shapes. Tailscale and similar products build a peer-to-peer mesh, so traffic between two of your devices goes directly between them, which will be faster device-to-device, especially for users far from the UK. Cloudflare's tunnel is free at small scale. What neither offers: your apps already at the far end with nothing to install (their model requires you to run and patch a connector next to whatever you want to reach), a single UK supplier for the network, the apps, the bill and the support queue, and pricing that doesn't count seats. If a peer-to-peer mesh with a US control plane fits you better, use one; this product is for people who want the whole path run by one UK company.

Can I use it without hosting anything with you?

Yes: it works as a plain private network between your own devices, with per-device revocation and the same flat pricing. But the strongest reason to choose us over a mesh product is that your Node-hosted apps are already at the other end, so if you host nothing with us, a mesh-style product may honestly serve you better. We would rather tell you that than sell you the wrong thing.

Can I join a whole office or site, not just individual devices?

Yes. Enrol a capable router or firewall (MikroTik, OPNsense, pfSense, UniFi, OpenWrt) as a peer and the site behind it joins your network. By default nothing on the site can reach anything: you then allow specific apps and ports with Layer 4 rules, or switch on a Layer 3 route if a whole subnet should be reachable. Routes are opt-in per subnet and deny-by-default underneath, so joining a site never silently exposes it.

What is the difference between the Layer 4 rules and Layer 3 routing?

A Layer 4 rule allows one destination on specific TCP or UDP ports: precise, and the default way to grant access. A Layer 3 route publishes a whole subnet, so anything permitted on your network can route to any address in it: the right tool for genuine site-to-site plumbing, and a bigger surface, which is why it is off until you enable it per subnet. Most customers never need L3; when you do, it is one switch in the portal, and the deny-by-default rules still apply underneath.

What happens when a device disconnects, and does it cost anything while off?

Nothing to manage and nothing to pay. Connection time is metered hourly per device, so a disconnected device stops accruing the moment it drops, and traffic it is not moving costs nothing. When it comes back online it reconnects by itself: WireGuard sessions are keyed to the device rather than its IP address, so a laptop that sleeps overnight or moves from wifi to mobile data simply resumes.

Does it work behind NAT, and do I need to open firewall ports?

It works behind NAT with no inbound changes on your side: devices dial out to our UK concentrator over a single UDP port, which almost every network permits. You do not port-forward anything, and the apps you reach over the network stay off the public internet entirely.

Talk to us about your private network.

Tell us what you need to connect (people, sites, devices, apps) and an engineer will tell you whether this is the right shape and what it will cost.

Name*

Company Name*

Phone Number*

Email Address*

Message*

Get more detail