CloudConnexa
Jul 17, 2026
Jul 28, 2026
•
13 min read
CloudConnexa and GoodAccess both promise to replace a legacy business VPN with something closer to zero trust, but they start from different assumptions about how small and mid-size teams operate. This breakdown covers architecture, zero-trust controls, secure internet access, and pricing structure, so you can match the right platform to your environment.
CloudConnexa overview
OpenVPN CloudConnexa is a cloud-delivered network security platform that unifies ZTNA (private application access), secure internet access (content filtering, IDS/IPS), SaaS protection, and site-to-site connectivity into a single service. It is built around OpenVPN's “Wide-area Private Cloud” (WPC) model: an overlay private network spanning CloudConnexa’s Points of Presence, through which customers connect their networks via software Connectors that require no inbound ports and their devices via the OpenVPN Connect client, while OpenVPN operates the control and data planes. It uses OpenVPN Data Channel Offload (DCO) for high performance and offers zero-trust controls based on identity, device, and location context. Client and device connections use the OpenVPN protocol, and IPsec is supported for site-to-site (Network Connector) connections. Its built-in Cyber Shield delivers content filtering and IDS/IPS, and the service is SOC 2 Type 2 and ISO/IEC 27001 certified.
GoodAccess overview
GoodAccess is a fully cloud-delivered ZTNA and business-VPN platform aimed at SMBs, with no self-hosted option. Each customer receives a dedicated cloud gateway with a dedicated static IPv4 address for IP allow-listing, drawn from roughly 35+ gateway locations worldwide. Devices connect through native apps (Windows, macOS, iOS, Android, ChromeOS; Linux via OpenVPN config), and sites or cloud VPCs connect through IPsec-based Branch and Cloud Connectors. Client connections currently use OpenVPN and IKEv2/IPsec; WireGuard is on the roadmap as “in development, available during 2026” and is not yet generally available. Its zero-trust model centers on identity-based “Access Cards,” device posture checks, and SSO/SCIM, while secure internet access is delivered through a DNS-layer Threat Blocker rather than a full inspecting proxy or IDS/IPS. Many enterprise capabilities — SSO, SCIM, device posture, site/cloud connectors, REST API, and SIEM export — sit on its higher commercial tier rather than the entry tier.
Choose CloudConnexa vs. GoodAccess
Choose CloudConnexa if you want built-in signature IDS/IPS and content filtering included at no extra cost, a full-mesh overlay with IPsec or OpenVPN site-to-site connectivity, application domain-based routing that handles overlapping IPs and conceals server addresses, and automation via REST API and Terraform with SIEM streaming included.
Choose GoodAccess if you need a dedicated gateway with a dedicated static IP for IP allow-listing, identity-based Access Cards, and your requirements are met by DNS-layer threat blocking plus device posture — noting that site-to-site is IPsec-only, that WireGuard is on the roadmap but not yet generally available, and that SSO, SCIM, device posture, connectors, the API, and SIEM export require the higher commercial tier.
Architectural trade-off
The two platforms take different approaches to where traffic terminates. CloudConnexa spans a multi-region full-mesh overlay across roughly 36 Points of Presence, while GoodAccess assigns each account a single dedicated cloud gateway with a fixed static IP. The points below weigh that difference and test where common claims hold.
Where GoodAccess's dedicated-gateway model can help
- A fixed static IP per account simplifies allow-listing on banking portals, SaaS admin consoles, and firewalls that key access off source IP, since the address never rotates.
- One gateway per account is a simpler mental model for small IT teams: there is a single egress point and policy set to reason about, rather than a multi-region mesh.
- Choosing from 35+ possible gateway locations lets a small, single-office team pick a location close to their traffic without operating any infrastructure themselves.
- Onboarding is fast because there is no per-region provisioning decision to make beyond the initial gateway location.
Trade-offs and claim-vs-reality
- A single dedicated gateway is also a single point of presence for the whole account: users or sites far from that location backhaul to it, and CloudConnexa's ~36-region WPC with full-mesh routing has no equivalent single-hop bottleneck to route around.
- Throughput and availability for the entire account ride on that one gateway, whereas CloudConnexa's full-mesh core and multiple Network/Host Connectors distribute load and let admins add regions as they grow.
- WireGuard is described as “in development, available during 2026,” so despite the modern-protocol positioning, every connection today still runs over OpenVPN or IKEv2/IPsec — the same protocol families CloudConnexa already supports.
- Site-to-site is IPsec-only in GoodAccess; CloudConnexa's Network Connectors support OpenVPN or IPsec, so an existing OpenVPN-based router fleet doesn't need a protocol change.
- Secure internet access is DNS-layer threat blocking only — there's no inspecting proxy, IDS/IPS, or malware scanning, so anything beyond domain-category blocking has to be sourced from a separate tool, unlike CloudConnexa's built-in Cyber Shield.
- The capabilities most comparisons assume are “included” — SSO, SCIM, device posture, connectors, the REST API, and SIEM export — sit behind GoodAccess's higher commercial tier, so the entry-level price doesn't include the full ZTNA feature set being compared.
Feature comparison
The tables below break the comparison into architecture, administration, zero trust, access use cases, networking, secure internet access, and observability.
Architecture & Deployment Model |
||
|
Capability |
CloudConnexa |
GoodAccess |
|---|---|---|
|
Cloud-hosted control + data plane |
Yes — WPC overlay; fully hosted |
Yes — 100% cloud-delivered; no hardware |
|
Multiple isolated overlay networks |
Yes — multiple isolated WPCs per account (segment OT, IoT, and IT networks) |
No — single virtual network per account; isolation via Access Cards (ACLs), not separate overlays |
|
Connection model |
Devices via OpenVPN Connect; networks/servers via OpenVPN or IPsec Connectors |
Devices via native apps; sites/clouds via IPsec connectors |
|
Dedicated/single-tenant gateway |
No. Multi-tenant infrastructure. Per-account WPC overlay is virtually dedicated |
Yes — dedicated gateway per customer with reserved capacity |
|
Dedicated/static public IP |
No — customer runs the Internet Gateway and provides a static public IP |
Yes — dedicated static IPv4 per team for allow-listing |
|
Regions/PoPs |
~36 Regions worldwide; full-mesh core |
~35+ gateway locations; additional/HA gateways available |
|
High availability |
Redundant full-mesh core network |
Optional geo-separated backup gateway |
|
Client platform coverage |
Windows, macOS, iOS, Android, ChromeOS; Linux via openvpn3 |
Windows, macOS, iOS, Android, ChromeOS; Linux via OpenVPN config |
Administration & Management |
||
|
Capability |
CloudConnexa |
GoodAccess |
|---|---|---|
|
Web admin console |
Yes — Administration Portal; Owner/Admin/Member roles |
Yes — web Control Panel with admin roles/RBAC |
|
Public REST API |
Yes — REST API with OAuth 2.0 |
Yes — bearer-token REST API (not available in all plans) |
|
Infrastructure-as-code |
Yes — Terraform provider |
Not documented |
|
User provisioning |
Manual, API, SCIM 2.0 |
SCIM auto-provisioning (not available in all plans) |
|
Client deployment |
MDM deployed profile and client; URL-based profile import. |
MSI deployment/centralized distribution |
Zero Trust & Identity |
||
|
Capability |
CloudConnexa |
GoodAccess |
|---|---|---|
|
Zero-trust access model |
Zero Trust Application Broker in CloudConnexa continuously verifies identity, location context, and device posture, then assigns a synthetic intermediate IP scoped to a single authorized app. The device never receives a route to the private network, making lateral movement structurally impossible.
Access Groups control access to destination applications and IP services based on source identity. They include network-to-application and network-to-network access control. |
Identity-based "Access Cards" [1]; per-session least-privilege |
|
User authentication |
Local username/password, LDAP, SAML 2.0 |
Local username/password, LDAP, SAML |
|
Simultaneous IdP + local auth |
Yes — SAML and local accounts usable at the same time (not available in all plans) |
No — enabling SSO removes local accounts (mutually exclusive) |
|
Multiple group membership per user |
Yes — one Primary plus up to 20 Secondary user groups (additive) |
Yes — a member can belong to multiple Groups (additive via Access Cards) |
|
MFA |
Built-in 2FA; passkey/passwordless. Delegated to IdP when SAML is used. |
2FA on UI, apps, and optionally per-connection; biometric login |
|
Device posture/compliance |
Yes — OS, OS version, antivirus, disk encryption, certificate |
Yes - disk encryption, AV, firewall, root/jailbreak (not available in all plans) |
|
Location/geo context |
Yes — allow/block by IP range or country |
Yes — Geo Restrictions allow/block by country |
|
SCIM provisioning |
Yes — SCIM 2.0 (not available in all plans) |
Yes — automated IdP sync (not available in all plans) |
|
Service/non-human identity |
Host Connectors; REST API (OAuth client credentials), mTLS |
Partial — persistent connection for headless devices; management API keys |
|
Device/supply-chain trust |
Device Identity Verification & Enforcement (locks profile to device) |
Partial — device posture, manual device approval, and device certificates |
Access Use Cases |
||
|
Capability |
CloudConnexa |
GoodAccess |
|---|---|---|
|
Remote access |
Yes — core use case |
Yes — core use case |
|
Site-to-site |
Yes — via Network Connectors (IPsec or OpenVPN) or compatible routers |
Branch Connector [3] (IPsec) (not available in all plans) |
|
Cloud connectors (AWS/Azure/GCP) |
Yes — AWS, Azure, GCP; plus VPS and routers |
Cloud Connector [4] (IPsec into VPCs) (not available in all plans) |
|
Internet gateway/secure egress |
Yes — any Network as Internet Gateway; smart geo routing |
Yes — egress via dedicated static IP; inbound port forwarding |
|
Selective SaaS routing by domain (split tunnel on) |
Yes — route specific SaaS domains through a chosen Internet Gateway with split tunnel on (no full tunnel required) |
Partial — split tunneling routes selected destinations; domain-based selective routing not documented |
|
Vendor-provided static egress IP |
No — the customer runs the Internet Gateway and supplies the public IP |
Yes — vendor-provided dedicated static IP (not available in all plans) |
|
Split tunneling |
Yes — Split Tunnel On/Off and Restricted Internet |
Yes — split tunneling |
|
IoT/host/server access |
Host Connectors for single servers/IoT |
Servers/VMs/IoT added manually as "members" |
|
|
||
|
Capability |
CloudConnexa |
GoodAccess |
|---|---|---|
|
Client/device VPN protocol |
OpenVPN only; OpenVPN Data Channel Offload (DCO) for throughput |
OpenVPN and IKEv2/IPsec |
|
WireGuard |
No |
No |
|
Site-to-site protocol |
IPsec or OpenVPN (Network Connectors) |
IPsec only (Branch [3] and Cloud [4] Connectors) (not available in all plans) |
|
Dedicated/static IP |
Available via Internet Gateway/SNAT (customer provided) |
Yes — dedicated static IPv4 |
|
DNS |
Yes — DNS Proxy, custom records/zones, Private DNS support |
Yes — managed DNS infrastructure; custom DNS management |
|
Overlapping-IP/domain routing |
Yes — domain-based routing handles overlapping IPs |
Not documented |
Secure Internet Access |
||
|
Capability |
CloudConnexa |
GoodAccess |
|---|---|---|
|
Content/DNS/web filtering |
Yes — Cyber Shield Domain Filtering, 43 categories; included |
Yes — Threat Blocker [2] DNS filter (~5M domains); web categories |
|
Secure web gateway (SWG) |
DNS Proxy + Traffic Filtering (includes inline IDS/IPS) |
DNS-layer SWG only (not a full HTTPS-inspecting proxy) |
|
IDS/IPS |
Yes — Cyber Shield Traffic Filtering (monitor/block) |
No — no dedicated IDS/IPS; protection is DNS-layer + posture |
|
Malware/threat protection |
Yes — domain-level malware, ransomware, C2, phishing, more |
Yes — domain-level malware/phishing/C&C blocking via threat feeds |
|
Cloud firewall (FWaaS) |
Access Groups + WPC firewall function |
Network access control/IP allow-listing (not a full NGFW) |
|
CASB/SaaS security |
Not offered (SaaS access can be restricted to an Internet Gateway egress IP) |
Not offered |
Observability & Operations |
||
|
Capability |
CloudConnexa |
GoodAccess |
|---|---|---|
|
Audit/config log |
Yes — Audit Log of config changes; CSV export |
Yes — admin/audit logs |
|
Access/traffic visibility |
Yes — Access Visibility and DNS Log |
Gateway-level and system-level access logs; Threat Blocker [2] logs |
|
SIEM/log export |
Yes — JSON streaming to AWS S3; Splunk, Datadog |
JSON over Syslog (UDP/TCP/TLS) (not available in all plans) |
|
Device posture logs |
Posture results visible per device |
Historical posture-check logs (not available in all plans) |
|
Dashboards/monitoring |
Yes — Cyber Shield dashboards and CSV reports |
Yes — connection/threat/device dashboards and weekly reports |
Reference: GoodAccess named features
GoodAccess markets several capabilities under proprietary names. The numbers below are referenced in the comparison tables above (e.g. "Access Cards [1]"). Each entry summarizes the function and the closest equivalent in CloudConnexa.
|
Feature |
What it does |
CloudConnexa equivalent |
|---|---|---|
| Access Cards |
Identity-based bundles of access rights assigned to roles or groups in one click. |
Access Groups (source → destination). |
| Threat Blocker |
DNS-layer filtering that blocks malicious/phishing domains and web categories. |
Cyber Shield Domain Filtering and threat protection, included on all plans. |
| Branch Connector |
IPsec site-to-site connector to on-premises routers/firewalls. |
Network Connectors (IPsec or OpenVPN). |
| Cloud Connector |
IPsec site-to-site connector into cloud VPCs (AWS/Azure/GCP). |
Native OpenVPN Cloud Connectors for AWS, Azure, and GCP. IPsec supported too. |
Frequently Asked Questions
What is the main architectural difference between OpenVPN CloudConnexa and GoodAccess?
CloudConnexa runs a full-mesh overlay network across roughly 36 Points of Presence, so traffic and policy can be distributed across regions and multiple isolated WPCs. GoodAccess assigns each customer a single dedicated cloud gateway with one static IP, chosen from more than 35 available locations, so all of that account's traffic terminates at one gateway.
Does GoodAccess support WireGuard?
As of June 2026, it does not. GoodAccess lists WireGuard as “in development, available during 2026.” Today, client and site connections run over OpenVPN or IKEv2/IPsec — the same protocol families CloudConnexa already supports, with CloudConnexa adding Data Channel Offload (DCO) for throughput.
Does CloudConnexa offer a static egress IP like GoodAccess?
Yes, functionally. Any CloudConnexa Network can be configured as an Internet Gateway with smart geo-based routing, giving admins a controllable egress point, though CloudConnexa does not market this as a single fixed per-account IP the way GoodAccess does.
Which platform includes intrusion prevention and content filtering?
CloudConnexa's built-in Cyber Shield includes both domain/content filtering and IDS/IPS at no extra cost. GoodAccess's Threat Blocker is DNS-layer category blocking only; it does not include an inspecting proxy, IDS/IPS, or malware scanning.
Do I need GoodAccess's higher tier to get SSO, SCIM, or device posture?
Yes. GoodAccess gates SSO, SCIM, device posture, Branch/Cloud Connectors, the REST API, and SIEM export to its higher commercial tier rather than including them at the entry level.
Is GoodAccess a good OpenVPN alternative for a small team that only needs remote access?
It can be, if a single dedicated gateway and DNS-layer filtering match your needs and you don't require built-in IDS/IPS, multi-region routing, or WireGuard today. Teams that also want inline threat inspection, full-mesh site-to-site, or a choice of OpenVPN or IPsec for site connectivity should weigh CloudConnexa's built-in Cyber Shield and WPC architecture against GoodAccess's simpler, single-gateway model.
Related comparisons
- Comparing OpenVPN CloudConnexa and Tailscale
- Comparing OpenVPN CloudConnexa and NordLayer
- Comparing OpenVPN CloudConnexa and Cloudflare One
- Comparing OpenVPN CloudConnexa and Check Point Harmony SASE
- See how CloudConnexa stacks up against other alternatives
Secure your network now.
Ready to see how CloudConnexa's full-mesh architecture and built-in Cyber Shield compare to a single dedicated gateway? Get started for free or book a demo.