.png)
Announcements
Oct 16, 2024
Jul 9, 2026
•
11 min read
CloudConnexa and NordLayer both promise to replace legacy VPN sprawl with a single, cloud-delivered platform for secure access — but they start from different architectural assumptions. CloudConnexa unifies ZTNA, secure internet access, and site-to-site connectivity into one multi-tenant overlay network spanning all its global PoPs, with no per-feature tier gating. NordLayer, built on the Nord Security stack, takes a gateway-based approach instead — routing devices through shared or dedicated cloud gateways over its WireGuard-based NordLynx protocol, with many of its advanced controls reserved for higher commercial tiers.
This breakdown covers architecture, zero-trust controls, secure internet access, and administration, so you can see which model actually fits your network. For a side-by-side feature and pricing snapshot, see the full OpenVPN vs. NordLayer comparison.
CloudConnexa overview
OpenVPN CloudConnexa is a cloud-delivered network security platform that unifies ZTNA (private application access), secure internet access (content filtering, IDS/IPS), SaaS protection, and site-to-site connectivity into a single service. It is built around OpenVPN's "Wide-area Private Cloud" (WPC) model: an overlay private network spanning CloudConnexa’s Points of Presence, through which customers connect their networks via software Connectors that require no inbound ports and their devices via the OpenVPN Connect client, while OpenVPN operates the control and data planes. It uses OpenVPN Data Channel Offload (DCO) for high performance and offers zero-trust controls based on identity, device, and location context. Client and device connections use the OpenVPN protocol, and IPsec is supported for site-to-site (Network Connector) connections. Its built-in Cyber Shield delivers content filtering and IDS/IPS, and the service is SOC 2 Type 2 and ISO/IEC 27001 certified.
NordLayer overview
NordLayer is a cloud-delivered network security and SSE/SASE platform from Nord Security (the maker of NordVPN), positioned for SMB and mid-market organizations. It is delivered exclusively as a vendor-operated SaaS — customers manage users, gateways, and policies from a hosted Control Panel and there is no self-hosted variant. Devices connect through native apps (Windows, macOS, Linux, iOS, Android, and a browser extension) to shared or dedicated gateways hosted across 40+ countries. Its client connections use NordLynx (Nord's WireGuard-based protocol) or OpenVPN; IKEv2/IPsec was retired as a client protocol and now survives only for site-to-site tunnels. NordLayer layers ZTNA, network segmentation, device posture, DNS-based threat protection, and a Cloud Firewall on top of its gateway model. Many advanced capabilities — site-to-site, Cloud LAN, granular segmentation, DNS filtering, and DPI — sit on its higher commercial tiers rather than its entry tier.
When to Choose CloudConnexa vs. NordLayer
Choose CloudConnexa if you want a single service that bundles ZTNA, secure internet access (built-in IDS/IPS and content filtering), and site-to-site connectivity without per-feature tier gating; if you want the OpenVPN protocol with cross-platform client and router compatibility; or if you need site or cloud connectivity over IPsec or OpenVPN with Terraform automation and SIEM log streaming included.
Choose NordLayer if you want NordLynx (WireGuard-based) or OpenVPN client connections, already use the Nord Security ecosystem, and your requirements are met by DNS/web/download threat protection and a Cloud Firewall rather than a signature-based IDS/IPS — noting that site-to-site and several advanced controls are limited to higher commercial tiers. Note that CloudConnexa’s overlay network spans all global PoPs, but with NordLayer, you must select specific PoPs to host single-tenant private/dedicated gateways. For a deeper side-by-side on pricing, authentication, and deployment speed, see the full OpenVPN vs. NordLayer comparison.
Architectural trade-off
The two products use different connectivity models: CloudConnexa routes traffic through a multi-tenant WPC overlay spanning all of its global PoPs by default, while NordLayer routes traffic through shared or single-tenant gateways that you select and provision by region. The points below weigh that difference and test where common claims hold.
Where NordLayer’s gateway model can help
- Single-tenant Virtual Private Gateways give you a fixed, predictable point of presence and IP for compliance or allow-listing needs, since you choose exactly which regions host them.
- Because gateways are provisioned per region, capacity for a given location can be sized and isolated independently of the rest of the tenant.
- NordLynx’s WireGuard-based design can offer lower per-connection overhead than heavier legacy protocols for simple client-to-gateway paths.
- Standardizing on a small number of regional gateways keeps routing and troubleshooting comparatively simple for smaller, single-region deployments.
Trade-offs and claim-vs-reality
- The claim that dedicated gateways guarantee consistent performance holds only where they’re provisioned with headroom; shared gateways, the default on lower tiers, are multi-tenant and subject to the same noisy-neighbor and regional-capacity constraints sometimes raised against overlay architectures — so the benefit depends on which tier you’re actually on.
- Signature-based IDS/IPS is not part of NordLayer’s stack; its threat blocking is DNS-, web-, download-, and DPI-based (ThreatBlock, Application Blocker), so inline intrusion detection comparable to Cyber Shield Traffic Filtering must be sourced elsewhere or accepted as a gap.
- Several of the controls that make the gateway model compelling — site-to-site, Cloud LAN, granular segmentation, DNS filtering, DPI — are gated to higher commercial tiers, so the entry-tier experience is thinner than the marketed feature set suggests.
- Selecting specific PoPs for single-tenant gateways means coverage is only as broad as the regions you’ve explicitly provisioned, unlike CloudConnexa’s WPC overlay, which spans all Regions by default without per-region setup.
- No general-purpose public API is documented for NordLayer beyond SCIM provisioning endpoints, which limits infrastructure-as-code and custom automation relative to CloudConnexa’s REST API and Terraform provider.
Feature comparison
Architecture & Deployment Model |
||
|
Capability |
CloudConnexa |
NordLayer |
|---|---|---|
|
Cloud-hosted control + data plane |
Yes — fully hosted; WPC overlay ("virtual distributed router / next-gen firewall in the cloud") spans all global PoPs |
Yes — hosted Control Panel and dedicated cloud gateways in chosen PoPs |
|
Multiple isolated overlay networks |
Yes — multiple isolated WPCs per account (segment OT, IoT, and IT networks) |
Partial — segmentation via Virtual Private Gateways and firewall rules within one tenant; full isolation needs separate organizations |
|
Connection model |
Devices via OpenVPN Connect client; networks/servers via Connectors (Network and Host Connectors) |
Devices via native apps / browser extension to shared gateways; sites via dedicated-IP gateway |
|
Dedicated / single-tenant gateway |
No. The data layer uses a multi-tenant infrastructure, virtually creating a dedicated private overlay network that encompasses all mesh-connected PoPs. |
Single-tenant dedicated Virtual Private Gateways [5] and dedicated-IP servers (not available in all plans) |
|
Regions / Points of Presence |
~36 Regions worldwide; full-mesh core between PoPs |
40+ countries (shared); broader coverage for Virtual Private Gateways [5] (not available in all plans) |
|
Client platform coverage |
Windows, macOS, iOS, Android, ChromeOS; Linux via openvpn3 |
Windows, macOS, Linux, iOS, Android, browser extension |
|
IPv6 transport |
Yes — dual-stack and IPv6-only devices supported |
Not clearly documented |
Administration & Management |
||
|
Capability |
CloudConnexa |
NordLayer |
|---|---|---|
|
Web admin console |
Yes — Administration Portal; Owner / Administrator / Member roles |
Yes — central Control Panel |
|
Public management/automation API |
Yes — REST API with OAuth 2.0; Swagger docs |
No general-purpose public API documented; SCIM provisioning endpoints only |
|
Infrastructure-as-code |
Yes — official Terraform provider |
Not documented |
|
User provisioning |
Manual, API, SCIM 2.0 |
Manual, Automated provisioning via SCIM (Okta, Entra ID) (not available in all plans) |
|
Device management |
Device allowance, trusted devices, device identity enforcement, and connection profiles imported after login. |
Device list and management; posture features tier-gated |
Zero Trust & Identity |
||
|
Capability |
CloudConnexa |
NordLayer |
|---|---|---|
|
Zero-trust access model |
Access Groups control access to the destination applications and IP services based on source identity. Includes Network-to-application and Network-to-Network access control. |
Trust-broker model with segmentation up to Layer 7 (not available in all plans) |
|
User authentication |
Local username/password, LDAP, SAML 2.0 |
Local username/password, SAML/SSO |
|
Simultaneous IdP + local auth |
Yes — SAML and local accounts usable at the same time |
Yes — local accounts and SSO can run concurrently |
|
Multiple group membership per user |
Yes — one Primary plus up to 20 Secondary user groups (additive) |
Partial — team-based grouping; additive multi-group access not explicitly documented |
|
MFA |
Built-in 2FA; passkey / passwordless. Delegated to IdP when SAML is used. |
Built-in MFA; biometric 2FA (not available in all plans) |
|
Device posture / compliance |
Yes — OS, OS version, antivirus, disk encryption, client certificate |
Device Posture Security with auto-restrict; jailbreak detection (not available in all plans) |
|
Location / geo context |
Yes — allow/block by IP range or country |
Yes — geo-location rule and country block; source-IP allow-listing |
|
SCIM provisioning |
Yes — SCIM 2.0 (not available in all plans) |
Yes — Okta, Entra ID (not available in all plans) |
|
Service / non-human identity |
Host Connectors; REST API (OAuth client credentials) |
Partial — management API keys; no per-node service identity documented |
|
Device / supply-chain trust |
Device Identity Verification & Enforcement (locks profile to device) |
Partial — trusted-device enforcement via posture; no node-key co-signing |
Access Use Cases |
||
|
Capability |
CloudConnexa |
NordLayer |
|---|---|---|
|
Remote access |
Yes — core use case |
Yes — core use case |
|
Site-to-site |
Yes — via Network Connectors (IPsec or OpenVPN) and OpenVPN-compatible routers |
Yes — via dedicated-IP gateway (not available in all plans) |
|
Internet gateway / secure egress |
Yes — any Network can be an Internet Gateway; smart geo routing |
Yes — shared/private gateways for egress |
|
Selective SaaS routing by domain (split tunnel on) |
Yes — route specific SaaS domains through a chosen Internet Gateway with split tunnel on (no full tunnel required) |
Partial — URL-based split tunneling (browser extension) (not available in all plans) |
|
Vendor-provided static egress IP |
No — the customer runs the Internet Gateway and supplies the public IP |
Yes — vendor-provided dedicated/fixed IP (not available in all plans) |
|
Cloud connectors (AWS / Azure / GCP) |
Yes — AWS, Azure, GCP (IPsec or OpenVPN); plus VPS. |
AWS, GCP, IBM Cloud; Azure listed for identity, not as a native network connector (not available in all plans) |
|
Mesh interconnect of sites/devices |
Yes — full-mesh WPC overlay |
Cloud LAN [3] (not available in all plans) |
|
Split tunneling |
Yes — Split Tunnel On/Off and Restricted Internet modes |
IP-based split tunneling (not available in all plans); URL-based split tunneling (not available in all plans) |
|
Secure extranet / app sharing |
Yes — AppHub for sharing private apps across businesses/WPCs |
Not documented |
Networking |
||
|
Capability |
CloudConnexa |
NordLayer |
|---|---|---|
|
Client/device VPN protocol |
OpenVPN only (no WireGuard, no IPsec for clients); OpenVPN Data Channel Offload (DCO) for throughput |
NordLynx [1] (WireGuard-based) and OpenVPN; IKEv2/IPsec retired for clients |
|
WireGuard support |
No — not supported for any connection type |
Yes — via NordLynx [1] for client connections |
|
Site-to-site protocol |
IPsec or OpenVPN (Network Connectors only) |
IPsec/IKEv2 to customer router/firewall (not available in all plans) |
|
Custom DNS |
Yes — DNS Proxy, custom records/zones |
Custom DNS (not available in all plans) |
|
Overlapping-IP / domain routing |
Yes — application domain-based routing handles overlapping IPs |
Not documented |
Secure Internet Access |
||
|
Capability |
CloudConnexa |
NordLayer |
|---|---|---|
|
Content / DNS / web filtering |
Yes — Cyber Shield Domain Filtering, 43 categories, preset + custom; included |
DNS filtering by category (not available in all plans) |
|
IDS / IPS |
Yes — Cyber Shield Traffic Filtering (monitor/block, three threat priorities) |
No dedicated signature IDS/IPS; threat blocking is DNS/web/download/DPI-based |
|
Malware / threat protection |
Yes — malware, ransomware, C2, phishing, DoS, cryptojacking, more |
Web Protection (ThreatBlock [2]) and real-time Download Protection |
|
Deep packet inspection / app blocking |
Application/IP service controls via Access Groups |
Yes — DPI-based Application Blocker [4] (~400 ports/protocols) (not available in all plans) |
|
Cloud firewall (FWaaS) |
Access Groups + allowed protocol and port |
Yes — Cloud Firewall (not available in all plans) |
|
CASB / SaaS security |
Not offered (SaaS access can be restricted to an Internet Gateway egress IP) |
Not documented |
|
Endpoint protection (EDR) |
Integrates via device posture / antivirus checks |
CrowdStrike Falcon as a paid add-on (third-party, not native) |
Observability & Operations |
||
|
Capability |
CloudConnexa |
NordLayer |
|---|---|---|
|
Audit / configuration log |
Yes — Audit Log of all config changes; CSV export |
Activity > Actions logging |
|
Access / traffic visibility |
Yes — Access Visibility (allowed/blocked flows) and DNS Log |
Activity monitoring and device network activity |
|
SIEM / log streaming |
Yes — JSON streaming to AWS S3; Splunk, Datadog integrations |
No documented native SIEM/log export |
|
Dashboards / reporting |
Yes — Cyber Shield dashboards, top categories/threats, CSV reports |
Yes — dashboards |
|
Alerts / notifications |
Yes — email alerts for usage, connector status, log streaming |
Activity monitoring; dark-web monitoring via add-on |
Reference: NordLayer named feature
NordLayer markets several capabilities under proprietary names. The numbers below are referenced in the comparison tables above (e.g. "NordLynx [1]"). Each entry summarizes the function and the closest equivalent in CloudConnexa.
|
Feature |
What it does |
CloudConnexa equivalent |
|---|---|---|
|
Nord's WireGuard-based client VPN protocol with a double-NAT design for performance. |
Client connections use the OpenVPN protocol with OpenVPN Data Channel Offload (DCO) for throughput. |
|
DNS/web-layer blocking of known malicious and phishing sites. |
Cyber Shield content / DNS filtering and threat protection, included on all plans. |
|
Interconnects sites and devices into a single virtual mesh LAN. |
The full-mesh WPC overlay connects networks and devices natively. |
|
Deep-packet-inspection-based blocking of applications, ports, and protocols. |
Application / IP-service access controls via Access Groups (policy-based rather than DPI). |
|
A single-tenant, dedicated gateway with its own policies. |
There are no single-tenant dedicated gateways. The data layer uses a multi-tenant infrastructure, virtually creating a dedicated WPC overlay that encompasses all PoPs. |
Secure your network now.
Ready to take your business to the next level with CloudConnexa? Work from anywhere and from any device with confidence.
