Ditching Legacy VPNs: Implementing Zero Trust Network Access (ZTNA) for Hybrid Teams

When an employee connects via legacy OpenVPN or IPSec, their laptop becomes a virtual extension of the server room. If their personal device or home router is compromised, that malware can scan and attack internal servers unimpeded across flat subnets.

Zero Trust Network Access (ZTNA) completely abolishes broad network tunneling. Internal resources (ERP portals, staging clusters, Git repositories, admin dashboards) are fronted by identity-aware proxies that authenticate every single HTTP request and TCP stream.

Under ZTNA, developers can only reach git servers and staging environments; finance personnel can only reach payroll dashboards. At no point can an infected engineering workstation communicate with billing databases or hypervisor management planes.

Modern wireguard-based mesh overlays such as Tailscale permit declarative JSON ACLs that enforce mutual authentication, ephemeral key rotation, and strict egress filtering without maintaining brittle edge concentrator hardware.

{
  // NATELAD ENTERPRISE TAILSCALE ZTNA ACCESS CONTROL POLICY
  "tagOwners": {
    "tag:prod-db": ["group:cloud-engineers"],
    "tag:internal-apps": ["group:devops-lead"]
  },
  "groups": {
    "group:cloud-engineers": ["kuda@natelad.co.zw", "panashe@natelad.co.zw"],
    "group:support-agents": ["support-1@natelad.co.zw", "support-2@natelad.co.zw"]
  },
  "acls": [
    // Database engineers can access Postgres primary port 5432 only with device posture checks
    {
      "action": "accept",
      "src": ["group:cloud-engineers"],
      "dst": ["tag:prod-db:5432"],
      "posture": ["posture:secureWorkstation"]
    },
    // Support agents can only reach internal helpdesk web portals over HTTPS
    {
      "action": "accept",
      "src": ["group:support-agents"],
      "dst": ["tag:internal-apps:443"]
    }
  ],
  "postures": {
    "posture:secureWorkstation": [
      "node:os == 'macos' || node:os == 'linux'",
      "node:disk_encryption == true"
    ]
  }
}

Unlike traditional VPN sessions that persist for hours once logged in, ZTNA evaluates identity tokens on every request. If an employee resigns or their Google Workspace account is locked, their access to all internal tools drops instantly across all devices without needing to flush router states.