Twingate Alternatives for MSPs: Where Per-User ZTNA Falls Short
Twingate is solid ZTNA for one company. For MSPs managing client sites, per-user pricing and a client app on every device create friction. Here is the gap.
Twingate is a well built zero trust network access (ZTNA) product. It replaces the old "connect to the VPN and you are on the LAN" model with per-resource access policies tied to your identity provider. For an MSP managing dozens of separate client sites, though, the same design choices that make Twingate clean for a single company create friction at scale.
This post is for MSPs weighing Twingate for client remote access: how it is built, where the per-user ZTNA model runs into MSP reality, and the architectural difference that matters most.
How Twingate Works
Twingate uses four components. A Controller runs as SaaS, hosted by Twingate, and delegates authentication to your identity provider. A Client application runs on each end-user device and intercepts traffic bound for protected resources. A Connector is deployed on a host inside each remote network, and every remote network needs at least one. A Relay carries traffic when a direct client-to-connector connection is not possible.
The Connector model is sound, and in fairness it is close to how ProxyLink works: one component per site rather than one agent per device, so a camera or a switch does not need to run anything. The difference for an MSP sits on the two ends of that connection: who has to install software, and how you are billed.
The Client App on Every Accessing Device
To reach anything through Twingate, the accessing device must run the Twingate Client (Windows, macOS, Linux, iOS, or Android) and sign in. For your own engineers that is a one-time install, assuming their laptops allow it. The sharper problem is everyone who is not a full-time engineer: a client who wants to view their own camera feed, a third-party vendor who needs ten minutes on one PLC, a technician on a borrowed device. Each of them needs the client app installed and an account provisioned first.
ProxyLink runs in the browser. An engineer opens a URL and the RDP, VNC, or SSH session renders in a tab, with no client software on the laptop. For one-off or third-party access, a shareable access link opens the device in a browser with no ProxyLink account at all.
Per-User Pricing at MSP Scale
Twingate is priced per user per month. There is a free tier (up to 5 users and 50 resources), a Teams plan around $5 per user per month billed annually, and a Business tier above that. For a single company with a fixed headcount this is predictable. For an MSP it is the wrong axis: your cost grows with every engineer and every client contact you add, not with the number of sites you manage. ProxyLink's MSP tier is a flat EUR 69 per month for 300 tunnels and a team, locked in for life for early-access subscribers, and it does not move when you add another engineer.
Network Access, Not a Session Console
Twingate delivers network connectivity to a resource. Once connected, your engineer still opens their own tools against it: an RDP client for Windows, a VNC viewer, a terminal for SSH. There is no built-in browser console, and the connection itself does not record the session. ProxyLink is built around the session. Browser RDP, VNC, and SSH run on the relay using Apache Guacamole, session recording is available per proxy link on paid plans, and an audit log captures who connected to which device and when.
EU Data Residency and NIS2
Twingate is a US company, and its Controller and relay infrastructure run in public cloud operated by Twingate. If your clients fall under NIS2 or GDPR, where your session traffic transits and who operates that infrastructure is a supply chain question worth raising with your DPO before you assume it is covered. ProxyLink is hosted entirely on Hetzner in Germany, runs on WireGuard (an open, independently audited protocol that ships in the Linux kernel), and does not route session traffic through any third party.
The Router Gateway Model
ProxyLink puts one WireGuard tunnel on the router or gateway at each client site: MikroTik, pfSense, OPNsense, OpenWRT, or a Linux box such as a Raspberry Pi. Every device on every LAN and VLAN behind it becomes reachable, Windows PCs, NVR cameras, PBX systems, managed switches, PLCs, anything with an IP, with nothing installed on those devices. The site keeps no open inbound ports and needs no static IP, because the tunnel is initiated outbound from the router.
| Feature | Twingate | ProxyLink |
|---|---|---|
| Component per site | Connector | WireGuard tunnel on router |
| Software on accessing device | Client app required | Browser only |
| Access with no account or app | No | Yes (shareable access link) |
| Browser RDP / VNC / SSH | No | Yes |
| Session recording | No | Yes (paid plans) |
| Hosting | Public cloud (US vendor) | Hetzner Germany |
| Pricing model | Per user per month | Flat EUR 69/mo (300 tunnels) |
When Twingate Is the Right Choice
Twingate is a strong fit when you are securing one organization's own workforce: employees on managed devices that can run the client, reaching internal apps and servers, with access tied to your identity provider. If that is the shape of the problem, per-user ZTNA is exactly what it is for. The mismatch appears when the accessing side is a mix of engineers, clients, and outside vendors, when you bill per site rather than per seat, and when you need the session itself, a recorded RDP or SSH console in a browser, rather than only the network path to it. That is the gap ProxyLink was built for.
One WireGuard tunnel per client router. Every device on every VLAN reachable from a browser, no client app on the laptop, no per-user bill. Try ProxyLink free at app.proxylink.dev, no card required, free during early access. Setup guides for MikroTik, pfSense, OPNsense, OpenWRT, and Linux are in the docs. Related: Tailscale for MSPs.