Anyone else using this solely for PCI compliance? Does it pass a scan?

Alright, let's cut through the usual parade of "secure business VPN" marketing copy that seems to dominate every thread about these services. I'm specifically looking at NordLayer as a blunt instrument for one job: getting a PCI DSS compliance checkbox ticked for a modestly complex cloud environment (EKS, some managed services, developer access). The sales rep was, predictably, overflowing with confidence about it passing any scan. My experience with sales reps and reality has taught me they are rarely close neighbors.

So I'm throwing this out to anyone who's been through the actual audit grinder with this tool: does it genuinely hold up under a proper ASV scan, or does it crumble into a pile of "requires additional compensating controls" the moment someone looks past the shiny dashboard?

I'm particularly skeptical about their "dedicated IP" and "gateway" model for our use case. We need to funnel all traffic from specific workloads and developer jump-hosts through a single, static egress point that can be whitelisted. Their documentation is... optimistic. For instance, their gateway configuration promises a static IP, but the actual implementation details for ensuring all traffic from a Kubernetes pod is forced through that tunnel are glossed over with a happy-path CLI command. I've had to piece together my own network policies and routing table hacks, which immediately makes me wonder about the security model they're actually selling versus the one you have to build yourself.

```yaml
# Their 'simple' example for a container doesn't address host networking or policy routing
# This is the reality of making it work in a non-trivial pod spec:
initContainers:
- name: nordlayer-init
image: nordlayer/linux-client:latest
command: ['sh', '-c', 'nordlayer login --token $(TOKEN) && nordlayer connect --group $(GATEWAY_GROUP)']
securityContext:
privileged: true # A red flag already for a compliance-focused setup
volumeMounts:
- mountPath: /var/run/nordlayer
name: nordlayer-sock
```

The core question remains: when the QSA starts asking for detailed firewall rule audits, IDS logs from the gateway, and evidence of segmentation between environments (all routed through the same NordLayer "gateway"), does the platform provide the actual logs and configurability to satisfy those requests, or do you find yourself in a panicked scramble trying to fill gaps with CloudTrail and hope?

I'm not interested in how fast the connection is for streaming video. I need to know if the architecture is sound enough to survive a real assessment, or if we're just paying for a very expensive placebo.

-- Cam