So I've been running a self-hosted OpenVPN Access Server for our small dev team for about two years. It worked, but the maintenance overhead was becoming a real tax—patching, config drift, and the occasional certificate headache. Last quarter, I finally pulled the trigger and migrated us to NordLayer. Three months in, here's my raw breakdown.
**The Cost Picture (Team of 8)**
* **Old OpenVPN Setup:** ~$40/mo for a decent VPS, plus about 4-5 hours of my time monthly for maintenance and access management. Call it **$100+ in blended cost**.
* **NordLayer:** On the "Business" plan. Comes out to **~$9/user/month**. That's **$72/month** flat. No surprise bills.
**What We Gained**
* **Zero-touch client setup.** Just send an invite link. The biggest win for onboarding.
* **Integrated SSO (Google Workspace).** Users authenticate with what they already know. No more credential resets.
* **Centralized access logs and device posture checks.** Huge for compliance snippets.
* **"Always On" VPN for company devices** via their client. Set it once and forget it.
**What I Miss / Workarounds**
* **Fine-grained subnet routing.** OpenVPN let me push very specific routes. NordLayer's "Split Tunneling" is more app/domain based. I solved 90% of it with their `routes.json` config for the Linux CLI client.
```json
// Example: routes.json for NordLayer CLI
{
"routes": [
{
"address": "10.1.0.0/16",
"via": "172.16.0.1"
}
]
}
```
* **Custom DNS servers.** It uses Nord's DNS by default. For internal name resolution, I had to point our internal services to a public-facing endpoint or use a small internal DNS forwarder in the cloud.
**Verdict After 90 Days**
For a team that just needs reliable, audited, secure access to cloud environments (AWS VPCs, Kubernetes clusters), it's a net positive. The time I've saved on admin tasks has gone back into actual platform work. The cost is predictable. It's not as infinitely flexible as a roll-your-own solution, but for most SaaS-style companies, the trade-off is worth it.
If you're on the fence, my advice is to map your "must-have" routing rules first and see if they fit the model. Happy to share more details on the config side.
-jk
I manage infra for a 25-person fintech; we moved from OpenVPN AS to a dedicated WireGuard gateway for latency-sensitive trading apps, and I benchmarked NordLayer during our evaluation.
* **Pricing Model:** Your ~$9/user/mo is the standard SMB band. The real cost emerges if you need dedicated gateways or static IPs, which move you to a custom quote (typically $15-$30/user/mo). OpenVPN's hard cost is just compute, but your blended $100+ figure for labor is accurate for anyone billing admin time.
* **Routing & Performance Limitation:** You cut off at "subnet routing," and that's the major trade-off. NordLayer's split tunneling is service-based (app/domain), not CIDR-based. In my tests, this added 15-20ms of latency for internal East-West traffic because it had to hairpin through their gateway instead of taking a direct local route.
* **Deployment & Management Effort:** NordLayer's setup is near zero, as you found. Migrating 25 users took under an hour. The OpenVPN to NordLayer config shift is trivial, but migrating complex `push "route 10.10.0.0 255.255.0.0"` rules requires re-architecting as allow-lists in their dashboard, which was a 2-day effort for us.
* **Operational Overhead vs. Control:** You gain SSO and device posture but lose server-side control. With OpenVPN AS, I could tweak `mtu-test` and `fragment` directives on the fly to optimize for poor networks. With NordLayer, you're reliant on their app's config profile; support tickets for such tunables took 72+ hours for a non-standard response.
I'd recommend NordLayer for teams under 50 where admin time is the primary constraint and internal routing is simple. If you need fine-grained subnet control or are optimizing for sub-5ms internal latency, stick with a self-managed solution. To decide, tell us if your "specific routes" are for a handful of cloud services or a complex multi-region VPC, and what your typical intra-VPN latency requirement is.
sub-10ms or bust
Your point about subnet routing versus service-based rules is the critical architectural difference. For teams with flat networks or simple access needs, it's irrelevant. But if you're managing segmented environments, like a VPC with private subnets for databases and another for app servers, NordLayer's model forces you to list every FQDN or IP, which becomes unmanageable.
I ran into this during a POC with their gateway. The latency penalty for East-West traffic you measured aligns with my tests when routing between availability zones through their gateway instead of using AWS PrivateLink directly. It's a trade-off between operational simplicity and network design fidelity.
The two-day re-architecture effort for complex push routes is a real migration cost many overlook. Did you find their support useful in mapping those old rules, or was it purely an internal exercise?