NOOSH is an identity-based remote access platform — a modern, zero-trust replacement for the legacy VPN. Drop a connector behind any firewall, let people sign in with the identity they already have, and grant access to specific applications and infrastructure — never the whole network.
Traditional VPNs were built to extend the network. Connect, and you land on a flat segment with a broad line of sight to everything on it — long after the reason for connecting has passed. NOOSH inverts that model.
Instead of trusting the network, NOOSH verifies who and verifies context at every step, then opens a path to exactly one authorized application — and nothing else. There is no implicit east-west access, no standing exposure of the wider environment, and no inbound port to attack. Access is a decision, evaluated continuously, not a door left propped open.
People connect with the identity they already use. Authorization is bound to that identity — not to an IP range, a subnet, or a tunnel that, once up, can reach anything.
Each application or device is published as its own resource. Someone authorized for one service never gains a route to the rest of the environment behind it.
Administrators define who reaches what, under which conditions. Identity and context are checked at each step — so access reflects the situation right now, not a one-time login.
Because access is scoped to a single resource, the blast radius shrinks dramatically — without the connection drops, client wrestling, and routing headaches people expect from a VPN.
What NOOSH does
One platform handles the whole lifecycle of remote access: publish a resource, decide who reaches it, connect people to it, and watch every session. Read the headlines below — each one is a capability, not a slogan.
Deployment centers on a single connector you install behind any firewall. It reaches out to establish trust, so there is no inbound port to open, forward, or defend. From there, people connect using their existing identity and reach what they are authorized to reach. Need more capacity or another site? Add another connector — scaling is additive, not a re-architecture.
When it makes sense, NOOSH connects clients to resources over direct, encrypted peer-to-peer tunnels — keeping traffic on the shortest path for low latency and high throughput, without hauling every packet through a central concentrator. It is built on a proven, widely deployed open-source tunneling protocol, so the data plane is battle-tested rather than bespoke.
Not every situation allows installing software — a contractor's laptop, a locked-down kiosk, a quick check from an unmanaged device. For those, NOOSH offers clientless access straight from a web browser, with the same identity verification and per-application scoping. Native client apps are available for macOS, iOS, Windows, Linux, and Android when you want them.
NOOSH presents a single, consistent way to reach resources wherever they live — in a data center, across cloud providers, or out at the edge on a remote site. The same identity model, the same policies, and the same monitoring follow the resource, so distributed infrastructure stops feeling like a patchwork of disconnected access methods.
NOOSH is open-source and built on an established open-source tunneling protocol. You can read the code, audit the data path, and run the whole thing yourself — no black box at the center of your network. That openness is also why it has spread: more than a million deployments worldwide and a substantial open-source community stand behind it.
NOOSH is made for IT, operational technology, the Internet of Things, and engineering — the places where remote access has to be both effortless and tightly controlled. Same identity model, very different machines on the other end.
Internal web apps, servers, databases, and admin consoles — reachable by the right people, on the right terms, without dropping anyone onto the corporate LAN.
PLCs, SCADA, HMIs, and plant-floor controllers that were never meant to face the open network — kept isolated, reached only by verified identity for maintenance and support.
Fleets of constrained, numerous, and often unattended devices in the field. Provision and reach them at scale — without standing them up with public IPs or open ports.
Labs, test benches, build infrastructure, and remote hardware that engineers need hands-on, from anywhere — with access scoped to the bench, not the building.
Why teams switch
Less exposure.
Less friction.
A VPN trades convenience for a wide-open blast radius: one compromised credential can see the whole segment. NOOSH scopes access to a single application, so a breach of one path never becomes a tour of the network. And because there is no concentrator to route through and no client to babysit, the day-to-day drag of legacy remote access simply goes away.
Verify at every step.
Authorization is not a one-time event at login. NOOSH evaluates identity and context at each step of a connection, so access keeps reflecting reality — the person, the device, and the conditions as they are now, not as they were when the session began.
Adoption at this scale is the natural result of an open-source core, a widely used underlying tunneling protocol, clients across every major desktop and mobile platform, and the freedom to run it as a managed cloud service or fully self-hosted. It is the basis for adopting identity-based access across diverse infrastructure — while keeping control and visibility in your hands.
Recently shipped
The platform iterates in the open. A few of the capabilities that have landed recently — each one widening where and how NOOSH can reach.
Publish internal HTTPS applications as private resources, reachable by verified identity — without exposing them to the public internet or terminating TLS where you don't want it.
Route traffic intelligently across multiple sites and connectors, so distributed environments are reached over sensible paths and a single site is never a bottleneck.
Get notified when it matters — connector and access events surface as alerts, so operators learn about a change in posture from the platform instead of from a user complaint.
Define edge deployments as templates and roll them out repeatably across many sites — turning what used to be careful, one-off setup into a consistent, push-button process.
The platform
Provision connectors, publish applications, write identity- and context-aware policies, watch live sessions, and audit every decision — from a single place. A look at the operations console.
An illustrative preview of the operations console — figures shown are example data.
| Identity / group | Application | Condition | Action |
|---|---|---|---|
| Platform engineers | git.internal | Managed device | Allow |
| On-call SRE | grafana.ops | Any device · business hours | Allow |
| Field technicians | plc-07.plant-b | Managed device · step-up | Require MFA |
| Vendor — ACME | hmi.line-3 | Time-boxed window | Require MFA |
| Everyone else | * · all resources | Default | Deny |
| Connector | Site | Resources | Status |
|---|---|---|---|
| dc-east-01 | Data center — East | 21 | Online |
| cloud-prod | Cloud — Production VPC | 34 | Online |
| plant-b-edge | Plant B — Edge | 9 | Online |
| lab-bench-3 | Engineering lab | 6 | Degraded |
| site-ridge | Remote site — Ridge | 3 | Online |
How you run it
Run NOOSH as a fully managed cloud service, or self-host the whole thing on your own infrastructure. Same platform, same model — you choose where the control plane lives.
We run and operate the control plane. You deploy connectors, publish resources, and write policy — and skip the work of standing up and maintaining the management layer yourself.
Run every component yourself, on your own infrastructure. Because NOOSH is open-source, you can inspect it, host it air-gapped, and keep the entire access path under your own roof.
Native apps + clientless browser
Open-source core. NOOSH's core is open-source and built on an established open-source tunneling protocol — the foundation for adopting it across diverse infrastructure while keeping identity-based control and monitoring in your hands. The combination is why it has reached more than a million deployments worldwide.
Get in touch
Tell us about your environment and how your teams need to reach it. We'll help you map identity-based access onto your infrastructure — and figure out whether managed cloud or self-hosted is the right fit.
Thanks — we've opened a pre-filled email to our team in your mail app. If nothing appeared, just write to hello@nooshsuite.com and we'll take it from there.