Nexaplane networking
The network is
part of the product.
Every customer gets real routers of their own, VPN in one click and one network across sites — provisioned automatically, isolated from everyone else.
Tenant routers
Every tenant gets
their own real routers.
Not a shared gateway with rules bolted on. Each tenant runs as many routers as its network needs, with the protocols an engineer expects — and none of the weight of Neutron or NSX.
One tenant. All of it provisioned when they click Create.
Routing customers run themselves
A tenant network reaches whatever it needs to, with the protocols to do it and no ticket to you.
- BGP and OSPF — peer a tenant network with real upstream routing
- Dual-stack IPv4/IPv6 — v6 firewalling and peering included
- Automatic VLAN and subnet allocation — no spreadsheet, no collisions
Isolation you don’t have to configure
Each tenant lands on its own VLAN, behind its own router. Neighbours can’t reach each other — they never share a wire.
- Stateful firewall — per tenant, enforced at their edge
- Security groups — reusable rule sets applied to instances
- Port forwarding — expose exactly what they mean to expose
IPv6 wherever IPv4 is
Routing, firewalling, peering and address pools, in both families. Designed in from the start.
Load balancing included
L4 and L7, with TLS termination, health checks and sticky sessions, on an appliance of its own so web traffic never starves routing. HTTPS certificates renew themselves.
Every address in one place
Public IPv4 and IPv6 pools, per-tenant allocation, DHCP reservations and port forwarding, tracked together.
A machine fails. Nobody notices.
One switch runs a customer’s router or load balancer on two separate machines. If one goes down, the other carries on within seconds — sites stay up and VPNs stay connected.
- Sell it as uptime — a line on your price list, not an engineering project
- Nothing changes for the customer — no downtime, no new addresses, nothing to reconfigure
- No second address — a protected pair doesn’t use a second public IP
VPN and interconnect
VPN in one click.
Not one ticket.
Remote staff, a branch office, a second datacenter: each usually means keys emailed around, routes edited by hand and an engineer on the call. Nexaplane terminates them all on the router the tenant already has.
No concentrator to buy. No tunnel to configure by hand.
Client VPN anyone can enrol in
Grant access and the person gets a working profile, not a config file and a phone call. WireGuard for speed, IKEv2 for the devices that need it.
- One-time enrolment links — no keys pasted into email
- Per-user access control — reach only what that person should
- Full or split tunnel, per user
- Rotate or revoke instantly when someone leaves
Interconnect in a single click
Two of a tenant’s routers in different datacenters. Toggle the pair on and they connect — the platform generates the keys, builds the tunnel and programs both sides.
- Routes follow the network — add a subnet and the far side learns it
- Conflicts flagged first — overlapping ranges surface before they break routing
- Encrypted by default — WireGuard, with key handling out of your hands
- Reversible — toggle it off and both sides clean up
With NuajProtect
Filter the same edge
NuajProtect filters the router that terminates these tunnels. Sold separately, on its own subscription, and resold at your margin.
Toggle the pair on. Routes on both sides update themselves — and keep updating when the subnets change.
Multi-datacenter
One tenant.
Many sites.
Customers who grow past one location are the ones worth keeping. A second site is a toggle, not a project.
See it on your own fabric.
Bring a Proxmox cluster and we will show you a tenant, a network, a router and a running instance — in the same call.
Launching 2027 · Early partners get direct input on the roadmap