Tailscale

Tailscale creates a private network between your devices, servers and cloud resources using the WireGuard protocol. Each machine runs a small client and signs in with your existing identity provider, and Tailscale coordinates the encrypted connections so devices can reach each other directly, even behind NAT.

IT teams use it to replace a traditional VPN for reaching internal tools, to give administrators access to servers without opening ports, and to connect sites or cloud networks. Access rules are written as a policy file that says which users and groups can reach which machines and ports.

It fits technical teams comfortable writing access policies. Check how it logs connections for your audits, how you will manage keys on servers, and whether you need its subnet routers to reach devices that cannot run the client.