The same process works if you want to give remote employees access to cloud storage or applications. Or, if your cloud app allows IP allowlisting, you can enter your dedicated IP address in NordLayer.
Admins can monitor user activity through the NordLayer dashboard. You can see a list of recent connections and which actions each user took while connected.
Admins can choose how users log into NordLayer. An email and password combination is the default, but NordLayer also supports:
- Two-factor authentication
- Single sign-on (SSO) through Google, Azure AD, Okta, and OneLogin
- SCIM provisioning with Azure AD and Okta
- Biometric verification
You can take advantage of shared servers or spin up dedicated servers in any of the following countries:
- US
- Canada
- Mexico
- Ireland
- Portugal
- United Kingdom
- Spain
- France
- Netherlands
- Belgium
- Norway
- Denmark
- Germany
- Sweden
- Switzerland
- Italy
- Czech Republic
- Finland
- Austria
- Slovakia
- Poland
- Croatia
- Hungary
- Serbia
- Bulgaria
- Romania
- Turkey
- Israel
- Japan
- United Arab Emirates
- Hong Kong
- Singapore
- Australia
If you’re annoyed by the fact that the above list isn’t ordered alphabetically, you should know that this is the order in which countries appear in the client app, as a user in the US, with no option to sort them otherwise. More on those endpoint device apps next…
Client apps: What devices work with NordLayer?
NordLayer makes client apps for the following operating systems:
- Windows
- MacOS
- Android
- iOS
- Linux
The desktop apps can be downloaded from NordLayer’s website, and the mobile apps are available from their respective official app stores.
The Linux app comes in .deb and .rpm file types and, unlike the other four, doesn’t have a graphic user interface (GUI). Instead, it runs from the command line.
The SWG browser extension, once set up with your gateway, will make your browser connection work as if you were connected through the NordLayer native app. It’s available for Edge, Firefox, and Chrome, but only if you subscribe to the more expensive plan.
The overall app design is simple and easy to use. On desktop, it displays as a panel on the right-hand side of your screen. Changes made by the administrator immediately take effect in the client apps without needing to restart them.
As an endpoint user, you can add trusted wifi networks to a list. By default, you won’t be automatically connected to the VPN when using these, though the apps can be set to auto-connect when using untrusted wifi or when the app launches.
A kill switch can be toggled on in the app. When enabled, the kill switch will halt all internet traffic whenever the VPN connection drops out. Unlike the NordVPN app, the kill switch is system-wide and not app-specific.
One small complaint as a desktop user is that I must open the app to know if I’m connected to NordLayer. The system tray icon always looks the same, so I can’t discern whether I’m connected at a glance. The mobile app puts an icon in the status bar, so it doesn’t have this problem.
NordLayer security
NordLayer is chock-full of security features tailored to small and medium-sized businesses where employees constantly access company resources remotely from multiple devices. It keeps track of and protects all endpoint devices at once.
NordLayer’s security features include:
- Network access management sets permissions and security policies for users and apps to ensure only authorized staff can reach sensitive and confidential data.
- Network segmentation lets admins create teams and private gateways, each with a dedicated IP address. This lets you segment your local networks and restrict certain data to those who really need it.
- Zero Trust Network Access (ZTNA) is a “never trust, always verify” approach to network access. Authentication is required prior to access being granted.
- Cloud access security brokers (CASBs) enforce security policies between cloud infrastructure and users, controlling access to critical resources.
- Secure web gateways (SWGs) enforces security policies to keep organizations compliant. NordLayer SWGs filter unwanted traffic through application control and data loss prevention (DLP) filters, among others.
- Firewall-as-a-service (FWaaS) is a layer of security for a cloud-based network perimeter that detects unauthorized attempts to gain access.
- ThreatBlock automatically restricts untrusted websites and users to protect your users from malware, ransomware, and viruses. Threatblock can be disabled in the client app.
- Jailbroken device detection detects devices that are vulnerable to attack and alerts admins immediately.
- Automatic provisioning maintains and removes user identities as their statuses or roles change.
- Single sign-on (SSO) allows you to use one set of security credentials to access your multiple cloud applications.
- Biometrics authenticate users based on fingerprint scanning and face recognition.
- All traffic in transit is protected using 256-bit AES data channel encryption.
NordLayer integrates with platforms such as AWS and Azure.
NordLayer leaks DNS and IPv6
Unfortunately, NordLayer suffers from a few leaks as of time of writing. First, it fails to tunnel all IPv6 traffic, which means your IPv6 address and traffic will leak outside the VPN tunnel if you don’t disable IPv6 altogether in your end users’ device settings. In the screenshot below, you can see that the IPv6 address is not changed or hidden while connected to NordLayer on Windows:
Even though NordLayer doesn’t support IPv6, it should still have an option to toggle it off and prevent leaks in the client app settings.
It also suffers from DNS leaks on both IPv4 and IPv6. As a result, your ISP or other snoops on your network can track which apps and websites clients use, or which networks they try to access. The screenshots below show that my ISP’s DNS servers were still visible while connected to NordLayer.
These leaks are especially disappointing considering Nord’s consumer VPN doesn’t suffer from them. Given time, I think these problems will be fixed. I’ll update this review when they are.
NordLayer SASE and SD-WAN explained
SASE, or Secure Access Service Edge, combines SD-WAN and network security point solutions (FWaaS, CASB, SWG, and ZTNA) into a single cloud-based service.
SD-WAN stands for software-defined wide area networking. It’s a cloud-based approach to connecting offices in multiple locations. It allows administrators to separate traffic based on security level, authorization, and quality of service (QoS) settings. Compared to a VPN, SD-WAN benefits from lower latency and has some security failovers that VPNs do not.
SD-WAN requires less maintenance and expertise than a VPN, and is easier to scale up. Because of this, SD-WAN is better for work-from-home employees than traditional VPNs. SD-WANs channel traffic across cloud-compatible WANs for optimal application performance. Connections can be made over LTE, 4G, and MPLS, among others.
By default, SD-WAN doesn’t come with any security or access control. In the past, businesses had to set up their own, unwieldy network of gateways and firewalls. Enter SASE.
SASE, or Secure Access Service Edge, is a model for implementing SD-WAN that gives enterprises a single, centralized view of the entire network, allowing for easy management. It combines SD-WAN with ZTNA and the other security features listed above into a single, manageable solution. NordLayer gives admins the ability to manage their SASE entirely through a web dashboard.
NordLayer “Advanced” features
NordLayer’s Advanced plan allows admins to request several network, security, and access control upgrades as needed. These include:
- Site-to-site VPN that securely connects your business’ local network to the cloud or other on-premises resources via a dedicated server
- SWG browser extensions are available for Edge, Firefox, and Chrome browsers. They enable access to SaaS platforms via a web browser. Once SWG is set up with your gateway, your browser connection works as if you were connected through the NordLayer native app.
- DPI Lite looks for certain patterns in headers, ports, protocols, IP addresses, et cetera in users’ traffic. Based on database matches, it blocks selected categories. Admins can choose from about 250 categories ranging from Apple Push notifications to WhatsApp messages.
- Custom DNS lets you set your own nameservers instead of Nord’s default DNS servers
- DNS filtering blocks websites and hostnames belonging to a specific content category
All of these features need to be requested from the NordLayer dashboard and can take up to 24 hours to be enabled.
Gateways can be enabled with Smart remote access, a feature that lets two users connect endpoint to endpoint when they are connected to the same server. Additionally, it gives users the ability to see each others’ endpoints even if they are not in the same local network.
Speed: Is NordLayer fast?
Using shared gateways, NordLayer’s average speed when downloading from the web measured 382 Mbps in our tests. Its speeds are similar to NordVPN, but Nord assures us that the server infrastructure for NordLayer is completely separate from its consumer VPN service.
Here are the average speeds for each region:
- North America (nearest): 355 Mbps
- Europe: 442 Mbps
- Asia: 349 Mbps
All our tests were run using the NordLynx protocol, which is a fork of the open-source Wireguard protocol. NordLynx offers the fastest speeds of all the available protocols, which include IKEv2 and OpenVPN.
As for dedicated gateways used exclusively by your team, both the Basic and Advanced plans give you access to 1 Gbps servers. You can get up to 10 Gbps servers with a custom plan. More on those plans below.
Price and billing
NordLayer offers three plans:
- Basic costs $7 per user per month or $84 per year
- Advanced costs $9 per user per month or $108 per year
- Custom plans vary in cost and are negotiated directly with Nord
The basic plan gets you 1 Gbps servers, shared gateways in more than 30 countries, and unlimited data. This plan essentially gives your staff members access to NordLayer’s shared gateways.
For most organizations, I recommend the advanced plan with at least one dedicated server. This will let you set up a private gateway to remotely access your organization’s internal resources, whether they exist locally or on the cloud.
The advanced and custom plans add:
- Site-to-site interconnectivity
- SWG browser extension
- Smart remote access (cloud LAN)
- Network segmentation
- Unlimited gateways and teams
- Custom DNS
- DNS filtering
- Deep packet inspection (DPI Lite)
- A dedicated account manager
Bear in mind that private gateways require dedicated servers. If you need a private gateway, dedicated servers are only available on the Advanced and custom plans, and cost an additional $40 per month per server. Most organizations will probably want at least one dedicated server.
You can choose whether your organization is billed monthly or once per year, with the annual plans costing less (up to 22% discount as of time of writing).
User licenses are transferable. If you let go of one employee and hire another, the departing employee’s account can be transferred to the new employee. Charges for any additional licenses will be prorated based on your initial contract with NordLayer. That makes it easy to scale up, but bear in mind there’s no further discount as you add more licenses unless you can negotiate it on a custom plan.
You can book a demo if you’d like to try NordLayer in advance.
Customer support
NordLayer support is available 24/7 via email or live chat on its website. I posed a couple of questions to the live chat support regarding IPv6 and access from China. An agent responded immediately. Although curt, their answers were prompt and satisfactory.