--- title: "Frazer Access and VPN: private access for people, devices and agents · Frazer" description: "One private network per organization for laptops, phones, agents, devboxes, VMs, clusters and VPCs, over WireGuard with post-quantum keys, with access rendered from IAM, relays run by Frazer, and HA VPN for your office." url: https://frazer.ai/network/access index: https://frazer.ai/llms.txt tokens: 2570 --- > For agents: every page on frazer.ai is indexed at https://frazer.ai/llms.txt. # Frazer Access and VPN: private access for people, devices and agents · Frazer **Frazer Access and VPN** frazer.ai # A private network for your whole team. Access from IAM. No bastion host. Frazer Access connects your people's laptops and phones, and your agents, to devboxes, VMs, clusters and VPCs over WireGuard, peer to peer. Who reaches what is rendered from IAM, so ssh to a box or psql to a private database works from a laptop, and removing a person ends their access in one operation. HA VPN brings your office onto the same networks. [Connect a device](https://frazer.ai/start?product=mesh) [Read the docs](https://frazer.ai/docs) ``` $ frazer access connect Signed in to Acme as lena@acme.example ✓ lena-mbp connected to Acme's private network 100.88.0.4 · fd3a:91c2:5e07::4 DNS lena-mbp-acme.access.frazer.run, *.acme-production.internal $ ssh oncall-1 $ psql -h storefront.db.acme-production.internal ``` ``` # Nothing else on this laptop: the frazer CLI carries its own # client (userspace, no root, no system extension) $ frazer ssh jump-1 $ frazer devboxes ssh lena-api $ frazer databases connect orders --role readonly ``` ``` $ frazer network vpn-tunnels create office --gateway vint-hill \ --peer-ip 203.0.113.7 --ike-psk-from-secret office-psk --bgp-asn 65010 office-sf-0 IPsec IKEv2 if 0 Established BGP up office-sf-1 IPsec IKEv2 if 1 Established BGP up Learned 192.168.40.0/22 from AS 65010 Advertised 10.20.0.0/20, 10.20.17.0/24 ``` 01 · How it works Fig. 1 ## One network per organization. Peer to peer, with rules from IAM. Frazer runs the control plane in your organization's cell. It hands every device and resource its keys, its policy and its names, and then they talk to each other directly over WireGuard. Relays run by Frazer carry traffic only when no direct path exists. **Fig. 1** One private network: people, resources and networks, with the control path dashed 02 · Access Fig. 2 ## Access comes from IAM. Never from hand-written rules. Frazer renders the access policy from your organization's members, groups and role bindings, and tests it in the plan. When a role changes, the policy changes with it. Members → users who sign in with Frazer Groups → `group:` entries Resources → tags: `tag:devbox-…`, `tag:vm-…`, `tag:cluster-…`, `tag:vpcgw-…` Role bindings → grants: `devbox.user` reaches only your own boxes, `cluster.viewer` only the API port ### Leaving the organization, in one operation 1. Membership ends 2. Devices deleted 3. Keys expired 4. Policy re-rendered 5. SSH certificates revoked 6. Boxes stopped ``` // Rendered from IAM · revision 37 // Change roles, groups or AccessPolicy, never this file { "groups": { "group:acme-oncall": ["lena@acme.example", "kenji@acme.example"] }, "grants": [ // devbox.user: only your own boxes {"src": ["lena@acme.example"], "dst": ["tag:devbox-lena-api"], "ip": ["*"]}, // database.client: endpoint storefront {"src": ["group:acme-oncall"], "dst": ["10.20.4.10/32"], "ip": ["tcp:5432"]} ], "autoApprovers": { "routes": {"10.20.0.0/20": ["tag:vpcgw-acme-prod-vpc"]} }, "tests": [{"src": "amara@acme.example", "deny": ["10.20.4.10:5432"]}] } ``` *The Frazer Access page of the demo organization Acme in the Frazer console: a control plane run by Frazer in the organization's cell, a policy rendered from IAM, and 11 devices and nodes. 5 are people's laptops and phones with an owner and a key that expires (1 expired and cut off); 6 are devboxes, a VM, a VPC attachment, an exit and a CI runner, connected directly or approved automatically; 1 device with no direct path goes through a Frazer relay.* **Fig. 2** Devices and nodes: people's devices expire, resources' nodes do not product UI, demo organization 03 · Which way in ## Pick the path by what you reach. Frazer Access for people, VPN for offices. Which connection reaches what, from where | To reach | From | Use | How it works | | --- | --- | --- | --- | | A devbox, VM or cluster API | A laptop or phone | **Frazer Access** | WireGuard, peer to peer. Who reaches what comes from IAM roles; a relay carries the traffic only when no direct path exists. | | A whole VPC network | A laptop | **VPC attachment** | An HA pair of gateways in the network advertises its subnets, and split DNS sends `*.internal` names to the network's resolver. | | Your VPC | Your office network | **HA VPN** | Two gateways per site with two public addresses, IPsec IKEv2 to your router and BGP over every tunnel. WireGuard as a second option. | | The internet, from a fixed address | A laptop | **Exit** | A Frazer regional exit with a static IP for your organization, or an exit you run. | | Your servers, to manage them | Frazer's control plane | **Frazer Link** | Not Frazer Access. A hub-and-spoke path that Frazer alone configures, which works before any member exists and never depends on Frazer Access. | 04 · What you get ## A private network, run for you. Ruled by your roles. - ### Names, not addresses Devices, boxes, VMs and clusters by short name and under access.frazer.run; `*.internal` names resolve through the network's VPC attachment. - ### VPC attachments A VPC attachment puts an HA pair of gateways in a network. Overlapping ranges are refused at plan time. - ### One SSH authority Short-lived certificates from your organization's SSH CA, for people and agents alike. - ### Nothing to install The frazer CLI carries its own client, in userspace without root, and works next to another company's VPN. - ### Relays and exits Relays carry only encrypted packets, and only when no direct path exists. Regional exits give a static IP per organization, or you run your own. - ### Post-quantum on every connection Every handshake mixes an ML-KEM-768 key exchange with X25519, end to end, and session keys rotate every two minutes. - ### Works on any network IPv6 first, so carrier-grade NAT, satellite internet and IPv6-only Wi-Fi need no settings. - ### Phones, agents and CI runners Phones connect with the Frazer app; agent sessions and CI runners join as their own nodes under the same rules. 05 · Controls ## Who reaches what. With the defaults written down. ### Who may do what Members Join a device with Frazer sign-in. A device reaches only what its owner's roles grant. devbox.user Reaches only the person's own boxes. cluster.viewer Reaches only the cluster's API port. AccessPolicy Rules beyond IAM, kept as a resource with tests that run in every plan. Gateways Approved automatically by their tag; a range that overlaps another attached network is refused. ### What is logged - Every connection to a box, with the person, the device and the path. - Every policy revision, rendered from IAM the same way every time, with drift recorded. - Firewall, route and peering changes, each through a plan and an approval. - Offboarding as one operation, from membership to stopped boxes. ### At the cap - Free for members' devices and Frazer resources. - A Frazer exit node costs $5 a month with its static IPv4; relay traffic has no meter. - No per-GB network fees. VPN is included within fair use. - A control-plane outage or a bad policy edit never cuts Frazer's management path to your servers. 06 · Pricing ## Free for your people. No per-GB fees. Frazer Access costs nothing for members' devices and Frazer resources, and HA VPN is included within fair use. A Frazer exit node, with a static address of its own, has one monthly price. [See every price](https://frazer.ai/pricing#lines) Members' devices **Included**: no fee per user or per device Boxes, VMs, routers **Free** as nodes HA VPN **Included** within fair use Exits and relays Frazer exit node: $5 / month, static IPv4 included · relay traffic within fair use; your own exits are free Relay fair use 1 TB per organization a month, with no meter Per-GB fees **None** Questions ## Frazer Access and VPN, answered. Do people have to install anything? No. The Frazer app's Connect switch covers the whole laptop, and so does nothing at all: the frazer CLI carries its own client, so `frazer ssh`, port forwarding, database connections and kubectl to private clusters run in userspace without root. It also works next to another company's VPN. Who runs the control plane and the relays? Frazer does. The control plane runs in your organization's cell, upgraded in rings and backed up. Relays are Frazer's own, in every region; they see only encrypted packets, and Frazer never sends your traffic through a third party's public relays. What happens when someone leaves? One operation. Their membership ends, their devices are deleted, their keys expire, the policy is re-rendered, their SSH certificates are revoked and their boxes stop. Is Frazer Access how Frazer reaches my servers? No. Frazer manages your servers over Frazer Link, a separate hub-and-spoke path that works before any member exists. Both use WireGuard and share nothing else, so a Frazer Access outage or a bad policy edit never cuts management. Is Frazer Access post-quantum? Yes, by default. Every handshake mixes an ML-KEM-768 key exchange with X25519, so traffic recorded today stays private if quantum computers break X25519 later. Organizations that need FIPS 140-3 validated cryptography turn on the FIPS profile, an organization policy. Can I connect my office network? Yes. HA VPN runs two gateways per site with two public addresses, IPsec IKEv2 to your router and BGP over every tunnel, with WireGuard as a second option. At your own sites, an existing VLAN can also join a network as a [VLAN attachment](https://frazer.ai/network). ## More in Network - [**VPC and firewall** Subnets, rules, NAT](https://frazer.ai/network) - [**Load balancers** L4 and L7, TLS included](https://frazer.ai/network/gateways) - [**DNS and certificates** Zones and automatic TLS](https://frazer.ai/network/dns) ## Connect a laptop in one command. Remove a person in one operation. [Connect a device](https://frazer.ai/start?product=mesh) [Read the docs](https://frazer.ai/docs)