PureDome is a capable business VPN from the people behind PureVPN, one of the most experienced consumer VPN providers around.

Signing up gets you all the benefits of PureVPN: easy-to-use Windows, Mac, Android and iOS apps; a vast network of thousands of servers spread across 60+ countries; WireGuard support for maximum speeds, a kill switch to protect you if the VPN drops, and plenty more.

But PureDome adds business-friendly security, remote access and team management tools of its own. You can control who uses the service, and what they can do; Single Sign On support allows your team to access the VPN using their existing credentials; you can enforce your preferred VPN settings on users for maximum security, and even prevent users accessing the VPN unless, say, they're running your preferred antivirus. 

In this review, we'll take an in-depth look at the VPN, its apps, speed and security, and especially its high-end business features.

But if you're mostly interested in PureVPN and its consumer features, you'll find more details on this in our full PureVPN review.

Plans and pricing 

PureDome is fairly priced for monthly billing at $8.45 per user billed monthly, but this only drops to a relatively high $6.74 on the annual plan.

There's also a potential catch. PureDome has a minimum subscription of five team members, which means the least you can pay is $42.25 billed monthly, or $33.70 on the annual plan.

You can add a dedicated IP for $84 per month, but this can only be assigned to one of your users. 

If you need a unique and static IP for all your users, you'll need to spend a chunky $600 per month for a dedicated gateway (essentially, your own VPN server.)

Payments are accepted via card or PayPal.

PureDome is more expensive than some of the competition, but there is some positive news. Although PureDome asked for our payment details when we signed up, it doesn't charge until the end of the billing period. That effectively means there's a free 30 day trial, and as long as you cancel before that time is up, you won't be billed.

PureDome apps

Business VPN apps are often underpowered, and with a range of usability issues. That's no surprise: business VPN providers might know how to create site-to-site network connections through every possible type of firewall, but developing quality apps requires very different skills, and it's often not a priority.

PureDome is a little different, because its apps are essentially based on PureVPN's range. That means a wide choice of platforms, with downloads for Windows, Mac, Android, iOS, Linux, even Chrome support. They include all the features you'd expect from a consumer VPN - WireGuard, IKEv2 and OpenVPN protocol support, a kill switch, split tunneling, location favorites and more - and yet they're also easy to use, even for the least experienced of users.

Our in-depth tests did highlight a DNS issue. When we connected using WireGuard or IKEv2 on Windows, our checks showed no DNS leaks, with PureDome using its own DNS server to resolve queries. But when we connected using OpenVPN, PureDome appeared to use Google DNS, which means information about your browsing is leaking outside of the tunnel. This probably won't have any practical effect (Google already has far better ways to track people than analysing DNS queries), but it is still a privacy concern.

PureDome's apps scored elsewhere, though. The Windows app kill switch correctly blocked our internet access, for instance, whenever we forcibly closed its VPN connection. That already outperforms many competitors (UTunnel VPN's Windows app doesn't have a kill switch at all.) 

There's another welcome plus in PureDome's new support for Single Sign On. That's good news, as it allows users to sign in with existing credentials, rather than create yet another account for PureDome. The service only supports Okta and Microsoft Azure AD right now, but the feature has only just arrived; hopefully Google and others will land soon.

PureDome User control 

PureDome makes it unusually easy to give your team members access to the VPN. Tap a button, enter an email address, and you can send an invite with a click. Or if you've a big team, you can even import the full list in a CSV file, and send them all at once.

As usual, you're able to assign each user a Role which defines what they can do on PureDome. For example, by default, users are assigned the role Member, which allows them to use the PureDome app but nothing else. But you can also give them other roles which might allow them to, say, change your billing details, add or remove members or tweak network settings.

PureDome also supports organising users into separate teams: Sales, Accounts, Engineering, whatever works for your business structure. This allows you to restrict each team to its own gateway (Sales can't access the Accounts systems, say), and you can also apply different VPN access rules to each team (more on this below.)

While this all works as advertised, it's a little limited. We found PureDome couldn't show us which users were connected to the service right now, for instance. There's no connection history, and no information on the devices they use. PureDome is working hard on adding new features, and we've no doubt this will improve over time, but right now, at least, it doesn't have anything like the user control and logging options of the competition.

App settings control 

As we've discussed above, PureDome's apps have all the most essential VPN settings. You can set an app to load and optionally connect when your device starts; choose your preferred protocol, enable the kill switch, show connection notifications, and more. 

We've seen more configurable apps, but PureDome has a handy plus: you can enforce particular settings on your users. 

If you want your team to leave the kill switch enabled for security, for instance, all you can do with most VPNs is send a group email and ask them nicely. But with PureDome, you can enable the kill switch, set your preferred protocol or whatever other settings you need, then enforce these settings on some or all of your users.

We set up some preferred app settings, then imposed them on our test MacBook, and tried a few tests on the app to see what happened.

The results were positive. We were able to force some or all of our users to keep their kill switch enabled, for instance, ensuring they always had the best possible security. That's a very welcome feature that we rarely see elsewhere, even with some major business VPN names.

Device control 

PureDome includes a feature called Posture Check. This allows you to block or allow access to the VPN, depending on how the user's device is set up.

If users connect with Windows devices, for instance, you can choose to only allow access if they have your preferred antivirus, or a certain certificate installed; if it's using your preferred versions of Windows; if it has disk encryption enabled; if a particular file or Registry key exists, or a certain Registry key.

Mac users get almost the same level of control, but Android and iOS are far more basic. You can block rooted devices, but that's about it.

We were pleased to see that Posture Checks can run both when a user logs on, and at regular intervals (every 20, 40 or 60 minutes.) This makes it more difficult for users who might run a must-have program to connect to the VPN, but then close it down.

This system doesn't always work as well as we hoped. PureDome's Antivirus test can only check if the device is running one of an internal list of 11 antivirus tools, for instance. This excludes a lot of big names, so if you're running Avira, F-Secure, G-Data, Panda or Trend Micro, for instance, Posture Check won't be able to confirm that they're installed.

Still, PureDome says the Posture Check feature is in beta right now, so perhaps this will be addressed soon. Even right now, Posture Check gives you some useful ways to protect your server from dubious devices, and overall, it's a welcome plus for PureDome.

How fast is PureDome? 

We measured PureDome's performance by running multiple tests on several top speed test sites and apps, including SpeedTest.net, Measurement Lab and Cloudflare.

We ran our tests from a UK cloud PC with a speedy 1Gbps connection, giving us plenty of room to see what PureDome could do.

The results were very acceptable, with PureDome averaging 610Mbps on WireGuard connections. We've seen faster VPNs - NordVPN, Surfshark, Hide.me and others reached 950Mbps and more in recent tests - but, realistically, PureDome has more than enough speed for most networks, devices and applications.

Netflix and unblocking 

Like most serious business VPNs, PureDome largely avoids talking about common consumer features, such as its ability to unblock Netflix and other streaming sites. With some providers that's because they can't unblock anything at all, but is that the case here?

To find out, we checked PureDome's unblocking performance with eight streaming platforms, using locations around the world.

Netflix results were excellent, with PureDome getting us access to content in the US, UK, Australia, Canada and Japan.

The service couldn't get us into Disney Plus, but it worked with Amazon Prime, and successfully unblocked our other test platforms: BBC iPlayer, ITV and Channel 4 in the UK, and Australia's 9Now and 10Play.

That's a great unblocking result, but it could be a positive indicator in other areas, too. If streaming providers can't detect PureDome is a VPN, there's a chance that other websites will also miss it, and you'll see less 'click all the tiles containing a bicycle'-type CATCHAs.

Final verdict

Many business VPNs focus entirely on team management, permissions, auditing and high-level networking features, but forget about the usability basics. They'll have hugely powerful account management dashboards, but the most horribly basic apps.

PureDome is the opposite. It's based on the consumer service PureVPN, with its large network, decent apps and a good range of features. But it's a relative newcomer to business VPNs, and can't begin to match the best of the competition for management, access control or reporting tools.

This may not be a problem for everyone. If you're mostly looking for a VPN with easy team management, centralized billing and the ability to ensure everyone always has their kill switch on, then take PureDome's 30-day trial and see how it works for you.

But if you need fine-tuned user management, detailed audit reports or anything more advanced, we'd recommend looking elsewhere.

• Also check out our complete list of the best business VPNs

TunnelBear Teams is the business version of TunnelBear, a Canadian VPN best known for its extreme simplicity and ease of use.

TunnelBear is also well known for its lack of advanced features. If you need, say, leading-edge device management, layer after layer of access controls, and all kinds of network connectivity options, then TunnelBear Teams isn't for you. But if you're after something simpler, it's a very different story.

TunnelBear Teams is essentially the regular TunnelBear VPN product, with smarter user management. You can easily create a team, invite and manage your team members. Centralized billing helps to control your costs. And there are even potential savings to be made, with TunnelBear crediting you for any remaining team member's subscription time if they leave.

The simplicity of TunnelBear's apps is a particular plus, as it means all your colleagues should be able to use the service, no training required, even if they've no real technical expertise.

In this review we take a detailed look at TunnelBear Teams and everything it has to offer. We've plenty to say about the core VPN and its apps, too, but if you're mostly interested in TunnelBear's regular consumer service, check out our in-depth TunnelBear review.

TunnelBear VPN features 

TunnelBear isn't a very powerful or configurable VPN, but there's still a lot to like about the service.

The company has 5,000+ servers spread across 47+ countries, for instance. Many providers have far larger networks - ExpressVPN now supports 105+ countries - but TunnelBear probably has more than enough locations for most users.

The service has a decent set of apps covering Windows, Mac, Android and iOS. It has a strong range of browser extensions covering Chrome, Firefox and Edge, one area where it delivers more than most of the competition.

TunnelBear's apps don't have expert-level networking options (looking for an MTU tweak, anyone?), but they more than cover the basics. There's WireGuard support for maximum speeds (with OpenVPN as a fallback), a kill switch to protect you if the VPN drops, split tunneling to control which apps use the VPN, and a GhostBear obfuscation feature to help bypass VPN blocks and get you online.

Could these work for you? It's easy to find out, because unlike almost all of the competition, TunnelBear has a free plan. Sign up and you get 2GB of data every month, along with access to all locations and features. 2GB isn't much, but it's enough to try out the apps and get a feel for whether TunnelBear might suit your needs.

If you've gone shopping for VPNs before, you'll know how difficult it is to figure out whether a provider can be trusted. But the good news is that TunnelBear has made huge efforts to deal with that, by putting its entire infrastructure - apps, servers, website, more - through annual independent audits.

The not-so-good news is those audits have turned up plenty of problems in the past. But we have to applaud any VPN which puts itself through this level of scrutiny, each and every year. And even though the last report found a lot of issues, that does show the value of the process: the auditors really are digging deep, TunnelBear gets to fix problems before they're exploited, and the service is much safer as a result.

TunnelBear Teams prices

TunnelBear Teams has a surprisingly simple pricing scheme. Accounts are priced at $69 per year for each team member, there's a minimum of two members per team, and, well, that's it.

That's arguably taking simplicity a little too far. We'd like a monthly billing option, for instance, but TunnelBear offers annual plans only.

There are advantages in how TunnelBear handles team changes. If you remove a team member three months into your plan, for instance, TunnelBear credits you with the nine months service they didn't use. That's a welcome improvement on most consumer VPN accounts, where normally you won't get anything back if you stop using the service early. 

The system also makes it much easier to handle billing overall. Instead of employees buying plans themselves and claiming them back on expenses, you have a single centrally managed subscription which covers everyone. You can view your billing status at any time, and even download PDFs of previous invoices whenever necessary.

As we've discussed above, you can also try the regular TunnelBear VPN for free. This doesn't give you access to Teams' extra management tools, but it will allow you install the apps, test TunnelBear's features and sample speeds (up to a limit of 2GB data transfer a month.)

Managing team members 

The first step in setting up TunnelBear Teams is to add your team members to the service.

We found this very straightforward. Tap the Add button, enter an email address (or multiple addresses, separated by commas), and TunnelBear sends all the invitation emails you need with a click.

An optional Team Domain feature automatically adds members to your team if they sign up with an email address using your company domain (first.last@alwaysthesame.com.) That could make life easier, but there's also scope for problems. If an employee signs up for a personal TunnelBear account and happens to use their company email, they'll automatically be added to your team.

Every user is assigned a 'Role' which defines how they can use the service. Initially, users have the role of Member, which only allows them to use the VPN. But you can also assign users the Admin role, giving them the ability to add or remove users.

This all works as advertised. The Team Domain feature is an unusual extra which might benefit some, and there's no doubt TunnelBear Teams is very easy to use. But we think it's also very basic, and doesn't begin to match the abilities of the competition.

There's no two or multi-factor authentication, for instance, where users must enter a code sent by email or an authenticator app before they can log in.

The TunnelBear Teams dashboard shows you when a user has activated their account, but there's no other status information available. We couldn't see any way to find out whether they're currently connected, when they last connected, the devices they've used or anything else.

Most business VPNs have at least minimal logs, giving businesses an audit trail of important service events, but TunnelBear has nothing at all: no session records, no device details, not even a record of important admin events (when users are added and removed, when the billing details are changed, and so on.)

If you're running a small team, you're not so concerned about details like multi-factor authentication, then this might not matter at all. Everyone can sign in as usual with their passwords, and that could be enough.

But if you're looking for more central user management and control, there are better business VPNs around.

PureDome logs admin actions, and has excellent device controls. For instance, it can block desktop VPN access unless it's running an approved antivirus and some other must-have security software.

Perimeter 81 is vastly more complex than TunnelBear, but it also gives you hugely comprehensive control over who can use the VPN and who can't, and has detailed logs to help you track what's going on.

TunnelBear apps 

TunnelBear has apps for Windows, Mac, Android and iOS, as well as browser extensions for Chrome, Firefox and Edge.

These don't quite have the serious look of most business VPN apps. They're full of bear puns and animations, for instance (when we logged in and entered our password, a cartoon bear covered its eyes.) That won't be what everyone expects, but don't be fooled: beneath the bear-related humour, there's a serious and very capable VPN.

We saw this immediately from the feature list. Not only does this have a strong set of core features - a kill switch, WireGuard support, split tunneling, more - but they also proved very reliable during testing. We tried all kinds of low-level trickery to forcibly drop the VPN connection, for instance, but TunnelBear's kill switch stepped in every time, blocking our internet traffic and shielding use from snoopers.

There are unexpected technical bonuses just under the hood, too. For example, Encrypted Client Hello (ECH) is an advanced feature which prevents others spying on your initial website connections, and perhaps blocking VPN use. Many more powerful VPNs have said nothing about ECH, but TunnelBear began rolling it out in May 2023.

We're less convinced by the desktop app interface, which is mostly taken up with a huge world of TunnelBear locations. You can use this to connect, but it's just not very convenient. If the map is centered on your location in the US, say, and you want to use the map to connect to South Korea, you must click on the screen, then drag left to pan across Europe and the Middle East, before clicking on the country you need.

There is also a drop-down list of locations, which we found faster to use: click, scroll to the country you need, another click and you're done. But the app still spends a couple of extra seconds on the map, zooming in and recentering its view on your chosen location. It's not a big deal, but it just isn't necessary, and the more typical VPN app interface - a sortable text list of locations with a Favorites system - would be more efficient.

How fast is TunnelBear? 

TunnelBear now supports the ultra-efficient WireGuard protocol with all its apps, very good news if speeds are high on your VPN priority list.

We measure VPN performance by running repeated checks from an ultra-fast 1Gbps connection using the most accurate speed testing services: SpeedTest.net, the SpeedTest app, Measurement Lab, Cloudflare and more.

The results showed TunnelBear WireGuard connections reaching median download speeds of around 430Mbps.

In theory, that looks poor, because it's less than half the speed of our top five providers.

In real-world use, it's unlikely to matter to most users. If you're typically using a VPN over public Wi-Fi, or for normal internet tasks (browsing, email, messaging, streaming), then TunnelBear is likely to deliver all the speed you need.

Netflix and unblocking 

Unblocking streaming sites isn't normally high on the priority list for a business VPN, but it's still worth seeing what a service can do. If a VPN can avoid detection by streaming platforms, it's more likely to avoid detection elsewhere, which means you're less likely to see CAPTCHAs or other security alerts on any websites.

We assess VPN unblocking by checking multiple streaming platforms from locations around the world. TunnelBear got off to a bad start, and couldn't get us access to Disney Plus, Amazon Prime or Netflix in the US, UK, Australia, Canada and Japan. But it did have a handful of unblocking successes, including BBC iPlayer, ITV and Channel 4 in the UK, and 9Now in Australia. Not great, but we've seen much worse.

Next, we accessed ten general websites (not streaming) which also try to detect, restrict or block VPNs. TunnelBear allowed us to access six, a decent mid-range result.

You may see something different, of course, depending on the websites you visit. But if unblocking or CAPTCHA-avoidance is a priority for you, sign up for TunnelBear's free plan and you can try out the service before you buy.

Final verdict

If TunnelBear's ease of use matches your businesses VPN needs, then signing up for TunnelBear Teams keeps any admin to a minimum. You can add (or remove) accounts for every user you need from a single web console, see your current team setup at a glance, and you can pay for everyone with a single annual payment. It's the simplest setup around.

What TunnelBear Teams doesn't offer is any extra login functionality, device management or user access controls. If that's a problem, take a look at PureDome for a simple VPN with more security features, or check out Perimeter 81 for an array of business VPN security and management tools.

• Also check out our complete list of the best business VPNs

Tailscale is a capable business VPN which allows you to securely connect your devices, applications and employees, wherever they are in the world.

The service isn't a traditional VPN. Your devices don't route their traffic through Tailscale servers. Instead, Tailscale helps you create a zero-trust mesh network, where every device connects directly to each other via an encrypted WireGuard-based tunnel. That's much faster, and means you don't have to worry about Tailscale logging any of your activities.

The service has all kinds of applications. You could use Tailscale to connect remote and in-house teams, devices and shared resources into a single secure network. But it also works as a safe remote access method for shared resources. Another option is site-to-site networking, allowing you to transfer data between private cloud environments.

This looks impressive, but is Tailscale right for you? This review will look at its plans, features, ease of use and support to see if it lives up to expectations.

Plans and pricing 

Tailscale's free plan provides a risk-free way to try out the service. It limits you to three users, but you can connect up to 100 devices, there's email support if you need it, and it's only missing a few of the most advanced features (there's no logging of network traffic, for instance.)

Upgrading to the Starter plan supports unlimited users. You still get three users per free; each extra account costs $6 a month, and you get support for an extra 10 devices per user. That's fair value, and should be enough for most businesses.

The Premium plan is relatively expensive at $18 per user. This gets you 20x devices per user and Priority Support for faster response times, but otherwise it's mostly about high-end features for demanding users: fine-tuned access control, SSH authentication and encryption, more versatile user and device management, and more.

We browsed the plan comparison tables, and noticed one unexpected issue. Tailscale's free plan is so generous that it actually has more features than the Starter plan. Free users can restrict individual users from accessing a particular resource, for instance; Starter users can't. 

Sounds strange, but it does make sense: Tailscale sees the free plan as an advertisement for its full product, so it wants users to be able to try almost everything. But that won't help you if you've moved from Free to Starter just to get one extra user, and realise you've lost a feature you need. If that could be a problem, browse the Comparison table on Tailscale's Pricing page, and make sure you understand exactly what you're getting.

Tailscale integrations 

Tailscale is all about ease of use, and the service has 100+ integrations to make that happen.

SSO (Single Sign On) support allows you to authenticate with credentials from 20+ identity providers, for instance: Google, Microsoft Azure AD, Okta, Apple, GitHub. There's no need to create yet another account for Tailscale, just sign up with whatever you're using already.

Custom Windows, Mac, Android, iOS, Linux and Synology apps allow you to use Tailscale just about everywhere.

The service aims to automatically connect to your network, even when you're behind the best business firewalls. To make that happen, Tailscale already works with pfSense, OPNsense, Barracuda, Check Point, Cisco, Fortinet and more.

This isn't just about making that initial connection, though. Tailscale also supports directly connecting to the platforms you use already: AWS (VPC, EC2, Lightsail, more), Google Cloud (VPC, GCE, GKE, more), Microsoft Azure (VPC, all VMs, app services), DigitalOcean, Docker and LXC containers, resources running in Kubernetes, GitHub and more.

Supporting integrations allow you to, say, raise notifications via Slack, Discord or Google Chat. And if you decide you need the private browsing features of a conventional VPN, good news: Tailscale also gives you built-in support for accessing the excellent Mullvad.

Getting started

Click 'Get started' on most websites and you're launched into the usual 'give us your details, choose yet another password, verify your email' sequence. Tailscale's SSO support meant we could sign on immediately with Google, Microsoft, GitHub, Apple or OIDC credentials, though, no further work required.

The Tailscale web dashboard didn't make it obvious what we should do next. We opted to download and install the Windows app, though, and the process couldn't have been any more straightforward. We clicked the Tailscale app; it opened a page in a browser tab; we tapped Connect, and that got our first device connected to the service.

We repeated the process on our MacBook Pro, and Tailscale connected the devices in a couple of seconds. There's no big app interface to explore, no lists of locations, no need to choose protocols or anything else: Tailscale just works.

The Tailscale web dashboard on our Windows helpfully displayed the MacBook's IP address, and suggested we ping it. We did, and it worked as expected. Tailscale then supports using whatever other network software you like to access resources, share information or anything else you want to do. (We ran a LAN messaging tool and that worked, too.)

That's a great start, and enough to make Tailscale very useful all on its own, but the service has many other features to explore.

Features

Tailscale has a built-in file transfer feature called Taildrop. It's in alpha and currently only allows you to securely copy files between your own devices, but we were keen to see how it worked.

The feature was disabled by default on our MacBook for security reasons, but we enabled it in a click from the MacOS Extensions list. After that, transfers were as easy as right-clicking a file in Explorer, selecting 'Send with Tailscale' and choosing the target device. 

Taildrop transfers were fast and secure (thanks to WireGuard encryption), and moments later our files appeared in the MacBook's Downloads folder. Taildrop is a little short on settings - okay, there are none at all - but that's no surprise for an alpha, and it's already enough to be useful.

You can use Tailscale as a sort-of VPN by using exit nodes. Install Tailscale on a computer in your home or office, for instance, and you can configure it as an exit node. Then, when you next need to browse on unsecured WiFi, connect to Tailscale and choose your exit node. 

Just like using a conventional VPN, Tailscale routes all your internet traffic through a secure connection to your exit node computer, then sends it on to its destination. Speeds may not be great, depending on your exit node's connection, but it works, and you use this right now with Tailscale's free plan.

If you need VPN functionality but don't have devices in the locations you're after, there is another option. Tailscale allows users to set up Mullvad VPN locations as exit nodes, and you can connect to the VPN as required.

This does bump up your costs, to the tune of an extra $5 a month. But that's less than half the monthly price you'll pay with some VPNs. And better still, that $5 allows you to configure up to five of your devices as able to use Mullvad's servers as exit nodes. Even if you only set this up on a couple of devices, that's a really good deal.

Access controls

Creating a secure network isn't just about establishing encrypted tunnels. Tailscale also provides a stack of essential management features to control who can access the network, which devices they can use, and what, exactly, they can do.

You can invite new members by creating a one-time use link, then sending it via email, a messaging app or whatever route you prefer. By default they can log in and use Tailscale immediately, but you can add another layer of protection by requiring admin approval. (They can connect immediately, but not access other devices until an admin says it's okay.)

Users are assigned 'roles' which define exactly what they can do on Tailscale. By default new users are sensibly set at 'Members', which means they can access the network but not view or change any settings, but there are other roles available. Setting someone as 'IT Admin' allows them to add new users, for instance, and similar new management tasks, but not change any technical settings.

An extremely flexible Access Controls system allows you to organise your users into custom groups, if necessary ('sales', 'engineering', whatever fits), then control who can access which devices.

This has to be defined by editing a JSON configuration file, making it a little more complex than the rest of Tailscale. But the file has helpful comments, with examples, and in-depth articles on the Support site, and we figured the basics out within a few minutes.

It's a strong set of features which does a lot to keep you safe, but Tailscale does require some manual configuration to get the best results.

For example, because Tailscale allows users to log in via third-party identity provider accounts, it can't enforce multi-factor authentication. If your users all use a company Google account, that's not a problem: you can enforce logon rules there. But if they're using personal accounts, the best you can do is ask them to turn on MFA.

Although Android, iOS and macOS apps are updated automatically, we were surprised to see Linux and Windows devices require manual updates. You can use Tailscale's web dashboard to see devices which require updates, and alert the owners if they haven't spotted the issue, but the Windows app in particular really should be able to handle this itself.

Support

Tailscale doesn't offer many direct support routes. There's no live chat and no phone support. The company does offer email support, but only from 9am-6pm Monday to Friday US Eastern Time, and replies can take a while. (Issues classed as 'normal', such as a feature not working properly, might not get an initial response for two business days.)

Fortunately, there are other options for those in a hurry. Tailscale's excellent Knowledgebase is a great place to start, with its array of setup documents, How-To guides, FAQs and more advanced API and other references.

Although Tailscale closed its own web forum in the summer of 2023, you can still get support from other users via its subreddit. As we write, this has seven new posts in the past 24 hours, all of them with answers, and most replies arriving in under an hour.

Final Verdict

Tailscale is a top-notch VPN service which makes it easy to create your own private network, and gives you all kinds of access and other controls to keep it secure. Large or inexperienced teams might have an issue with the underpowered apps and limited support, but Tailscale could be ideal for small and medium-sized teams who know exactly what they're doing. Unsure? That's what the free plan is for: sign up and see for yourself. 

• Also check out our complete list of the best business VPNs

UTunnel is a capable business VPN which makes it easy to create and deploy your own VPN server and provide Zero Trust remote access to your company network and resources.

The service is largely focused on business users, with enterprise-friendly secure access control features such as Single Sign-On, Multi-Factor Authentication, team management and more.

But UTunnel is also so easy-to-use and affordable that it could appeal to more technical and demanding personal users, too.

How does UTunnel compare to the competition? We've signed up for an account, set up our own servers, installed both desktop and mobile apps, run multiple tests and dug deep into the results to see what's really going on. Read on to find out what we discovered, and if UTunnel is the business VPN for you.

Plans and pricing

UTunnel pricing starts with its Basic plan. This covers all the core VPN essentials, and costs from around $5-$25 a month per server (depending on the setup you choose), plus an extra $5 per user.

The Standard plan adds many more advanced features: site-to-site VPN tunneling, split tunneling, server-level access policies, device filtering, custom DNS servers, connection logs, priority support and more. That would be our pick for business users, but it's only a little more expensive, at around $5-$25 for the server, depending on its setup, plus $7.50 per user.

While that might sound expensive, you're getting a lot for your money. Connect to New York with a regular VPN, for instance, and you're sharing the server with thousands of users, including hackers and spammers who might get your IP address blocked. Meanwhile UTunnel creates a New York server just for you, on a top cloud provider like DigitalOcean or Kamatera. You're far less likely to have block-list issues, and it's a far better way to set up secure access to your business network.

These prices cover monthly billing, too, which makes them look like an even better deal. We found prices as low as $9 a month for a simple server and one user; ExpressVPN and a few others ask $13 a month for their monthly-billed plans.

Unfortunately, only supports one payment method: a debit/ credit card. While most users can live with that, we'd like to see a little more flexibility (Perimeter81 also accepts payment by PayPal and wire transfers, for instance.)

We would also like the option to sign up for longer-term plans to get lower rates, but, overall, the service is fair value for what's on offer. And if you sign up and disagree, that's okay too: UTunnel's 14-day money-back guarantee gives you enough time to find out if it's the right VPN for you.

Logging

UTunnel claims it doesn't log user activity, but the company Privacy Policy says something else.

The apps collect various details about your device. The policy says this includes 'information about your hardware, device manufacturer, unique device identifiers, information about software, the operating system, and version running on your system or device, browser and plug-ins, and mobile network information.'

We have no problem with that, as long as a provider's apps make it clear that this is happening and allow you to disable the feature. UTunnel doesn't mention the feature outside of the Privacy Policy, and there's no way to turn it off.

The Policy also says UTunnel keeps separate Log Data, including 'IP address, operating system, visited pages, location, hardware or device information, and cookie information.' That sounds worrying, but when asked the company, UTunnel explained that these details are logged when you visit the website; the service doesn't record any details of your VPN use.

Creating a custom UTunnel VPN server

After signing up for a UTunnel account, the website prompted us to create our VPN server. There's an option to specify an on-premises server (something you host yourself), but in this review we're interested in UTunnel's cloud VPN servers.

After entering a name for our server, UTunnel asked us to choose the cloud provider that would host our server. The list included DigitalOcean, Exoscale, Hetzner, Kamatera, Linode, Upcloud and Vultr. (AWS is supported, too, but you must sign up for UTunnel from the AWS Marketplace, rather than UTunnel's website.)

That's a decent list of providers, but there's a problem: unless you're a cloud hosting expert, you'll probably have no idea who to pick.

Once you've selected a provider, you're able to choose a location for your server. Sounds simple, but every provider has a different list of locations, so we had to choose multiple servers to see what's available.

Although the UTunnel website suggests you can choose from 30 locations, the most we found was 26 across 13 countries from Vultr. When we chose DigitalOcean, for instance, we had eight locations to choose from: Amsterdam, Bangalore, Frankfurt, London, New York, San Francisco, Singapore, Toronto. 

And there's another complication. After choosing a provider and a location, you must finally select an 'Instance type', a hosting plan which defines how powerful your VPN server should be. The options vary depending on your vendor, but, for instance, DigitalOcean has three options: 1 CPU core, 1GB RAM, 1TB bandwidth; 1 CPU core, 2GB RAM, 2TB bandwidth, and 2 CPU cores, 4GB RAM, 4TB bandwidth.

The issue here is the price you pay varies depending on the provider and location. It's not displayed on the list, so you must choose a plan to see what it costs. If you're looking to find the cheapest plan, that means you must select a provider, then the location, then the instance type, then make a note of the price. Then you must do exactly the same for each of the other six providers.

We figured this out eventually, so it's not a huge problem. But it is far more awkward than it needs to be, and UTunnel really should make it easier for users to quickly see all its available plans.

UTunnel apps

After buying a plan, UTunnel created our test VPN server in around five minutes.

The UTunnel web dashboard made little effort to explain what we should do next. Install an app, we wondered? There was no obvious download link, so we opened the Knowledgebase, ran a couple of searches and found the download ourselves. That wasn't difficult, but again, UTunnel could make life far easier by signposting steps like this more clearly.

UTunnel's apps are relatively basic, and in part that's by design. The apps don't support setting a custom DNS server, for instance, because that would allow every user to have their own, possibly insecure settings. Instead, you're able to enforce your preferred DNS on all users from UTunnel's web dashboard. That's much more secure.

Still, even making allowances for UTunnel's security design, the Windows app is seriously underpowered. It supports OpenVPN and IKEv2 protocols only (no WireGuard), and there are the bare minimum of settings: a 'connect on startup' option', 'enable notifications' and 'reconnect if the VPN disconnects automatically.'

Some platforms are a little more capable - WireGuard has just arrived in UTunnel's Android app, for instance - but it still leaves UTunnel looking for less capable than most of the competition. And with the company only releasing three Android updates in the past three years, it doesn't look like we should expect an avalanche of new features anytime soon.

The app has no mention of a kill switch, but did it include one anyway? We ran some in-depth tests to find out, and the answer was a concern. When we manually closed an IKEv2 connection, the app continued to allow access to our now unprotected IP address. And despite both the 'notifications' and 'reconnect' switches, the app didn't raise an alert to try to warn us, and it didn't try to reconnect.

We noticed one partial solution for UTunnel's app issues. The service supports manual OpenVPN connections, which allows you to use third-party apps such as OpenVPN Connect.

VPN speed tests don't always mean very much. That's especially true with UTunnel, because performance will depend on your and the server's location, the provider you choose, and the power of your server. But we were keen to run our tests anyway, just to get a feel for what UTunnel could do.

We created a London-based server using DigitalOcean's cheapest plan (just one CPU core.) Our IKEv2 speed tests returned decent average download speeds of around 260Mbps. A good WireGuard VPN could be three times as fast, but, realistically, UTunnel looks more than fast enough for most devices, networks and internet tasks.

We checked our London server's unblocking abilities, and the results were mixed. It failed with UK Netflix, but unblocked BBC iPlayer, ITV and Channel 4. You may see very different results, though, depending on your location, and the provider you choose.

UTunnel VPN access management

UTunnel's apps may be limited, but the service does have plenty of interesting team security, access control and server management features.

You're able to manually invite colleagues to use the server, for instance. By default, new users are only allowed to connect to the server. You can also give specific users Administrator rights, though, allowing them to help you manage UTunnel (add more users, change settings, more.) 

UTunnel supports using Single Sign On (SSO) to authenticate users, for example allowing them to sign in with their Google, Microsoft Azure AD or Okta account. 

UTunnel requires that you set up SSO manually (via SAML, if you're curious), which is more complicated than usual. The official tutorial for Google gives you an idea of how it works. But the advantage is UTunnel should also work with any identity provider which supports custom SAML connections, something we rarely see elsewhere.

 If you're not using Single Sign On, UTunnel allows you to enforce Two Factor Authentication (2FA.) That's a security plus which requires users to log in using their password, and then enter a code sent via email or an OTP app (Google or Microsoft Authenticator.)

A comprehensive Access Policy system enables creating rules to define who can access which server. You can organise users into groups, for instance; selectively hide some servers from some users and groups, or allow access to approved devices only. 

That's a decent list of access features, but UTunnel isn't done yet. The service also has a number of logs which record server events and allow you to track what's going on. You're able to view VPN connection times, devices used, and key settings changes (user invitations, credit card changes, server configurations), ideal for making sure UTunnel is being used as you'd expect.  

UTunnel server and other features 

UTunnel's servers support a number of very useful advanced network settings.

You can set up split tunneling, for instance (called split routing here.) That allows users to connect to your business resources through the tunnel, but have all other traffic sent through their regular connection. It's a very useful feature which cuts bandwidth use, improves server speeds, and reduces the chance of user problems (if they're an app which isn't compatible with the VPN, say.)

UTunnel has some valuable expert-level DNS controls. Not only can you set up custom DNS for all your server users; UTunnel's split DNS allows you to route DNS queries from some domains to your custom DNS server, which others use your regular DNS.

A handy 'OneClick Applications' feature essentially creates shortcuts which give HTTPS, SSH and RDP access to resources on your network with a single click.

There's even support for setting up site-to-site connections. We found instructions for firewalls and network setups including Cisco, Fortinet, Sophos, Unifi, MikroTik and AWS Virtual Private Gateway.

If you have problems with any of this, UTunnel's web support site has various documents which might help. It doesn't have the depth we've seen with some VPNs, but there are tutorials explaining how to complete many common tasks.

There's no live chat or phone support, but you can raise tickets or send emails for more complex problems. The UTunnel website doesn't commit to a response time, but we sent a simple test question to try it out. Even though we asked a basic product question, which we would expect to get the lowest priority, the support team sent a helpful reply in around an hour. That's not bad for email, but it could still be an issue if you're using UTunnel for business-critical tasks.

Final Verdict

UTunnel's expert-level features, such as site-to-site networking and split DNS routing, mean it could work for experienced business users with complex networking requirements. Take a look if you'll make use of UTunnel's more advanced tools, but beware: there are plenty of technical and service issues, too. If you sign up, use the 14-day money-back period for some intensive testing, and make sure UTunnel is the business VPN for you.

• Also check out our complete list of the best business VPNs