NetworkProduct page Pricing

Frazer Access and VPN

Frazer Access is a private network for each organization. It connects your people’s laptops and phones, agent sessions, CI runners, devboxes, VMs, cluster API servers, databases and VPC networks to each other, peer to peer over WireGuard with post-quantum keys, and who reaches what comes from IAM, so removing a person ends their access in one operation. Frazer runs the control plane and the relays; your people connect with the Connect switch of the Frazer app on a laptop or a phone, or with the frazer CLI, which carries its own client. HA VPN connects your office network to the same VPCs.

Product overview: Frazer Access and VPN.

How it works

Frazer runs the control plane in your organization’s cell, upgrades it and backs it up. It hands every device and resource its keys, its policy and its names; then they talk to each other directly over WireGuard. Relays that Frazer runs in every region carry traffic only when no direct path exists, and they see only encrypted packets. Frazer never sends your traffic through a third party’s public relays.

The private network lives in your organization’s host project. Its IPv4 range is yours to choose, inside 100.64.0.0/10 by default, and its IPv6 range is a random unique local /48 of your organization’s own. If a device’s own network already uses your IPv4 range (carrier-grade NAT, satellite internet or another VPN), the device carries your organization’s traffic over IPv6, and the console offers a new range.

Device: a person’s laptop or phone, connected with Frazer sign-in. A device’s key expires.
Node: a devbox, VM, cluster API server, CI runner, agent session or gateway, which joins at creation and follows its resource’s rights.
Access policy: who reaches what, rendered from IAM. An AccessPolicy resource adds rules, with tests.
VPC attachment: a VPC network’s link to the private network, an HA pair of gateways that advertise the network’s subnets.
Exit: a node that carries a device’s internet traffic from a fixed address: a Frazer regional exit with a static IP for your organization, or one you run.

Devices, boxes, VMs and clusters answer to short names, such as lena-api, and to full names under access.frazer.run, such as lena-mbp-acme.access.frazer.run. Split DNS sends a project’s .internal names, such as storefront.db.acme-production.internal, to the network’s resolver through its VPC attachment.

Frazer Access is not Frazer Link. Both use WireGuard, and nothing else is shared.

Property	Frazer Link	Frazer Access
Purpose	Frazer’s control plane to the agents at your sites: console, kubectl, logs, signed operations	Your people, devices, agents, boxes and VPCs to each other
Shape	Hub and spoke through Frazer gateways	Peer to peer, relays only as a fallback
Configured by	Frazer only; works before any member exists	You, through IAM and `AccessPolicy`
Failure rule	Never depends on Frazer Access	A control-plane outage or a bad policy edit never cuts Frazer’s path to your servers

Connect a laptop

Install the frazer CLI and sign in:

curl -fsSL https://get.frazer.ai | sh
frazer login

Connect the laptop to your organization’s private network. With the Frazer app installed, its Connect switch does the same; from a terminal, frazer access connect signs the device in, so every app on the laptop reaches the network:
Terminal window
```
frazer access connect
```
Output
```
Signed in to Acme as lena@acme.example
✓ lena-mbp connected to Acme's private network
100.88.0.4 · fd3a:91c2:5e07::4
DNS  lena-mbp-acme.access.frazer.run, *.acme-production.internal
```
Connect to what your roles allow, by name, with the tools you already use.
Terminal window
ssh oncall-1 psql -h storefront.db.acme-production.internal
Terminal window
frazer ssh jump-1 frazer devboxes ssh lena-api frazer databases connect storefront --role readonly
The frazer CLI carries its own client: it runs in userspace, with no root and no system extension, so a laptop needs nothing else installed. It also works next to another company’s VPN on the same laptop. SSH, port forwarding, database connections and kubectl to private clusters all use it.
Install the Frazer app on the phone, sign in with Frazer and turn on Connect.

CI runners join as nodes and follow the same rules.

Reach a VPC network

A VPC attachment on a network creates an HA pair of gateways with a network card in the network. They advertise the network’s subnets to the private network, approved automatically by their tag, tag:vpcgw-<network>. A range that overlaps another attached network is refused at plan time.

Create the attachment in the network’s project, under Network › Access. Then:

Laptops reach the network’s private addresses, as far as the access policy allows.
The network’s .internal names resolve on every device, through split DNS.
Connectivity tests include access rules, so “can this laptop reach that database?” has an answer with the rule that decided it.

Control who reaches what

The access policy is rendered from IAM, never written by hand. When a role changes, the policy changes with it.

In IAM	In the access policy
Members	Users; their devices connect with Frazer sign-in
Groups	`group:` entries
Resources	Tags: `tag:devbox-<id>`, `tag:vm-…`, `tag:cluster-<id>`, `tag:vpcgw-<network>`
Role bindings	Grants: `devbox.user` reaches only the person’s own boxes, `cluster.viewer` only the cluster’s API port

In the host project, Network › Access shows the rendered policy, read-only, next to devices, nodes, gateways and exits:

// Change roles, groups or AccessPolicy, never this file
{
  "groups": {
    "group:acme-oncall": ["lena@acme.example", "kenji@acme.example"],
  },
  "grants": [
    // devbox.user: only your own boxes
    { "src": ["lena@acme.example"], "dst": ["tag:devbox-lena-api"], "ip": ["*"] },
    // database.client: endpoint storefront
    { "src": ["group:acme-oncall"], "dst": ["10.20.4.10/32"], "ip": ["tcp:5432"] },
  ],
  "autoApprovers": {
    "routes": { "10.20.0.0/20": ["tag:vpcgw-acme-prod-vpc"] },
  },
  "tests": [{ "src": "amara@acme.example", "deny": ["10.20.4.10:5432"] }],
}

Rules beyond IAM live in an AccessPolicy resource. Its tests run in every plan, so a change that would let the wrong person in fails before it applies.
Rendering is deterministic: the same IAM state always gives the same policy, and drift is recorded.
SSH has one authority: short-lived certificates from your organization’s SSH certificate authority, over Frazer Access.
Public exposure never goes through Frazer Access: public sharing and service publishing are off. Publish a service through a gateway instead.

Connect your office with HA VPN

HA VPN runs two gateways per site, each with a public address, with IPsec IKEv2 to your router and BGP over every tunnel. IKEv2 uses a hybrid post-quantum key exchange (X25519 then ML-KEM-768) whenever your router offers it; a classic tunnel is labeled, and the organization constraint network.requirePostQuantumVpn refuses classic peers. WireGuard is a second option. Keep the pre-shared key in Secrets, then create the tunnel:

frazer network vpn-tunnels create office --gateway vint-hill \
    --peer-ip 203.0.113.7 --ike-psk-from-secret office-psk --bgp-asn 65010

office-sf-0   IPsec IKEv2   if 0   Established   BGP up
office-sf-1   IPsec IKEv2   if 1   Established   BGP up
Learned      192.168.40.0/22 from AS 65010
Advertised   10.20.0.0/20, 10.20.17.0/24

Tunnels carry IPv4 and IPv6 routes, and the routes learned from your router take part in the network’s overlap check. Tunnel and BGP state show under Network › Connectivity › VPN and interconnect and raise alerts when they change. At your own site, an existing VLAN can join a network directly instead: VLAN attachments.

Clusters outside Frazer

Install the Frazer Access operator in a cluster Frazer does not run. A Service becomes a resource with a private name, pods reach your private resources through a pair of egress gateways that sign in with the cluster’s own identity, and kubectl reaches the cluster’s API through Frazer Access with your identity, recorded. Frazer’s own clusters join by themselves.

Remove a person

Removing a member from the organization is one operation:

The membership ends. Every new credential (an SSH certificate, a device key, a Git or LLM token) checks membership first, so access stops here.
The person’s devices are deleted and their keys expire.
The access policy is rendered again.
Their SSH certificates are revoked.
Their boxes stop. Box data is kept.

If an outside step fails, the membership stays ended and the operation retries the rest.

Access and audit

Who	What they can do
Members	Connect a device with Frazer sign-in. A device reaches only what its owner’s roles grant.
`devbox.user`	Reaches only the person’s own boxes.
`cluster.viewer`	Reaches only the cluster’s API port.
`AccessPolicy` authors	Add rules beyond IAM, with tests that run in every plan.
Gateways	Approved automatically by their tag; a range that overlaps another attached network is refused.
Agents and MCP clients	Read by default. Firewall, route and peering changes always go through a plan and an approval.

What is recorded:

Every connection to a box, with the person, the device and the path.
Every policy revision, rendered from IAM the same way every time, with drift recorded.
Every firewall, route and peering change, each through a plan and an approval.
Every offboarding, from the ended membership to the stopped boxes.

Devboxes verify identity on every connection with two-factor sign-in and a device enrolled in Frazer Access: Devboxes.

Limits and defaults

Item	Default
Private networks per organization	One by default, in the organization’s host project
Control plane	Run by Frazer in the organization’s cell
Address ranges	IPv4 inside `100.64.0.0/10` by default; a random IPv6 ULA /48
Gateways per VPC attachment	2
HA VPN gateways per site	2, each with a public address
Device keys	Expire; nodes follow their resources
SSH certificates for devboxes	8 hours
Public sharing and service publishing	Off
Encryption	WireGuard with a hybrid post-quantum key exchange (ML-KEM-768) on every connection; HA VPN: hybrid ML-KEM-768 when the peer offers it
FIPS profile	Off; an organization policy turns it on

Pricing

Frazer Access is free for your members’ devices and for Frazer resources, and relays are free within fair use. Frazer’s regional exits are billed monthly. HA VPN is included within fair use, and there are no per-GB network fees.

Frazer Access and VPN	On your servers	On the Frazer fleet
Price	Included: no fee per user or per device	Frazer exit node: $5 / month, static IPv4 included · relay traffic within fair use

Every line, with the estimator: pricing.

Troubleshooting

Symptom	Cause	Fix
A device cannot reach a box, VM or database	Its owner’s roles do not grant it	Grant the role (for example `devbox.user` on the box) or add an `AccessPolicy` rule; the policy renders again.
A device shows as expired	Its key expired	Sign in again: `frazer access connect` on a laptop, or Connect in the Frazer app.
A connection shows a relay instead of a direct path	No direct path exists between the two nodes	Nothing breaks: traffic flows, still encrypted, through a Frazer relay in the region; `frazer access status` shows it.
`.internal` names do not resolve on a laptop	The network has no VPC attachment, so split DNS has no gateway	Add a VPC attachment to the network.
A VPC attachment is refused	Its subnets overlap a network that is already attached	Attach networks with distinct ranges, or detach the other network.
The console reports a range clash for a device	The device’s own network uses your organization’s IPv4 range (carrier-grade NAT, satellite internet, another VPN)	Nothing breaks: traffic goes over IPv6. Accept the remap the console offers to use IPv4 again.
The laptop already runs another company’s VPN	Its routes clash with your organization’s range	Accept the remap the Frazer app offers, or use the `frazer` CLI’s own client: `frazer ssh`, `frazer databases connect`.
A VPN tunnel is down or BGP is not up	The router’s peer address, pre-shared key or ASN does not match the tunnel	Check the tunnel’s `--peer-ip`, the secret behind `--ike-psk-from-secret` and `--bgp-asn` against the router.

Reference

CLI

Command	What it does
`frazer access connect`	Connect this device to your organization's private network with Frazer sign-in.
`frazer access status`	Show the path to each peer, direct or through a relay.
`frazer ssh`	Open SSH to a VM or a box over Frazer Access, with nothing else to install; the CLI carries its own client.
`frazer network vpn-tunnels create`	Create an HA VPN tunnel from a site's VPN gateway to your router, with BGP.

All of them: CLI reference.

VPC and firewall: the networks that VPC attachments and VPN tunnels connect to.
Devboxes: boxes that join the private network and the ways to open them.
Identity and access: the roles and groups the access policy is rendered from.
Give your team devboxes: templates, policies and one-click open.
Frazer Access and VPN: the product page.