What is the NetOz managed VPN?
How the NetOz managed WireGuard VPN works: a dedicated Australian-hosted server for your organisation, split tunnelling, per-person device links and usage reporting.
On this page
The NetOz managed VPN gives your team private, encrypted access to the systems they need for work, such as an internal application, a file server or an office network, without exposing those systems to the public internet. NetOz runs and maintains the VPN server. You decide who gets access and which devices they can use, all from the NetOz Portal.
This guide explains how the service works so you know what to expect before you add your first person.
Built on WireGuard
The VPN uses WireGuard, a modern VPN protocol known for being fast, simple and easy to audit. WireGuard connects almost instantly and copes well with phones and laptops that move between Wi-Fi and mobile networks.
Your staff use the free, official WireGuard app, which is available for:
- Windows
- macOS
- iPhone and iPad
- Android
- Linux
There is no NetOz-specific client to install and no username or password to remember. Each device holds its own key, delivered through a private setup link.
A dedicated server for your organisation
Your VPN runs on its own server rather than a shared pool. It is hosted in our Adelaide data centre, so traffic that goes through the tunnel stays on Australian infrastructure. That helps with data sovereignty requirements and keeps latency low for teams based in Australia.
NetOz looks after the server itself: keeping it running, monitoring its health and managing the WireGuard configuration. You look after access.
Split tunnelling: only work traffic goes through the VPN
The NetOz VPN is a split tunnel. When you set up the service, NetOz configures a list of destination networks that should be reachable through the VPN, for example the address range of your private servers. Only traffic to those destinations goes through the tunnel.
Everything else, including normal web browsing, video calls and streaming, carries on over the person's own internet connection exactly as before. This means:
- Staff do not notice the VPN when they are not using work systems.
- Your VPN is not a general-purpose privacy VPN and does not change anyone's public IP address for normal browsing.
- Leaving the VPN switched on all day is harmless, and switching it off is harmless too.
Each person can see exactly which destinations are included. Their setup page has a section called What you'll be able to reach that lists the address ranges carried by the tunnel.
Routing all traffic through the VPN (a full tunnel, 0.0.0.0/0) is deliberately not allowed.
People, devices and setup links
Access is organised by person and device:
- An administrator adds a person in the VPN area of the NetOz Portal, using their email address and a name for their first device, such as Laptop.
- NetOz emails that person a private setup link. The email subject starts with the name of your VPN, followed by "set up" and the device name.
- The person opens the link on the device they are setting up. On a phone they scan a QR code with the WireGuard app. On a computer they download a
.conffile and import it into WireGuard.
One device per setup link
Every device gets its own key and its own link. A configuration must not be shared between devices: the VPN server only knows about one connection per key, so two devices using the same configuration will keep knocking each other off.
If someone needs the VPN on both a laptop and a phone, an administrator uses Add device on their row, and NetOz sends a separate link for the second device.
The link keeps working
Setup links are not single-use. A person can open the same link again later to set the same device up again, for example after reinstalling the app. Because anyone with the link can connect as that person, it should be kept private and never forwarded.
The link stops working straight away if the device or the person's access is removed.
When the network changes
If NetOz updates your list of destinations, devices that were set up before the change still carry the old list and cannot reach the new ranges. The portal marks those people with a Needs new link status, and administrators can use Resend link to re-import.
When the person opens their link again, the setup page tells them the network has changed and gives them the updated QR code and file to import.
Usage and status
Administrators can select a person in the VPN area to see each device's tunnel address, when it was set up and when it last connected. Data usage is also recorded per device and reported by calendar month (UTC).
Removing access
When someone leaves or loses a device, an administrator can use Remove access for the person, or remove a single device. Removed devices stop connecting and their setup links stop working immediately. Other devices belonging to the same person are not affected when you remove just one.
Next steps
- Add a user and device to your NetOz VPN
- Set up WireGuard on Windows
- Set up WireGuard on iPhone and iPad
- Troubleshooting the NetOz WireGuard VPN
- Want the VPN for your business? See our private VPN service.
Was this guide helpful?
Your answer helps us keep these guides accurate.