Zero-trust costs beyond the seat: connectors, gateways and servers
The scenario
- Ten people. One connector into the office network (vendors call it a gateway, a site, a subnet router, a connector). One dedicated IP address.
- This site's data holds nine charges that do not move with headcount. Two are required (NordLayer's $40 server, UTunnel's $5 gateway), four are optional add-ons, and three show up as a way of counting seats or devices (an OpenVPN connector uses a seat; a Tailscale tagged device beyond 50 is $1; a NetBird machine beyond the allowance is €0.50).
- For the scenario above, ten people run from $41.60 a month at Firezone to $180 at NordLayer Premium. Five vendors print a price for a dedicated IP; the rest print nothing, and nothing is what this site records.
- The IP and gateway charges on their own are listed at dedicated-ip-cost. This page is the wider view: every non-seat charge, carried through one team.
The nine charges that are not per user
| Vendor | Charge | Amount | Required? | How it is counted |
|---|---|---|---|---|
| NordLayer Core / Premium | Server with Dedicated IP | $40 a month | Required | One per network. The yearly-billing figure; the monthly toggle shows $50 |
| UTunnel Basic / Standard | Minimum Gateway Cost | $5 a month | Required (cloud gateway) | One cloud gateway. $0 if you bring your own server |
| GoodAccess (all three plans) | Dedicated gateway | $49 a month | Optional | Per gateway |
| OpenVPN CloudConnexa | Connector | One seat ($7 on Essential) | Not required, but every connector takes a seat | "A seat represents either an activated user or a connector" |
| Tailscale (every plan) | Tagged resources | 50 included, then $1 a month each | Only past 50 | Exit nodes, subnet routers and other devices with no person behind them |
| NetBird Team / Business | Additional machines | €0.50 a month each | Only past the allowance | 100 machines + 10 per user included |
| ExpressVPN for Teams | Dedicated IP for Teams | $390 a year per location ($32.50 a month) | Optional | Per location |
| PureVPN Business | Static IP | $5.99 a month per member ($4.99 yearly) | Optional | Per member who takes one |
| PureVPN Business | Team Server | $50 a month | Optional | The page gives the amount; the unit it is charged per could not be read |
Twingate and Firezone put no price on a connector or gateway. Firezone runs gateways on your own infrastructure, and its pricing page only caps Sites (10 on Starter, 100 on Team) and service accounts. Twingate's page prices no connector and lists "static IPs" under Enterprise.
Ten people, one connector, one dedicated IP
| Vendor and plan | Seats | Connector | Dedicated IP | Monthly | Per person |
|---|---|---|---|---|---|
| Firezone Team | $4.16 x 10 = $41.60 | No price on the page | Not stated | $41.60 | $4.16 |
| Twingate Teams | $5 x 10 = $50 (read 2026-10-02) | No price on the page | An Enterprise item, price not published | $50 | $5.00 |
| UTunnel Standard | $8 x 10 = $80 | Cloud gateway $5 (a static IP is in Basic; site-to-site is a Standard feature) | Included with the gateway | $85 | $8.50 |
| OpenVPN CloudConnexa Essential | $7 x 11 seats = $77 (the connector is a seat) | One seat = $7 | Not stated | $77 | $7.70 |
| Tailscale Standard | $8 x 10 = $80 | One tagged device, $0 inside the 50 | Not stated | $80 | $8.00 |
| GoodAccess Essential | $7 x 10 = $70 | No separate price on the page | Dedicated gateway $49 (optional) | $119 | $11.90 |
| NordLayer Core | $11 x 10 = $110 | No separate price on the page | Server with Dedicated IP $40 (required) | $150 | $15.00 |
| NordLayer Premium | $14 x 10 = $140 | As above | $40 (required) | $180 | $18.00 |
| ExpressVPN Teams, 12 months (reference) | $4.37 x 10 = $43.70 (10-19 license tier) | No matching item | $390 a year / 12 = $32.50 | $76.20 | $7.62 |
| PureVPN Business Starter, yearly (reference) | $7 x 10 = $70 | No matching item | One member's static IP, $4.99 | $74.99 | $7.50 |
| NetBird Team (euros, ranked apart) | €6 x 10 = €60 | One machine, €0 inside the 200 | Not stated | €60 | €6.00 |
Scroll sideways on a phone.
ExpressVPN and PureVPN publish tiered "from" prices and are kept out of this site's rankings; they are here for reference because they carry non-seat items. NetBird is in euros and is never converted, so it is not placed in the order.
One row changed on 2026-10-02. Until then this site's tables computed Twingate Teams from the $4.25 yearly price read on 2026-09-07, which gave $42.50 for ten. The page re-read that day shows $5, and the tables now use it; article-41 has the details.
At OpenVPN, a connector eats a seat
The CloudConnexa pricing page says in its FAQ that "A seat represents either an activated user or a connector in your CloudConnexa environment", and that a connector consumes a seat the moment it is created, online or not. Ten people plus one connector is eleven seats: $7 x 11 = $77 on Essential, or $7.70 a head against the printed $7. A second site makes it twelve seats and $84.
The free Starter plan has "5 seats included". Four people and one connector fill it.
Tailscale and NetBird count devices
Tailscale prices no connector and instead counts devices with no person behind them as tagged resources. Each plan includes 50; from the 51st they are $1 a month apiece (article-39). One subnet router at the office is inside the allowance and costs nothing. Connect sixty servers and the bill grows by $10 a month.
NetBird includes 100 machines plus 10 per user. Ten people get 200, and the office connector is one of them. Beyond that, €0.50 a month each.
Neither charge fits a divide-by-headcount formula: it is $0 while the device count is small and rises in a straight line after that. What changes when the unit is a person, a device or a server is set out in article-07.
Where the line between required and optional sits
This site adds a fixed charge to the per-user figure only when the pricing page says "required" or the vendor's own calculator adds it to the total. NordLayer prints "+$40/month required". UTunnel's calculator adds $5 by default. Those two are inside the per-user numbers in the tables.
GoodAccess's $49, ExpressVPN's $390, PureVPN's $5.99 and $50 are optional and stay out. If you need one, add it yourself the way the scenario above does. $49 across ten people is $4.90 each; across two, $24.50. A fixed charge weighs most on the smallest team.
What the pricing pages do not price
Five vendors print a figure for a dedicated IP: NordLayer, UTunnel (a static IP comes with the gateway), GoodAccess (a dedicated gateway), ExpressVPN and PureVPN. Firezone, OpenVPN CloudConnexa, Tailscale and NetBird have no dedicated IP line on their pricing pages, and this site writes "not stated". That is not read as free and not read as unavailable. Twingate places "static IPs" under Enterprise with no price.
Only two vendors put a number on a connector: OpenVPN, by counting it as a seat, and UTunnel, by charging $5 for the gateway. The others handle it with a device allowance (Tailscale, NetBird, Firezone's Sites) or say nothing. The general question of what a published price leaves out is covered at article-04 and guide-cost.
Who this is not for
A single-site team that needs no dedicated IP has nothing to add; the per-seat figures at ztna-cost and 10-users are the whole answer.
Sources
- https://nordlayer.com/pricing/ (checked 2026-10-02)
- https://openvpn.net/cloud-vpn/pricing/ (checked 2026-10-02)
- https://tailscale.com/pricing (checked 2026-10-02)
- https://www.goodaccess.com/pricing (checked 2026-10-02)
- https://www.firezone.dev/pricing (checked 2026-10-02)
- https://www.twingate.com/pricing (checked 2026-10-02)
- https://netbird.io/pricing (checked 2026-10-02)
- https://www.expressvpn.com/teams/pricing (checked 2026-10-02)
- https://www.purevpn.com/business-vpn (checked 2026-10-02)
- https://www.utunnel.io/vpn-ztna-pricing-plans (as read 2026-09-08; HTTP 403 on 2026-10-02)
- https://seatbill.com/vpn-pricing/dedicated-ip-cost
- https://seatbill.com/vpn-pricing/article-39
Related on this site
- Every dedicated IP and gateway charge, converted to a per-person figure
- What zero-trust network access costs per user across 16 vendors
- OpenVPN CloudConnexa in this site's dataset
- NordLayer in this site's dataset
- Per user, per device, or per server: the unit is not the same everywhere
- How much does Tailscale cost for a business?
- GoodAccess and its optional $49 gateway
- UTunnel and its $5 gateway
Written by Kaz (pen name). Published October 2, 2026. Prices were checked on the dates given under Sources. We have not used these products. Corrections: contact form.