TonD overlaps with Teleport's reverse-tunnel access model, but is currently a much narrower secure connectivity product.
| Area | TonD | Teleport |
|---|---|---|
| Primary purpose | On-demand forwarding to a remote machine or service | Identity-aware access platform for infrastructure |
| Connectivity | P2P first; SSH relay fallback, including customer relay nodes | Agent-initiated reverse tunnels through Teleport Proxy |
| Protocols | SSH, RDP, WinRM, HTTP/HTTPS, and custom TCP ports | SSH, Kubernetes, databases, desktops, web apps, and more |
| Authentication | Organization/device registration, Ed25519 nonce proof, and per-session SSH credentials | Central CA, SSO/IdP integration, and short-lived user and machine certificates |
| Authorization | Remote advertises allowed protocols and ports; organization isolation | Mature RBAC, labels, access requests, and just-in-time elevation |
| Audit | Design document exists; limited implementation | Comprehensive audit events, session recording/replay, and command/query auditing |
| Data plane | Direct encrypted SSH-over-P2P where possible; relay only when required | Usually proxy/reverse-tunnel mediated, with multiple routing modes |
| User experience | Client selects a remote endpoint and port/protocol | Web UI and CLI resource catalog with identity-driven access |
The key architectural difference is that TonD establishes an encrypted TCP path, then lets the operator's normal local tool use it. Teleport is an identity and policy control plane that understands the accessed resource type and enforces user and role policy throughout the session.
TonD's differentiators are direct P2P preference, simple fixed/custom-port exposure, and customer-owned fallback relays. To approach Teleport's scope, the major additions would be SSO, user roles and resource policy, certificate authority and lifecycle, centralized durable audit storage, session recording, and resource-specific gateways.