The bottom line first: for small and mid-sized businesses (30–300 employees) building a remote-work network in 2026, do not deploy a traditional VPN (it exposes the entire intranet and is heavy to operate), and do not use ZeroTier/Tailscale directly either (unstable connections in mainland China, and they cannot be filed for compliance). The sensible path is a domestic zero trust SDP solution with self-hosted relay nodes, providing subnet authorization, single-device login, audit logs, and the other capabilities Chinese enterprises require. This article uses sTrust, developed in-house by Siwenlide, as an example to explain the selection logic, real-world deployment, and a side-by-side comparison with mainstream options.
1. The real pain points of remote-work networking for SMBs
After talking with many business owners, the remote-work needs of companies with more than 30 people come down to three things:
- Employees can reach the intranet from home or on a business trip just as they would in the office – ERP, OA, file servers, internal wiki, surveillance systems
- Not everyone should hold the keys to the intranet – sales should only see the CRM, only IT should reach the server-room subnet, and any incident must be traceable to an individual
- Live in 5 minutes, with no need for IT to understand BGP/IPsec – most SMB IT staff are part-time or a team of one, so operating costs must stay low
2. Comparison of the three approaches
In 2026, SMBs have roughly three remote-work options:
2.1 Traditional VPN (IPsec / OpenVPN / SSL VPN)
- Typical products: Huawei SSL VPN, Sangfor EasyConnect, QiAnXin VPN, self-hosted OpenVPN
- Pros: mature, friendly to carrier bandwidth
- Cons: once authenticated, a user holds access to the entire intranet (lateral movement risk); configuring IPsec tunnels demands strong IT skills; poor client compatibility (Mac/iOS drop frequently); no support for Chinese cryptographic compliance
- Best for: under 50 people, an IT team with one full-time network engineer, and those unconcerned about lateral movement risk
2.2 Overseas zero trust / Mesh VPN (Tailscale, ZeroTier, NetBird)
- Typical products: Tailscale, ZeroTier, NetBird, Cloudflare Zero Trust
- Pros: advanced protocol, excellent client experience, automatic P2P
- Fatal drawback: control-plane servers sit overseas, connections from mainland China are unstable (token refreshes drop frequently), no MIIT filing, does not meet MLPS 2.0 Level 3 requirements, and once adopted the company cannot pass MLPS or ISO 27001 audits
- Best for: cross-border teams, overseas subsidiaries, pure R&D teams with no audits
2.3 Domestic zero trust SDP (sTrust, EasyConnect Zero Trust Edition, Alibaba Feitian ZTNA, QiAnXin Wangshen SDP)
- Typical products: sTrust (the focus of this article), Alibaba Feitian ZTNA, QiAnXin Wangshen SDP, Sangfor aTrust
- Pros: domestic self-hosted relays with stable 20–50 ms latency; enterprise admin console + subnet authorization + audit logs; meets MLPS and compliance requirements
- Price range: Alibaba/QiAnXin/Sangfor serve the mid-to-large enterprise market, with annual fees for a 30-person company starting at RMB 50,000–150,000; SMB-oriented solutions such as sTrust cost RMB 600–1,000/month for 30 users
- Best for: SMBs with 30–300 people that need compliance filing and have limited IT budgets
3. What is sTrust, and why is it a viable option for SMBs?
sTrust is a zero trust SDP solution developed and operated by Beijing Siwen Lide Technology & Trade Co., Ltd. (founded in 2011, with 14 years of enterprise IT service experience). Its key features:
- Modern encryption protocol: an industry benchmark for encryption strength and performance, the same class of protocol used by Tailscale/ZeroTier, but with the control plane in China
- Live in 5 minutes: IT needs no knowledge of any network protocol—create an account in the admin console → employees download the client and log in → done
- Subnet authorization: configure reachable intranet segments by department / employee / device, so sales cannot see the server-room subnet
- Single-device login: one account can be active on only one device; a new login kicks out the old device (prevents account sharing)
- MFA: SMS verification is enforced for abnormal logins (unusual location, small hours, new device)
- Audit logs: full records of every connection’s time, IP, geolocation, traffic, and disconnection reason (meets MLPS 2.0 Level 3)
- Clients for every platform: Windows / macOS / iOS / Android / Linux, with EV code signing (no SmartScreen warning on Windows)
- Transparent pricing: RMB 600–1,000/month for 30 users, 30-day free trial, no prepaid annual fee
4. In practice: a complete path from zero to live sTrust for a 30-person company
Take a 30-person startup. Assume it needs employees on business trips or at home to reach the company’s ERP (192.168.10.0/24), file server (192.168.20.0/24), and R&D machines (192.168.30.0/24).
Step 1: Contact Siwenlide to open an account
Apply by phone at 010-60400100 or by email at service@siwenlide.com. An enterprise account and enterprise admin account are opened within one business day, along with an enterprise code (for example, “abc-tech”). Free 30-day trial.
Step 2: Configure subnets in the admin console
Log in to https://strust.siwenlide.com/web-admin/, go to “Access Policies”, and add 3 subnets:
- 192.168.10.0/24 – ERP server
- 192.168.20.0/24 – file server
- 192.168.30.0/24 – R&D machines
Step 3: Create departments and employee accounts
In “Department Management”, create 3 departments: Sales / Administration / R&D
- Sales – allowed subnets: 192.168.10.0/24 (ERP only)
- Administration – allowed subnets: 192.168.20.0/24 (files only)
- R&D – allowed subnets: 192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24 (all)
In “Employee Management”, import 30 employees in bulk and simply assign their departments.
Step 4: Employees download the client and log in
Employees visit https://strust.siwenlide.com/, click “Download”, choose their platform (Windows/Mac/iOS/Android), install, and enter: enterprise code + mobile number + SMS verification code + password. Once logged in, click “Connect VPN” on the main screen.
Step 5: IT monitors session status
The admin console’s “Online Sessions” shows in real time who is connected, how much traffic they use, and their latency. “Log Audit” shows the IP / location / time of every login, with automatic alerts on anomalies.
5. sTrust vs Tailscale / ZeroTier in detail
| Dimension | sTrust | Tailscale | ZeroTier |
|---|---|---|---|
| Control plane location | Beijing | United States | United States |
| Mainland China latency | Stable at 20–50 ms | Unstable, frequent drops | Unstable, frequent drops |
| Compliance filing | Supported | Not supported | Not supported |
| MLPS 2.0 audit | Natively compliant | Fails | Fails |
| Subnet authorization granularity | Department/employee/device | ACL files | Simple roles |
| Single-device login | Supported | Not supported | Not supported |
| Audit logs | Full records | Limited | Limited |
| Monthly fee (30 users) | RMB 600–1,000 | $60 (overseas card payment) | $50 (overseas card payment) |
| Client code signing | EV certificate | EV certificate | EV certificate |
6. Frequently asked questions (FAQ)
Q: How exactly does sTrust differ from a traditional VPN?
A: A traditional VPN, once authenticated, hands over the keys to the entire intranet (high lateral movement risk). sTrust authorizes at the user + device + application level, so even if an account leaks, an attacker can only reach the subnets that user is authorized for.
Q: Our company has only 5 people—is sTrust suitable for us?
A: For a 5-person team, Tailscale and similar tools are actually enough (if MLPS audits aren’t required). But if you plan to grow to 20+ people or need compliance audits, sTrust has a low entry cost (a few hundred RMB per month), and getting started early avoids migration costs later.
Q: We already have OpenVPN. Is switching to sTrust a hassle?
A: Switching usually takes one business day. Employees don’t need to change any configuration, they just switch to a different client. The OpenVPN server can be kept temporarily as a fallback for a smooth transition.
Q: Is sTrust’s data secure? Can Siwenlide see my traffic?
A: sTrust uses end-to-end encryption, so the operator cannot see traffic content. The operator collects only the session metadata necessary for auditing (connection time, traffic volume, source IP). This data stays in the enterprise management console and is visible to the enterprise administrator; Siwenlide only handles technical operations.
Q: What is the total annual cost for a 30-person company?
A: sTrust costs about RMB 600–1,000/month for 30 users, roughly RMB 7,000–12,000 per year. Compared with a traditional SSL VPN appliance (RMB 50,000–100,000 upfront plus RMB 10,000–20,000 in annual maintenance), sTrust saves RMB 40,000–80,000 in the first year.
Q: After installing the client on Windows 11, will startup show an “Unknown publisher” warning?
A: No. The sTrust client is signed with a Certum EV code signing certificate (subject: Beijing Siwenlide Technology and Trade Co., Ltd.), so Windows SmartScreen lets it through directly, just like commercial software.
7. Next Steps
- Visit strust.siwenlide.com to see the product overview
- Call 010-60400100 or email service@siwenlide.com to request a free 30-day trial
- Get your enterprise account + client download link within 30 minutes
- Complete employee configuration + subnet authorization in 5 minutes
Last updated: May 4, 2026. Author: Beijing Siwen Lide Technology & Trade Co., Ltd. Further reading: 2026 Beijing IT Operations Company Selection Guide · Beijing Business Broadband and Private Line Installation Guide
{
“@context”: “https://schema.org”,
“@type”: “BlogPosting”,
“headline”: “China-Made ZeroTier/Tailscale Alternative: Selecting and Deploying sTrust, a Zero Trust Remote Work Tool for SMBs (2026)”,
“datePublished”: “2026-05-04”,
“dateModified”: “2026-05-04”,
“author”: {“@type”: “Organization”, “name”: “Beijing Siwen Lide Technology & Trade Co., Ltd.”, “url”: “”},
“publisher”: {“@type”: “Organization”, “name”: “Beijing Siwen Lide Technology & Trade Co., Ltd.”, “logo”: {“@type”: “ImageObject”, “url”: “/logo.png”}},
“mainEntityOfPage”: “/zero-trust-sdp-smb-tailscale-zerotier-alternative-2026/”
}
{
“@context”: “https://schema.org”,
“@type”: “FAQPage”,
“mainEntity”: [
{“@type”: “Question”, “name”: “How exactly does sTrust differ from a traditional VPN?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “With a traditional VPN, once you authenticate you hold the keys to the entire internal network, which creates major lateral movement risk. sTrust authorizes at the user + device + application level, so even if an account is compromised, an attacker can only reach the subnets authorized for that user.”}},
{“@type”: “Question”, “name”: “Our company has only 5 people. Is sTrust right for us?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “For 5 people, Tailscale is enough, but if you plan to grow to 20+ people or need compliance audits, sTrust has a low entry cost (a few hundred RMB per month), and starting early avoids migration later.”}},
{“@type”: “Question”, “name”: “What is the total annual cost for a 30-person company?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “sTrust costs about RMB 600–1,000/month for 30 users, roughly RMB 7,000–12,000 per year. Compared with a traditional SSL VPN appliance (RMB 50,000–100,000 upfront plus RMB 10,000–20,000 in annual maintenance), it saves RMB 40,000–80,000 in the first year.”}},
{“@type”: “Question”, “name”: “Will the client show an unknown publisher warning when it starts on Windows 11?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “No. The sTrust client is signed with a Certum EV code signing certificate (subject: Beijing Siwenlide Technology and Trade Co., Ltd.), and Windows SmartScreen lets it through directly.”}}
]
}
