Encrypted tunnels into the QCloud — engineered for Pakistan's enterprise.
QCloud Virtual Private Network (VPN) is a fully managed IPsec service that connects your data center, your branch offices, and your remote teams to QCloud — over redundant, AES-256-encrypted tunnels, terminated inside KHI-1 and ISB-1. Provision a site-to-site gateway in minutes. Pay by the hour, in PKR.
TRUSTED BY PAKISTAN'S HYBRID-CLOUD ENTERPRISES
Active VPN tunnels across QCloud
Median time to provision a new VPN gateway
Tunnel availability SLA
Bytes that ever leave Pakistan
Production telemetry · KHI-1 + ISB-1 · 12-month rolling window.
Two VPN patterns. One managed service. Zero offshore hops.
QCloud VPN gives you both flavors of enterprise VPN — gateway-to-gateway for connecting whole networks, and host-to-gateway for connecting individual users — under a single self-service control plane. Every tunnel is IPsec, every byte is encrypted, every endpoint sits inside Pakistan.
Site-to-Site VPN (gateway ↔ gateway)
Connect an entire on-premise network — your HQ, a branch office, a partner data center — to a QCloud VPC. Two redundant tunnels per connection, BGP or static routing, NAT-T support, AES-256 encryption. Survives ISP-level failover.
Up to 1.25 Gbps per tunnel · 2 redundant tunnels per VPN · < 4 min provisioning
Learn moreClient VPN (host ↔ gateway)
Give remote employees, contractors, and traveling staff secure access to QCloud workloads from any device. TLS- or IPsec-based client VPN, certificate or AD-based auth, granular access policies, full audit logs.
Unlimited concurrent sessions · per-account isolated client VPN · zero per-user license fees
Learn moreEvery tunnel, every state, at a glance.
The QCloud console gives network engineers a live, single-pane view of every IPsec tunnel — phase-1 / phase-2 status, throughput per tunnel, BGP routes received, re-key countdowns, and dead-peer-detection metrics — without leaving the browser.
- 10.10.0.0/16 → tunnel-1
- 10.20.0.0/16 → tunnel-1
- 192.168.50.0/24 → tunnel-2
- 172.16.0.0/12 → tunnel-1
- 0.0.0.0/0 → vgw
Built on four promises every network engineer asks for.
Secure by default.
Every tunnel runs IPsec with IKEv2 key exchange, AES-256-GCM encryption, SHA-2 integrity, and Diffie-Hellman groups 14 through 24. Pre-shared keys are stored in QCloud's HSM-backed KMS. Self-service tunnel creation through the console — no support ticket, no shared keys over email.
Provisioned in minutes, not weeks.
Specify your peer IP, your CIDR ranges, your routing mode, and your encryption profile — the console returns a working tunnel in under 4 minutes. A complete config file (Cisco ASA, Fortinet, MikroTik, pfSense, Palo Alto) is auto-generated for your customer gateway device.
Redundant by design.
Every site-to-site VPN includes two parallel tunnels, terminated on independent QCloud gateways across availability zones. Active/active or active/standby — your choice. BGP-based failover routes traffic to the healthy tunnel in seconds when one drops.
Sovereign. End to end.
Both VPN gateways terminate inside PTCL's Tier-3 / Rated-3 certified data centers in Karachi (KHI-1) and Islamabad (ISB-1). Encrypted traffic never traverses an offshore network. SBP, PTA, and PECA data-residency requirements satisfied by architecture.
From your data center to your VPC — a tunnel, two regions, zero offshore hops.
Every IPsec parameter we support, on the record.
Bring your existing customer gateway device. Match these parameters. Your tunnel comes up on the first try.
Don't see your device? Talk to a network architect →
Six patterns we ship every month — for the workloads that move Pakistan.
Core banking, behind a tunnel.
Connect on-prem core banking and KYC systems to QCloud-hosted analytics, fraud-detection, and DR workloads — over BGP-routed redundant tunnels. SBP-compliant by architecture.
● 4 of Pakistan's top 12 banks
BSS / OSS hybrid in minutes.
Site-to-site tunnels between PTCL-hosted billing infrastructure and QCloud-hosted analytics; tunnels span KHI-1 and ISB-1 for active/active resilience.
● 3 national telcos · 22 tunnels active
Sovereign hybrid, zero offshore.
Federal and provincial workloads tunneled from government data centers into PECA-aligned QCloud VPCs — air-gapped from the public internet via private IP VPN where required.
● 7 federal agencies onboarded
Branches to cloud, branches to each other.
Hub-and-spoke topology: every retail branch tunnels into a central QCloud VPC, branches communicate to each other through the cloud hub. Single firewall ruleset. One audit trail.
● 200+ branches across 6 retailers
EMR over IPsec, HIPAA-style.
Clinical workstations and lab pipelines reach EMR / PACS workloads in QCloud through encrypted tunnels. AES-256 + audit logs satisfy in-country HIPAA-equivalent controls.
● HSM-backed keys · 7-yr audit log
Client VPN for the distributed team.
Per-employee certificate-based client VPN. Split-tunnel for SaaS traffic, full-tunnel for production. Per-user logging, central revocation, integration with your AD.
● Up to 5,000 concurrent sessions
Why QCloud VPN, and not the next-best thing.
| Criterion | QCloud VPN RECOMMENDED | AWS Site-to-Site VPN | Self-managed pfSense / Cisco | Leased line (P2P / MPLS) |
|---|---|---|---|---|
| Time to deploy | < 4 minutes | < 30 minutes | Days to weeks | 4–8 weeks |
| Hardware to purchase | None | None | Yes — appliance + license | Yes — telco equipment |
| Encryption included | AES-256 / IPsec ✓ | AES-256 / IPsec ✓ | DIY | ✕ Not by default |
| Tunnel redundancy | 2 tunnels, cross-AZ | 2 tunnels, cross-AZ | DIY | Single circuit unless dual |
| Data residency | 🇵🇰 100% in-country | Offshore (ap-south-1) | Yours | In-country |
| Billing currency | PKR ✓ | USD (FX exposure) | Capex + ops | PKR (high) |
| 24/7 support | In-country specialists | Offshore queues | None | Telco SLA |
| Monthly cost (estimate) | PKR ~9,500 / VPN | ~PKR 15,000 / VPN @ FX | Capex spread | PKR 80k–250k |
Most enterprises moving off self-managed pfSense or a leased line cut total connectivity cost by 30–50% in the first quarter — without losing a single SLA second.
Pay by the hour. Settle in rupees. No FX. No mystery line items.
Starter — Single tunnel
Best for dev / staging hybrid, one branch office
- 1 IPsec tunnel
- Static routing
- 200 Mbps cap
- Single-AZ termination
Production Pair — Dual redundant tunnels
The default for serious workloads
- 2 IPsec tunnels
- BGP routing
- 1.25 Gbps per tunnel
- Cross-AZ termination
- 99.99% SLA
Enterprise — Concentrator + multi-site
Hub-and-spoke / multi-site / BGP at scale
- Up to 50 peer sites
- BGP route exchange
- Private IP VPN over Direct Connect
- 5 Gbps tunnels available
- Dedicated TAM
Illustrative only · billed by the hour
🇵🇰 Billed in PKR · no FX exposure · egress between your tunnels and your VPC is free
From peer-IP to packet-flow — five steps, four minutes.
Median provisioning time across all customers: 3m 42s · Last 30 days · KHI-1 + ISB-1
Everything you wanted to ask before you build your first tunnel.
Provision your first tunnel — on the house.
$100 in QCloud credit. A 1-month free trial of VPN, VPC, and ECS. A real network architect on the call from day one. Migration support from AWS, Azure, or self-managed pfSense — all included.
No credit card required · Production workloads welcome · PKR billing