--- title: SASE with Zscaler, Ubiquiti and Hetzner for SMEs description: "Reduce costs and increase security: Discover how SMBs can implement a simple and effective IT architecture with Zscaler, Ubiquiti and Hetzner Main point of summary: The concept presented enables SMBs to implement a cost-effective and secure IT architecture that is easy to manage and does not require expensive enterprise features by using Zscaler, Ubiquiti and Hetzner." image: https://rheintec.io/hubfs/SASE%20with%20Hetzne%2c%20Ubiquiti%20und%20Zscaler.png --- [Skip to content](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#main-content) [![Rheintec logo](https://rheintec.io/hubfs/website_assets/logo/logo-white.svg "Rheintec logo")](https://rheintec.io/home?hsLang=en) - [ KMU ](https://kmu.rheintec.io/de-ch/it-fuer-kmus) - [Enterprise](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Enterprise - [Consulting](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Consulting - [ IT Security Consulting ](https://rheintec.io/en/consulting/security/it-security-consulting) - [ Cyber Security Review ](https://rheintec.io/en/consulting/cybersecurity-review) - [ Governance, Risk & Compliance Consulting ](https://rheintec.io/en/consulting/compliance-and-governance) - [Zscaler](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Zscaler - [ Zscaler Architecture Consulting ](https://rheintec.io/en/consulting/zscaler/architecture-consulting) - [ Zscaler Health Checks ](https://rheintec.io/en/consulting/zscaler/healthchecks) - [ Zscaler Automation ](https://rheintec.io/en/consulting/zscaler/automation) - [ Zscaler Proof of Concepts ](https://rheintec.io/en/consulting/zscaler/proof-of-concept) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [ Solutions ](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#services) Show submenu for Solutions - [ Bring Your Own Device (BYOD) ](https://rheintec.io/en/solutions/zscaler-remote-browser-access) - [ CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Secure Access Service Edge (SASE) ](https://rheintec.io/en/solutions/secure-access-service-edge) - [ Secure Service Edge ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler Data Security ](https://rheintec.io/en/solutions/zscaler-data-security) - [ SD-WAN & WAN-Edge ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [Managed Services](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Managed Services - [ Managed Security Services ](https://rheintec.io/en/managed-security-services) - [ Small & Medium Companies (5-250) ](https://rheintec.io/managed-services/small-medium-companies-smb) Show submenu for Small & Medium Companies (5-250) - [ Zscaler 4 Small Businesses ](https://rheintec.io/en/managed-services/small-companies/zscaler-sse-4-small-businesses) - [ CrowdStrike XDR 4 Small Businesses ](https://rheintec.io/en/en/managed-services/small-companies/crowdstrike-xdr-4-small-businesses) - [ Mimecast 4 Small Businesses ](https://rheintec.io/de/mimecast-for-kmu) - [ Proofpoint 4 Small Businesses ](https://rheintec.io/en/rheintec-proofpoint-mail-sicherheit-f%C3%BCr-kmu-kleinunternehmen) - [ Small Business Secure ](https://rheintec.io/en/managed-services/small-companies/small-business-secure) - [ Small Business Complete ](https://rheintec.io/en/managed-services/small-companies/small-business-complete) - [ Medium Business Complete
 ](https://rheintec.io/en/managed-services/medium-companies/medium-business-complete) - [ Enterprises (250+) ](https://rheintec.io/managed-services/enterprise) Show submenu for Enterprises (250+) - [ Wiz CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Zscaler SSE ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler PSE as a Service ](https://rheintec.io/en/managed-services/enterprises/zscaler-pse) - [ CrowdStrike XDR ](https://rheintec.io/en/managed-services/enterprises/crowdstrike-xdr) - [ Mimecast Email Security ](https://rheintec.io/en/mimecast-for-enterprise) - [ Mimecast DMARC Monitoring ](https://rheintec.io/en/managed-services/enterprises/mimecast-dmarc) - [ Proofpoint Email Security ](https://rheintec.io/en/managed-services/enterprises/proofpoint-emailsecurity) - [ Cloudflare WAF ](https://rheintec.io/en/managed-services/enterprises/cloudflare-waf) - [ Cloudflare Zero Trust ](https://rheintec.io/en/cloudflare-sse-zero-trust-cloud-proxy) - [ Cloudflare DNS ](https://rheintec.io/en/managed-services/enterprises/cloudflare-dns) - [ Check Point Datacenter and Cloud Firewall ](https://rheintec.io/en/managed-services/enterprises/checkpointdatacenter) - [ Keeper PAM ](https://rheintec.io/en/managed-services/enterprises/keeper-pam) - [ Keeper Password Manager ](https://rheintec.io/en/managed-services/enterprises/password-manager) - [ Rubrik Backup & Data Protection ](https://rheintec.io/en/managed-services/enterprises/rubrik-backup) - [ Ubiquitiy WAN-Edge & SD-WAN ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Case Studies ](https://rheintec.io/case-studies-rheintec) - [ Blog ](https://rheintec.io/en/it-security-blog) - [About](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for About - [ Partner ](https://rheintec.io/de/partners) - [ About us ](https://rheintec.io/de/about) - [ Karriere ](https://rheintec.io/de/karriere) - [ KMU ](https://kmu.rheintec.io/de-ch/it-fuer-kmus) - [Enterprise](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Enterprise - [Consulting](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Consulting - [ IT Security Consulting ](https://rheintec.io/en/consulting/security/it-security-consulting) - [ Cyber Security Review ](https://rheintec.io/en/consulting/cybersecurity-review) - [ Governance, Risk & Compliance Consulting ](https://rheintec.io/en/consulting/compliance-and-governance) - [Zscaler](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Zscaler - [ Zscaler Architecture Consulting ](https://rheintec.io/en/consulting/zscaler/architecture-consulting) - [ Zscaler Health Checks ](https://rheintec.io/en/consulting/zscaler/healthchecks) - [ Zscaler Automation ](https://rheintec.io/en/consulting/zscaler/automation) - [ Zscaler Proof of Concepts ](https://rheintec.io/en/consulting/zscaler/proof-of-concept) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [ Solutions ](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#services) Show submenu for Solutions - [ Bring Your Own Device (BYOD) ](https://rheintec.io/en/solutions/zscaler-remote-browser-access) - [ CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Secure Access Service Edge (SASE) ](https://rheintec.io/en/solutions/secure-access-service-edge) - [ Secure Service Edge ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler Data Security ](https://rheintec.io/en/solutions/zscaler-data-security) - [ SD-WAN & WAN-Edge ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Z-Automate ](https://rheintec.io/en/zscaler-automation-tool) - [Managed Services](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for Managed Services - [ Managed Security Services ](https://rheintec.io/en/managed-security-services) - [ Small & Medium Companies (5-250) ](https://rheintec.io/managed-services/small-medium-companies-smb) Show submenu for Small & Medium Companies (5-250) - [ Zscaler 4 Small Businesses ](https://rheintec.io/en/managed-services/small-companies/zscaler-sse-4-small-businesses) - [ CrowdStrike XDR 4 Small Businesses ](https://rheintec.io/en/en/managed-services/small-companies/crowdstrike-xdr-4-small-businesses) - [ Mimecast 4 Small Businesses ](https://rheintec.io/de/mimecast-for-kmu) - [ Proofpoint 4 Small Businesses ](https://rheintec.io/en/rheintec-proofpoint-mail-sicherheit-f%C3%BCr-kmu-kleinunternehmen) - [ Small Business Secure ](https://rheintec.io/en/managed-services/small-companies/small-business-secure) - [ Small Business Complete ](https://rheintec.io/en/managed-services/small-companies/small-business-complete) - [ Medium Business Complete
 ](https://rheintec.io/en/managed-services/medium-companies/medium-business-complete) - [ Enterprises (250+) ](https://rheintec.io/managed-services/enterprise) Show submenu for Enterprises (250+) - [ Wiz CNAPP ](https://rheintec.io/en/managed-services/enterprises/wiz) - [ Zscaler SSE ](https://rheintec.io/en/managed-services/enterprises/zscaler-sse) - [ Zscaler PSE as a Service ](https://rheintec.io/en/managed-services/enterprises/zscaler-pse) - [ CrowdStrike XDR ](https://rheintec.io/en/managed-services/enterprises/crowdstrike-xdr) - [ Mimecast Email Security ](https://rheintec.io/en/mimecast-for-enterprise) - [ Mimecast DMARC Monitoring ](https://rheintec.io/en/managed-services/enterprises/mimecast-dmarc) - [ Proofpoint Email Security ](https://rheintec.io/en/managed-services/enterprises/proofpoint-emailsecurity) - [ Cloudflare WAF ](https://rheintec.io/en/managed-services/enterprises/cloudflare-waf) - [ Cloudflare Zero Trust ](https://rheintec.io/en/cloudflare-sse-zero-trust-cloud-proxy) - [ Cloudflare DNS ](https://rheintec.io/en/managed-services/enterprises/cloudflare-dns) - [ Check Point Datacenter and Cloud Firewall ](https://rheintec.io/en/managed-services/enterprises/checkpointdatacenter) - [ Keeper PAM ](https://rheintec.io/en/managed-services/enterprises/keeper-pam) - [ Keeper Password Manager ](https://rheintec.io/en/managed-services/enterprises/password-manager) - [ Rubrik Backup & Data Protection ](https://rheintec.io/en/managed-services/enterprises/rubrik-backup) - [ Ubiquitiy WAN-Edge & SD-WAN ](https://rheintec.io/en/managed-services/enterprises/ubiquitiy-wan-edge) - [ Case Studies ](https://rheintec.io/case-studies-rheintec) - [ Blog ](https://rheintec.io/en/it-security-blog) - [About](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs#) Show submenu for About - [ Partner ](https://rheintec.io/de/partners) - [ About us ](https://rheintec.io/de/about) - [ Karriere ](https://rheintec.io/de/karriere) [ Kostenlose Beratung anfordern ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLJhOjx3NEjl3dTzs3alex%2B2Sz%2BrhHiNeNPr3qhM%2Bmnd1xhH0hZc85R016Zfr4tNiAXpoJQutSl0RRl7l33WGIvDzQIOIR%2FMvZZ4ouwxGAFoXaQFdiHiPwDtXR0sbIfzA1ujA5%2BwzxqPoZeWO7EECpw3hpDCs%2BgvNAkrhioMf3iQWFSgkHyl51blL5ZZHc6r9v50UNaVzw%3D%3D&portalId=48452581) English - [Deutsch](https://rheintec.io/de/it-security-blog/sase-mit-zscaler-ubiquiti-hetzner-f%C3%BCr-kmus) - [English](https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs) # SASE with Zscaler, Ubiquiti, and Hetzner for SMEs [ Linus Espach ](https://rheintec.io/en/it-security-blog/author/linus-espach) - Feb 16, 2026 4:27:58 PM SMEs need one thing above all: simple, secure and ![](https://rheintec.io/hs-fs/hubfs/SASE%20with%20Hetzne%2c%20Ubiquiti%20und%20Zscaler.png?width=194&height=194&name=SASE%20with%20Hetzne%2c%20Ubiquiti%20und%20Zscaler.png)cost-effective architecture approaches so that IT and security become enablers rather than spoilsports. At Rheintec, we deliver exactly that with architecture concepts that are unparalleled on the market, with the aim of helping our customers lead the competition through secure digitalization. ## What it's all about - We **clearly reduce costs** by replacing unnecessary and expensive components such as firewalls and MPLS - We create a healthy and major **security baseline** for SMEs by using Zscaler as the market leader - We enable small internal teams **to operate** intelligent architectures **easily** - Our concept is **modularly expandable** --- ## Why this combination A brief look at the key data and function is necessary: Zscaler: - Market leader in the SSE (Zero Trust Network Access) sector - Cloud-native solution: Very low deployment and scaling effort (Security as a Service) - Extremely powerful security solution that gives users easy access to internal and external resources from anywhere. Ubiquiti: - Extremely simple but sufficiently powerful solution to map SD-WAN, WiFi and switching in the local network at the sites - Few seucirty functions, but a functional layer 4 firewall - License-free: No tens of thousands of francs for licenses for firewalls, switches and access points Hetzner: - Is a Bavarian cloud provider that makes it possible to host servers, applications and containers at a third of the cost of Azure, AWS and GCP - Offers a cloud firewall and backup as an easy-to-activate service - Does not have powerful enterprise functions, which an SME does not need and therefore does not pay for ## Context and reality check What is immediately apparent: Hetzner and Ubiquiti only have limited security functions. In fact, this is precisely the reason why we propose these components for SMEs: - Our concept almost completely degenerates the local network into "dumb" Internet access. Security is handled entirely with the market leader Zscaler in the cloud. - SMEs do not need these enterprise functions! Most SMEs we encounter already lack an existing security baseline. Instead of spending money on enterprise functionalities that these SMEs can't use anyway, we create a secure, micro-segmented baseline with maximum cost-benefit factor - The concept is modularly expandable with a WAF (e.g. Cloudflare), an MDR (e.g. fully managed with 24/7 service from the manufacturer), a SIEM (also from CrowdStrike, as most of the data comes from the endpoint anyway), a PAM for privileged access (e.g. Keeper), a mail server, a security management system (e.g. a security management system) and a security management system (e.g. a security management system).e.g. Keeper), a mail security gateway and awareness training from Proofpoint or Mimecast, an additional NAC that can be integrated with Ubiquiti (802.1.x) or an extended backup for more fine granularity such as Acronis and Rubrik. - No other architecture offers more added value for the francs invested - The infrastructure is extremely easy to operate, even for small teams without enterprise know-how - It creates noticeable added UX value for both end users (open the device and be connected everywhere) and admins (administration of these products is extremely simple and efficient) ## Architecture details ![Architecture SASE with Hetzne, Ubiquiti und Zscaler](https://rheintec.io/hs-fs/hubfs/Architecture%20SASE%20with%20Hetzne%2c%20Ubiquiti%20und%20Zscaler.png?width=4455&height=3056&name=Architecture%20SASE%20with%20Hetzne%2c%20Ubiquiti%20und%20Zscaler.png) Hetzner is used as a cloud solution for IaaS and PaaS. The resources are easy to deploy, are located in Europe and are extremely affordable. We use the built-in firewall for East-West communication. Servers can be grouped and segmented from each other on the application side. The built-in backup module is also activated as standard, allowing resources to be restored at the touch of a button. Zscaler is used as a Zero Trust Network solution via an agent on the clients in order to obtain micro-segmented access to the resources in the Hetzner cloud. App connectors are deployed for this purpose. The cloud does not need a single inbound port open for this approach and can remain completely inaccessible from the outside. Zscaler also filters user access to web applications, as this is one of the biggest attack vectors. Finally, Ubiquiti is used to provide the entire local network stack at the sites. We are talking about layer 2 with switching and WiFi and layer 3 with a built-in firewall and SD-WAN. If required, the gateways can be designed redundantly using HA clusters. The sites are networked via inexpensive FTTH (fiber) connections with optional provider SLA (we recommend Init7 for direct termination without an additional provider router) and 5G redundancy. Ultimately, the locations only need to segment simple network zones such as guest WiFi (for which we have developed our own captive portal with SMS authentication, see go-online.io), IoT, servers, internal clients and OT. All security and app access is via Zscaler, whereby the clients require no more than Internet access. [Zscaler](https://rheintec.io/en/it-security-blog/tag/zscaler), [SASE](https://rheintec.io/en/it-security-blog/tag/sase), [Cloud Security](https://rheintec.io/en/it-security-blog/tag/cloud-security), [Cost Optimization](https://rheintec.io/en/it-security-blog/tag/cost-optimization), [Ubiquiti](https://rheintec.io/en/it-security-blog/tag/ubiquiti), [Network Security & SD-WAN](https://rheintec.io/en/it-security-blog/tag/network-security-sd-wan) ### You might like ##### [Cloud Network Management: Ubiquiti's Edge in the Enterprise Market](https://rheintec.io/en/it-security-blog/cloud-network-management-ubiquitis-edge-in-the-enterprise-market?hsLang=en) Ubiquiti's seamless transition from home networking to enterprise solutions sets a new standard in cloud network management and multivendor SASE in combination with Zscaler. [![Ubiquiti Logo](https://rheintec.io/hs-fs/hubfs/Ubiquiti-Logo.jpg?width=352&name=Ubiquiti-Logo.jpg) ](https://rheintec.io/en/it-security-blog/how-to-setup-vpn-tunnels-von-ubiquiti-zu-zscaler-0?hsLang=en) ##### [Setup VPN tunnels from Ubiquiti to Zscaler](https://rheintec.io/en/it-security-blog/how-to-setup-vpn-tunnels-von-ubiquiti-zu-zscaler-0?hsLang=en) Problem: Many IoT/OT devices, servers and legacy systems do not support agents (e.g. Zscaler Client Connector).Solution: IPSec tunnels from UniFi Gateways to Zscaler (ZIA) to centrally inspect and filter HTTP/HTTPS traffic - without an agent on the endpoint device.Added value: Unified SSE... [![rheintec logo](https://rheintec.io/hs-fs/hubfs/rheintec-blue-symb-2.png?width=352&name=rheintec-blue-symb-2.png) ](https://rheintec.io/en/it-security-blog/check-point-fortinet-or-zscaler-which-threat-prevention-solution-gives-your-business-the-competitive-edge?hsLang=en) ##### [Threat prevention comparisment](https://rheintec.io/en/it-security-blog/check-point-fortinet-or-zscaler-which-threat-prevention-solution-gives-your-business-the-competitive-edge?hsLang=en) In today’s rapidly evolving threat landscape, CISOs and IT security leaders face an unprecedented volume of cyberattacks targeting operations, data integrity, and compliance mandates. As enterprises accelerate cloud adoption and hybrid workforces, the ability to proactively detect, mitigate, and... ## How much does IT security cost for your SMB? Easily estimate your IT security expenses with our pricing calculator. [ Check our pricing calculator ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLLdDaGp037PwumG%2BW1z1Azp65Anr6w1bT6quyIouhPKiq9x7zfbiD2B5x7NH%2Bq7KohFerMK6uORsvnlI7w%2F%2Bcc42MZwuwbW7LvWtuiY1SdwKH3wM5erK5rc7V%2Bo4C75GnQhTIVya%2B8KfbeTtmznXJYqAgmVKwW7AKWj14zj0TvjCQ%3D%3D&portalId=48452581) [![logo-white](https://rheintec.io/hubfs/website_assets/logo/logo-white.svg "logo-white")](https://rheintec.io?hsLang=en) [Legal Notice](https://rheintec.io/legal-notice?hsLang=en) [Privacy Policy](https://rheintec.io/en/privacy-policy?hsLang=en) [Careers](https://rheintec.io/de/karriere?hsLang=en) [![rht-tuev-iso-9001](https://rheintec.io/hubfs/website_assets/iso/rht-tuev-iso-9001.webp)](https://rheintec.io/hubfs/Rheintec%20ISO%209001%20EN.pdf?hsLang=en) [![rht-tuev-iso-iec-27001](https://rheintec.io/hs-fs/hubfs/website_assets/iso/rht-tuev-iso-iec-27001.png?width=200&height=95&name=rht-tuev-iso-iec-27001.png)](https://rheintec.io/hubfs/Rheintec%20ISO%2027001%20EN.pdf?hsLang=en)   Locations ![switzerland flag](https://rheintec.io/hs-fs/hubfs/website_assets/flags/switzerland%20flag.webp?width=80&height=49&name=switzerland%20flag.webp) Rheintec Solutions AG Uferstrasse 90, CH-4057 Basel ![germany flag](https://rheintec.io/hs-fs/hubfs/website_assets/flags/germany%20flag.png?width=60&height=37&name=germany%20flag.png) Rheintec Solutions GmbH Gartenstrasse 28 • DE-86938 Schondorf am Ammersee Contact Us +41 (0) 61 568 73 95 info@rheintec.ch Subscribe to our newsletter for security insights. © 2026 All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Linus Espach", "url" : "https://rheintec.io/en/it-security-blog/author/linus-espach" }, "dateModified" : "2026-02-16T15:27:58.552Z", "datePublished" : "2026-02-16T15:27:58.000Z", "headline" : "SASE with Zscaler, Ubiquiti and Hetzner for SMEs", "image" : [ "https://rheintec.io/hubfs/SASE%20with%20Hetzne%2c%20Ubiquiti%20und%20Zscaler.png" ], "mainEntityOfPage" : { "@id" : "https://rheintec.io/en/it-security-blog/sase-with-zscaler-ubiquiti-hetzner-for-smbs", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://rheintec.io/hubfs/rheintecblue.png" }, "name" : "Rheintec Solutions AG" } } ```