diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a66d32294f77..21e53a2ecc94 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14127,6 +14127,12 @@
     githubId = 8794235;
     name = "Tom Siewert";
   };
+  tonyshkurenko = {
+    email = "support@twingate.com";
+    github = "tonyshkurenko";
+    githubId = 8597964;
+    name = "Anton Shkurenko";
+  };
   toonn = {
     email = "nixpkgs@toonn.io";
     matrix = "@toonn:matrix.org";
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index 688f0f47676c..9b6e755fd470 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -561,6 +561,14 @@
           <link xlink:href="options.html#opt-services.prometheus.exporters.smartctl.enable">services.prometheus.exporters.smartctl</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://docs.twingate.com/docs/linux">twingate</link>,
+          a high performance, easy to use zero trust solution that
+          enables access to private resources from any device with
+          better security than a VPN.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-incompatibilities">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index 1ff2e826c601..fc4b44957c36 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -164,6 +164,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [smartctl_exporter](https://github.com/prometheus-community/smartctl_exporter), a Prometheus exporter for [S.M.A.R.T.](https://en.wikipedia.org/wiki/S.M.A.R.T.) data. Available as [services.prometheus.exporters.smartctl](options.html#opt-services.prometheus.exporters.smartctl.enable).
 
+- [twingate](https://docs.twingate.com/docs/linux), a high performance, easy to use zero trust solution that enables access to private resources from any device with better security than a VPN.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 - The NixOS VM test framework, `pkgs.nixosTest`/`make-test-python.nix` (`pkgs.testers.nixosTest` since 22.05), now requires detaching commands such as `succeed("foo &")` and `succeed("foo | xclip -i")` to close stdout.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9faa58409b19..a2d67afe1378 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -988,6 +988,7 @@
   ./services/networking/tox-node.nix
   ./services/networking/toxvpn.nix
   ./services/networking/tvheadend.nix
+  ./services/networking/twingate.nix
   ./services/networking/ucarp.nix
   ./services/networking/unbound.nix
   ./services/networking/unifi.nix
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
new file mode 100644
index 000000000000..17140bffd218
--- /dev/null
+++ b/nixos/modules/services/networking/twingate.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.twingate;
+
+in {
+
+  options.services.twingate = {
+    enable = mkEnableOption (lib.mdDoc "Twingate Client daemon");
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.firewall.checkReversePath = lib.mkDefault false;
+    networking.networkmanager.enable = true;
+
+    environment.systemPackages = [ pkgs.twingate ]; # for the CLI
+    systemd.packages = [ pkgs.twingate ];
+
+    systemd.services.twingate.preStart = ''
+      cp -r -n ${pkgs.twingate}/etc/twingate/. /etc/twingate/
+    '';
+
+    systemd.services.twingate.wantedBy = [ "multi-user.target" ];
+  };
+}
diff --git a/pkgs/applications/networking/twingate/default.nix b/pkgs/applications/networking/twingate/default.nix
new file mode 100644
index 000000000000..33e0820bec9f
--- /dev/null
+++ b/pkgs/applications/networking/twingate/default.nix
@@ -0,0 +1,51 @@
+{ autoPatchelfHook
+, curl
+, dpkg
+, dbus
+, fetchurl
+, lib
+, libnl
+, udev
+, cryptsetup
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "twingate";
+  version = "1.0.60";
+
+  src = fetchurl {
+    url = "https://binaries.twingate.com/client/linux/DEB/${version}/twingate-amd64.deb";
+    sha256 = "b308c422af8a33ecd58e21a10a72c353351a189df67006e38d1ec029a93d5678";
+  };
+
+  buildInputs = [ dbus curl libnl udev cryptsetup ];
+  nativeBuildInputs = [ dpkg autoPatchelfHook ];
+
+  unpackCmd = "mkdir root ; dpkg-deb -x $curSrc root";
+
+  postPatch = ''
+    while read file; do
+      substituteInPlace "$file" \
+        --replace "/usr/bin" "$out/bin" \
+        --replace "/usr/sbin" "$out/bin"
+    done < <(find etc usr/lib usr/share -type f)
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv etc $out/
+    mv usr/bin $out/bin
+    mv usr/sbin/* $out/bin
+    mv usr/lib $out/lib
+    mv usr/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "Twingate Client";
+    homepage = "https://twingate.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ tonyshkurenko ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6a75e1aadb79..851ce6eac773 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26052,6 +26052,8 @@ with pkgs;
 
   twa = callPackage ../tools/networking/twa { };
 
+  twingate = callPackage ../applications/networking/twingate { };
+
   # Upstream U-Boots:
   inherit (callPackage ../misc/uboot {})
     buildUBoot