Connectivity that just works

• Hole punching gets through most home and office NAT
• Works on cellular and other CGNAT networks
• Falls back to an encrypted relay when no direct path exists
• Runs near line speed on most x86 Linux hosts

When is a connection relayed? Typically when both sides sit behind hard NAT, such as CGNAT or symmetric NAT. Relays forward encrypted packets and can't read them.

NAT traversal guide →

• Use Okta, Google, Microsoft Entra ID, or any OIDC provider
• Endpoints get their role automatically when they enroll
• Access ends when sign-in expires, or block a host at any time
• Admins sign in to the admin panel with SSO too

SSO setup guide →

• Every connection is mutually authenticated with certificates
• Inbound traffic is denied by default; rules allow by role and tag
• Hosts need no open inbound ports or port forwards
• Encrypted with the Noise Protocol Framework

Firewall rules guide →

• We run your CA and rotate certificates automatically
• A managed lighthouse is included, or run your own
• Config and firewall changes reach hosts within a minute
• Audit logs show who changed what, and when

Architecture overview →