On-premises sites
One site, one routing device
A small always-on Linux host inside the building runs the agent and carries traffic to the machines that never will: printers, cameras, PLCs, lab instruments. Nothing else in the site changes.
Free plan · No card · Hosts behind a route aren't devices
The problem
A box at the edge, or a host inside
Reaching into one building is the job a remote-access VPN used to do. It needs one machine inside the site, not a concentrator in front of it.
A concentrator at the perimeter
It needs a public address, an inbound rule and a maintenance window. Patching it ends every session at once.
An ordinary host on the LAN
A small Linux machine that stays on, deliberately not the site router. Rebuild it and the office keeps working.
One route for the whole /24
Advertise 192.168.1.0/24 and a laptop whose home router uses that range has two ways to go. Everyone allowed to reach the printer also reaches the controller beside it.
Each machine named on its own
The label printer, the build server and the PLC are separate resources in separate groups. Support reaches the printer, engineering reaches the build server.
How it works
Pick the machine, name the things
The only change inside the site is the host you install the agent on.
One always-on host
A small Linux machine or VM on the same LAN as the things you need. It only has to stay on and forward.
Read moreName the hosts, not the subnet
One resource per printer, server or appliance, grouped by who needs it. Advertise a whole range only when listing the hosts is impractical.
Read moreA rule for each group
Support to the label printer. Engineering to the build server. A route on its own grants nothing until a rule says so.
Read moreWhat you get
The machines that will never run an agent
Printers, cameras, PLCs
Lab instruments and building controllers too. None of them need the agent: the routing device is the only machine in the site that runs one.
Read moreHide source IP, on by default
Traffic arrives from the routing device's LAN address, so nothing on the LAN has to know the network exists. Turn it off and the client keeps its own address, which is what per-host firewall rules and readable logs need. The LAN then needs a static route back.
Read moreSame office, no detour
Two machines on the same LAN connect directly. That traffic never leaves the building.
Read moreStart with one building
One host, a list of the machines behind it, one rule. The label printer answers from your laptop.
Free plan · No card · Routes and access rules on every plan