Site to site
Every site on one network
One device per site advertises the subnet behind it. Printers and old servers keep their addresses. No tunnel per pair.
Free plan · No card · Routes included
The problem
Tunnels multiply. A network doesn't.
A tunnel per pair means the work grows with the square of the site count.
A tunnel per pair
Four sites is six tunnels, ten is forty-five. Each with its own keys, MTU and way of failing.
One device per site
It advertises the subnet behind it. The tenth site is the same work as the second.
A public address per site
IPsec needs a reachable address and an inbound rule on one end. A branch behind carrier-grade NAT can't be it.
Outbound only, every site
Each site's device dials out and negotiates a direct path through NAT. If that fails, an encrypted relay takes over.
How it works
Every site, the same three steps
The only change at the site is the one device you install.
One device per site
A small Linux host, a VM or a router runs the agent. Everything behind it stays as it is.
Read moreAdvertise the subnet
A route names the address range and the device that carries traffic into it. Hosts there need no agent.
Read moreWrite the access rules
Which groups, which hosts, which ports. Nothing until a rule says so. Failing a device requirement ends access.
Read moreReplacing an appliance
Alongside first, then off
If the sites hang off a VPN appliance today, nothing has to move in one night window. Each step stands on its own, and nothing on the appliance changes until the last.
Run alongside
Install the agent on machines that already talk through the appliance. Nothing on the box changes.
Move one site
A device at the site advertises its subnet. Allow one group in, then run real traffic on both paths.
Retire the appliance
When nothing depends on the old path, switch it off. The renewal and the HA pair go too.
What you get
Same addresses, direct paths
Nothing renumbered
Only devices running the agent get a 100.x address. Hosts behind a route keep theirs.
Read moreDirect between sites
Office to cloud goes direct, encrypted end to end. Nothing in the middle reads it.
Read moreOne place to look
Every site, route and device in one list, each device marked online or not.
Read moreOne site, then the next
One box at the site, one route, and the printer is reachable from your laptop.
Hosts behind a route aren't devices