# Underpass

> Underpass connects laptops, servers and cloud machines into one private, encrypted network. Devices reach each other directly over WireGuard, through NATs and firewalls, with no inbound ports to open and no VPN server to run.

## What it does

- Each device runs a small client and gets a stable private address (from 100.64.0.0/10) and a name (MagicDNS, e.g. `db-prod`).
- Devices connect peer to peer over WireGuard. They find each other with STUN and coordinated hole punching; when a direct path is impossible, an encrypted relay forwards traffic until a direct path opens.
- The coordination server only exchanges public keys and addresses. It never carries traffic.
- Direct paths are re-checked every 3 seconds; a broken one is replaced within 8 seconds, and switching between direct and relay never restarts the connection. While relayed, direct is retried every 35-60 seconds. Details: https://getunderpass.com/product/direct-connections
- Relays forward only WireGuard ciphertext, only between devices of the same network, and only with a signed ticket that expires after 10 minutes.

## Features

- Machines: see every device, its address and whether it is online; rename or remove devices.
- MagicDNS: every machine and service gets a name ("db-prod", or the full name under the workspace's domain), answered on each device. DNS settings add custom nameservers, split DNS and search domains; `cert` gets an HTTPS certificate for a machine's name. Details: https://getunderpass.com/product/easy-names
- Services: give a service its own name and address, served by one or more machines, with failover. Every device uses the same host (online first, then the longest-serving); a host that stops checking in counts as offline after 90 seconds and devices move to the next one; `serve ... off` moves them immediately. Details: https://getunderpass.com/product/always-available
- App connectors: send traffic for chosen internet apps out through one machine's public IP, so allowlists need one address.
- Workspaces: invite people by email or link and approve who joins; each workspace is isolated.
- Audit log of sign-ins, invites, new devices and removals.
- Access controls: rules for which people and devices can reach each other (enforced by clients from version 0.3). Without a policy everything is allowed; once saved, rules only allow and everything else is blocked. Sources and destinations: everyone, groups, people, tags, machines; destinations also services and apps. SSH rules are separate, and policy tests must pass before a change saves. Details: https://getunderpass.com/product/access-controls

## Use cases

- Remote team: https://getunderpass.com/use-cases/remote-team
- Servers & cloud: https://getunderpass.com/use-cases/servers
- Always-on internal apps: https://getunderpass.com/use-cases/always-on-apps
- One address for IP allow-lists: https://getunderpass.com/use-cases/outside-services
- Home & personal: https://getunderpass.com/use-cases/home

## Platforms

- Windows (desktop app and background service) and Linux (systemd service), including servers, cloud VMs, Docker hosts and Raspberry Pi.
- macOS and mobile apps are not available yet.

## Pricing

Flat monthly price per workspace (not per person):

- Free: $0, up to 3 users and 25 machines.
- Team: $29/month, up to 15 users and 250 machines, email support.
- Business: $99/month, up to 50 users and 1,000 machines, priority support.
- Larger teams: contact sales.

Every feature is on every plan; plans differ only in size and support. Details: https://getunderpass.com/pricing

Online checkout is not open yet; paid plans are requested from the dashboard's Billing page.

## Getting started

1. Sign in with Google or a one-time email code.
2. Install the app on each device and approve it from the browser; servers can join with an auth key.
3. Connect to other devices by name.

## Legal

Terms, privacy, acceptable use, data processing (DPA), subprocessors, cookies and security disclosure: https://getunderpass.com/legal

## More

- FAQ: https://getunderpass.com/faq
- Support: https://getunderpass.com/support
- Blog: https://getunderpass.com/blog