Your devices talk
straight to each other.
Wherever they are.
No ports to open and no server in the middle. Underpass finds a direct path through home routers, hotel Wi-Fi and firewalls, so it's fast. When a direct path isn't possible, an encrypted relay steps in.
On an ordinary home network, the two devices reach each other directly within a second or two.
How it finds the way.
Without opening anything.
Routers and firewalls are built to keep strangers out. These three steps get your own devices through, without opening anything up.
Each device learns its address
Your router hides your device behind one shared public address. Each device asks our server which address and port it shows up as, so the other side knows where to knock.
← 203.0.113.7 : 41641
Both sides knock at once
A router only lets in replies to things it sent out. So both devices send to each other at the same moment: each router sees an answer to its own message and lets it through.
db-prod → laptop · t + 0 ms
✓ direct, 11 ms
A relay, when a wall won't open
Some firewalls refuse anything they didn't start. Then a relay passes the data along. It's encrypted before it leaves your device, so the relay can't read it.
relay → connected, encrypted
retry direct in 35 s
Switch networks.
Stay connected.
Leave the office, join a hotspot, wake your laptop on a train. The connection moves to the new network on its own, and nothing restarts.
Direct
Office Wi-Fi
Relay
a few seconds
Direct
Phone hotspot
10:02:14
You leave the office. The Wi-Fi drops.
10:02:15
The relay takes over. Your call keeps going.
10:02:21
A direct path through the hotspot is found.
- How often a direct path is checked
- 3 s
- To move off a path that stopped working
- < 8 s
- Between new tries for direct, while on the relay
- 35–60 s
- Reconnects you'll notice when the path changes
- 0
A backup that can't read anything.
And can't be used by strangers.
The relay is only there for the networks a direct path can't get through. It forwards scrambled data between your own devices, and nothing else.
Encrypted before it leaves
Your device encrypts everything with WireGuard. The relay passes along scrambled data it has no key for.
Only inside your network
The relay only connects devices in the same workspace. To anyone else, your devices don't exist.
Access that expires
A device's pass to use the relay lasts 10 minutes. Remove a device, and it's locked out soon after.
See every path.
Nothing hidden.
The status command shows how each of your devices is reached right now: directly, or through the relay, and how fast.
$ underpass status
100.64.0.7 laptop
| ADDRESS | NAME | STATUS | PATH | LATENCY |
|---|---|---|---|---|
| 100.64.0.21 | db-prod | online | direct 203.0.113.7:41641 | 11.2 ms |
| 100.64.0.9 | nas | online | direct 198.51.100.4:51820 | 23.8 ms |
| 100.64.0.12 | pi-garage | online | relay | 38.6 ms |
Questions about connecting.
Something we didn't cover? Write to us and we'll help you get set up.
Ask us anythingNo. Underpass only sends outgoing traffic, the kind every router already allows. Nothing on your network is opened to the internet.
/ Independent · bootstrapped · no investors
Built by a person,
not a fund.
I'm Endi, and I build Underpass myself. No investors to answer to, only the people who run their networks on it. Every message that comes in reaches me directly.