One approved address.
For the services that ask for it.
Some services, like a company GitHub, a cloud database or a client's firewall, only let in addresses you've approved. Send just that traffic through one of your machines, and approve one address instead of everyone's.
Before
- Amara · home198.51.100.12
- Jonas · home198.51.100.31
- Priya · hotel198.51.100.50
- Kenji · home198.51.100.69
- Lea · café198.51.100.88
- Omar · phone198.51.100.107
Changes every time someone moves.
With Underpass
One address for the whole team.
Everyone else's traffic keeps going the direct way.
Your approved address
203.0.113.24
Give this to the service. That's the only one it needs.
Stop updating
the allow-list every week.
Your team's traffic for those services leaves from one machine with a fixed address. Everything else stays direct.
The usual way
- 01Every home, hotel and café address on the list
- 02Updated each time someone moves
- 03Locked out until someone adds you
With a private network
- 01One address on the allow-list
- 02Only that service's traffic takes the route
- 03Nothing to update when people move
Three steps.
One address to approve.
Choose the services, choose the machine they go out through, and give the service that one address.
- 1
Choose the services
In the dashboard, add an app with the domains it uses. A wildcard covers a domain and everything under it.
New appName
githubDomains
github.com*.github.com - 2
Choose the connector
Pick a machine in your network with a fixed public address, like an office server or a small cloud VM.
ConnectorTraffic leaves from hereSelectedoffice-gw
203.0.113.24 · office
cloud-vm-1
198.51.100.7 · Hetzner
- 3
Approve one address
Add the connector's address to the service's allow-list. Your whole team gets in through it.
github.com · IP allow listOrganization settingsEnabled203.0.113.24
Acme team
Only the traffic
that needs it.
The detour is limited to the services you name, so everything else stays fast.
- Wildcard domains*.example.com covers a service and all of its subdomains.
- Everything else directOnly the domains you choose go through the connector.
- The whole teamEveryone in your network gets the same approved address.
- Encrypted on the wayTraffic travels encrypted to the connector, then out to the service.
Questions about allow-lists.
Something we didn't cover? Write to us and we'll help you get set up.
Ask us anythingNo. Only traffic for the domains you add to the app. Everything else goes the normal, direct way.
/ Independent · bootstrapped · no investors
Built by a person,
not a fund.
I'm Endi, and I build Underpass myself. No investors to answer to, only the people who run their networks on it. Every message that comes in reaches me directly.