Every server.
One private network.
Connect servers in your office and in any cloud. Reach each one by name, keep every port closed to the internet, and add new machines with a key, no browser needed.
Office
3 machines
- db-prod
- backup-01
- printer-hub
Hetzner
2 machines
- build-01
- build-02
Google Cloud
3 machines
- api-1
- api-2
- old-runner
$ ssh deploy@db-prod
Welcome to Ubuntu 24.04 LTS
deploy@db-prod:~$
Close every port.
Still reach every server.
Servers stop listening on the public internet. Your team reaches them over the private network instead.
The usual way
- 01Every open port is a door for strangers
- 02A jump box or firewall rules to babysit
- 03IP addresses kept in a spreadsheet
With a private network
- 01Nothing listens on the public internet
- 02Each server reached directly, by name
- 03One network across office and clouds
Add a server
with one command.
Servers join with a key instead of a person signing in, so it works in scripts and on brand-new machines.
- 1
Create a key
In the dashboard, create a key for adding machines. Keep it in your provisioning script or secret store.
KeysAdd machines without a browserCopytskey-auth-••••3f9a
For servers · created just now
- 2
Start it on the server
One command, and the server joins your network on its own. On Linux it runs as a service, so it comes back after a reboot.
root@db-prod$ sudo underpass up --auth-key tskey-auth-••••3f9a
Connected as db-prod (100.64.0.21).
- 3
Reach it by name
It shows up in your machines right away. From any device in your network, use its name for SSH, databases or anything else.
Machines3 onlineOnlinedb-prod
100.64.0.21 · Linux
Onlinebuild-01
100.64.0.34 · Linux
Onlineapi-1
100.64.0.40 · Linux
Made for servers.
And the people who run them.
Linux on x86-64 and ARM64, including cloud VMs, Docker hosts and Raspberry Pi, plus Windows.
- Keys for machinesAdd servers without a browser: ideal for scripts and images.
- Direct, by nameReach every server directly as db-prod or build-01.
- Whole office networksRoute a network like 192.168.1.0/24 through one Linux machine, once an admin approves it.
- SSH rulesDecide who may SSH into which machines, next to your access rules.
- Internal apps that stay upRun a service on two servers under one name, with failover.
- Survives rebootsRuns as a system service on Linux and Windows, and reconnects on its own.
Questions about servers.
Something we didn't cover? Write to us and we'll help you get set up.
Ask us anythingNo. Underpass only makes outgoing connections. You can close SSH and database ports to the internet entirely.
/ Independent · bootstrapped · no investors
Built by a person,
not a fund.
I'm Endi, and I build Underpass myself. No investors to answer to, only the people who run their networks on it. Every message that comes in reaches me directly.