Free
For getting started$0forever
For personal projects and small teams.
Get Started Free- Up to 5 users
- 100 machines
- End-to-end encrypted mesh
- Tag-based network rules
- Private DNS and public API
Secure Your Network with a Zero-Trust Mesh
Baseguard connects your devices directly, peer to peer, encrypted end to end. No VPN configs, no exposed ports, no latency tax. Your infrastructure finds itself, from anywhere.
E2E
EncryptedWireGuard®
ProtocolISO
27001
EncryptedWireGuard®
ProtocolISO
27001
console.baseguard.net
Nodes
Devices connected to your organization's private network.
Search nodes
Tags
New Node
NodeAddressLast SeenVersion
prod-api-01prod100.64.0.21Online0.2.8 · ubuntu 24.04
prod-db-primaryprod100.64.0.22Online0.2.8 · ubuntu 24.04
k8s-worker-03k8s100.64.0.31Online0.2.8 · debian 12
ci-runner-02ci100.64.0.41Jul 30, 17:520.2.8 · ubuntu 24.04
edge-gw-fraedge100.64.0.51Online0.2.8 · alpine 3.20
monitoring-01infra100.64.0.61Online0.2.8 · ubuntu 24.04
staging-api-01staging100.64.0.71Jul 29, 09:140.2.7 · ubuntu 22.04
prod-api-01Online
prod
IPv4100.64.0.21
Public IP34.89.112.4
Domainprod-api-01.7089b838.baseg…
Created Byops@acme.inc
Node Info
ID5KBMXDl8ztjOYztqHFRssm
Hostnameprod-api-01.internal
Nameprod-api-01
Last SeenOnline
Created AtFeb 14, 2026 14:05
Client Version0.2.8
Operating Systemubuntu 24.04
Key ExpiresSep 10, 2026 10:13
Trusted by engineering teams at
ozgur-macbook2msprod-api-01
ecem-thinkpad9msedge-gw-fra
ci-runner-024msprod-db-primary
A Mesh That Connects Itself
Reach your private tools across home, office and cloud. Baseguard connects your machines with encrypted paths and handles the network setup.
Explore the Meshallowtag:dev → tag:staging
allowtag:sre → tag:prod
allowtag:ci → tag:registry
Zero-Trust Access, Enforced Everywhere
Choose who can reach what with tag-based rules. Review your configuration in Preview and keep track of every rule change in the audit log.
Explore Access ControlOne platform, from first handshake to full audit trail
CONNECT
SECURE
RESOLVE
SSO withApple · Google · Microsoft · any OIDC provider
Deploy onCloud · On-Premise · Air-gapped
Baseguard. One Secure Network for Your Whole Team
A zero-trust networking platform that connects your people, servers and devices, securely, at wire speed, without the operational overhead.
Get Started FreeMESH VPN
Direct, Encrypted, Peer-to-Peer
Devices discover each other automatically and connect point to point over the WireGuard® protocol. Traffic never passes through our servers, there is no bandwidth bottleneck to pay for.
More About the MeshNew devices join the mesh and find every peer without any configuration.
“We replaced our legacy VPN in an afternoon. Latency dropped by 80%”
console.baseguard.net
Nodes
Devices connected to your organization's private network.
Search nodes
Tags
New Node
NodeAddressLast SeenVersion
prod-api-01prod100.64.0.21Online0.2.8 · ubuntu 24.04
prod-db-primaryprod100.64.0.22Online0.2.8 · ubuntu 24.04
k8s-worker-03k8s100.64.0.31Online0.2.8 · debian 12
ci-runner-02ci100.64.0.41Jul 30, 17:520.2.8 · ubuntu 24.04
edge-gw-fraedge100.64.0.51Online0.2.8 · alpine 3.20
monitoring-01infra100.64.0.61Online0.2.8 · ubuntu 24.04
staging-api-01staging100.64.0.71Jul 29, 09:140.2.7 · ubuntu 22.04
prod-api-01Online
prod
IPv4100.64.0.21
Public IP34.89.112.4
Domainprod-api-01.7089b838.baseg…
Created Byops@acme.inc
Node Info
ID5KBMXDl8ztjOYztqHFRssm
Hostnameprod-api-01.internal
Nameprod-api-01
Last SeenOnline
Created AtFeb 14, 2026 14:05
Client Version0.2.8
Operating Systemubuntu 24.04
Key ExpiresSep 10, 2026 10:13
ACCESS CONTROL
Zero-Trust Rules, Human-Readable
Tag your nodes, then write network rules from source tags to destination tags with a protocol and port range. Every node enforces the rules locally, and nothing connects until a rule allows it.
More About Access ControlNothing talks to anything until a rule says so. Least privilege, by construction.
“We are not managing the network any more. We just get on with our own work.”
console.baseguard.net
Access Control
Control which nodes can reach each other with tag-based rules.
Network RulesPreviewTags
Search rules
Tags
Create Rule
NameSource TagsDestination TagsProtocolPorts
allow-sre-prodsreprodTCP22
ci-to-registryciregistryTCP5000
DefaultAllAllALLAll
Configure network access rules
Define secure communication rules between nodes by configuring tags, protocols, and ports.
Name
rule name
Source Tags
dev
Destination Tags
staging
Protocol
TCP
Ports
22, 443
CancelCreate Rule
PRIVATE DNS
Every Device Gets a Name
Baseguard runs DNS inside your mesh. Machines get stable, memorable names the moment they join, and queries about your infrastructure never leave your network.
More About Private DNSTurn DNS on and every node answers at <node-name>.<your-org-domain>, with a PTR for its overlay IP. No zone files, no registrar, no tickets.
console.baseguard.net
DNS
Configure name resolution, search domains, and custom records for your network.
NameserversSearch DomainsRecords
Search records
Tags
Add Record
DomainTypeTargetTTL (seconds)Tags
*.corp.internalA10.0.0.1300All
api.corp.internalA100.64.0.21300prod
grafana.corp.internalA100.64.0.61300infra
registry.corp.internalA100.64.0.41300ci
AUDIT LOGS
Every Administrative Change, Accounted For
Rule edits, DNS changes, key creation and revocation, node approvals and removals, role changes, every administrative action lands in a log you can filter by action, resource and date range.
More About Audit LogsQuery any timeframe, any node, any rule, answers in seconds.
console.baseguard.net
Audit Log
Review administrative activity across your organization.
Search logs
Jul 24 – Jul 31, 2026
Action
Resource
ActorActionResourceCreated At
ops@acme.incCreate Network ACLallow-sre-prod09:12
ecem@acme.incUpdate Nodeedge-gw-fra09:04
ozgur@acme.incCreate API Keyapi-key-ci08:57
ci@acme.incVerify Node Authci-runner-0208:41
DEPLOY ANYWHERE
From Zero to Mesh in Minutes
A one-line install script on Linux, a signed .pkg on macOS, an .msi on Windows, and the App Store and Play Store on mobile. Run the control plane as SaaS or on your own infrastructure, even air-gapped.
Get the InstallersLinux, macOS, Windows, iOS, Android, Docker, Kubernetes, Raspberry Pi.
root@pi:~ #
Remote teams“Our team connects from wherever they are: office, home, on the road. It just works, and nobody thinks about the VPN anymore.”
Remote teamsReach office tools from home or on the road.
Remote teams“Our team connects from wherever they are: office, home, on the road. It just works, and nobody thinks about the VPN anymore.”
DevOps & CI/CDLet runners reach a private registry with the access they need.
DevOps & CI/CD“We were running four different VPNs. With Baseguard we are down to one.”
Hybrid cloudConnect applications and services across your locations.
Hybrid cloud“Low latency between our data centers was a game changer. Baseguard gives us direct paths where our old setup kept adding hops.”
IoT & edgeEnroll remote devices and reach them for maintenance.
IoT & edge“Baseguard runs even on devices with 64 MB of memory. It cut our costs dramatically, and we couldn't have pulled this off with any other solution.”
AI infrastructureReach your GPU machines and private model endpoints.
AI infrastructure“Managing our AI clusters used to be a project of its own. With Baseguard it's child's play.”
THE BASEGUARD WAY
Real security starts with simplicity.
When you understand your network, it’s easier to make the right decisions. We make room for that clarity.
Get to know BaseguardPrivate, wherever work happens.
WireGuard encrypts traffic between your devices, including when a relay carries it.
How we protect your networkAccess you can explain.
Group devices with tags, write the rules you intend, and review them in Preview.
Explore Access ControlA closer look is welcome.
Read our security documentation, policies and certification information in the Trust Center.
Visit the Trust CenterStart with the device you have.
Clients for Linux, macOS, Windows, iOS and Android. Bring the rest of your machines as you go.
Get BaseguardSimple pricing. No surprises.
Start free, scale as you grow. Every plan includes the core security features.
Team
For growing teams$10per user / month
For teams that need scale and a full audit trail.
Contact Sales- Unlimited users
- 100 machines + 10 per user
- +$0.50 per additional machine
- Everything in Free, plus:
- Enterprise SSO and SCIM provisioning
- Full audit logging and SLA
Enterprise
For your requirementsCustomannual agreements
For advanced security and compliance needs.
Contact Sales- Unlimited users
- Custom machine limits
- Everything in Team, plus:
- Self-hosted deployment
- Dedicated support and priority SLA
Frequently asked questions
Can't find what you're looking for? Talk to support. A human answers.
Baseguard is a zero-trust mesh networking platform. It connects your devices, servers and people directly to each other over encrypted, peer-to-peer WireGuard® tunnels, replacing traditional VPNs, bastion hosts and firewall sprawl with one network where tags decide what reaches what.
Roadmap
Simplicity. Coming next.
Two new ways to bring more of your security into Baseguard.
Baseguard AI
Coming soonAI-assisted network management
Your network. In your own words.
A simpler way to manage your network with AI. Say what you need, with Baseguard alongside you.
Baseguard PAM
Coming soonPrivileged access management
Powerful access. Peace of mind.
Privileged access management, with the simplicity of Baseguard. A clearer way to manage access to your most sensitive systems.
Baseguard for Enterprise
A bigger network.
The same peace of mind.
Bring your deployment requirements, security questions and team. We’ll help you plan a setup that fits.
Deployment & infrastructure
- On-premise control plane
- Air-gapped deployments
- Self-hosted relays
Identity & security
- SSO & SCIM provisioning
- Custom ACL policy reviews
- Security questionnaire support
Operations & support
- 99.99% uptime SLA
- Private support channel
- Advanced data retention
- Extended audit log retention