UpdatesExplore the release notes

Mesh VPN

A little closer.
Wherever you are.

Your work computer, your servers, your team's tools. Reach them from wherever the day takes you.

Reach your servers, work computer and cloud machines from wherever you are. Baseguard connects them with encrypted WireGuard tunnels.

Get Started Free

Mesh VPN

Work from anywhere

SSH into your office workstation from your laptop at home.

Pick up where you left off, with the same terminal and the same machine. Baseguard handles the connection between your home and office networks.

  • Connect by private name or overlay IP.
  • Keep your router's inbound ports closed.
Terminal
~ ssh build-01.acme.internal
Connected to build-01 · 100.64.0.12
developer@build-01:~$
Last login: today from 100.64.0.8
❯

Mesh VPN

Bring your clouds together

Let an application reach a database on another provider over the private mesh.

Your application and database do not have to live with the same provider. Join both machines to your organization and allow the database port between them.

  • Use your existing database drivers and clients.
  • Carry the connection over an encrypted tunnel.
Database client · production
app-db.acme.internalPostgreSQL · 5432
Connected
SELECT name, status FROM services;
namestatus
api ready
worker ready
scheduler ready

Mesh VPN

Keep internal tools internal

Open your team's dashboard through the network without exposing it publicly.

Monitoring, admin panels and development tools can stay on your private network. Your team reaches them through Baseguard using their usual browser.

  • Give each service a memorable private name.
  • Choose which devices can reach it with network rules.
grafana.corp.internal
Team dashboardPrivate
APIHealthy
DatabaseConnected
WorkersReady

FREQUENTLY ASKED QUESTIONS

A few things you might be wondering.

Do I need to open inbound ports?

No inbound port forwarding is needed. The documented outbound requirements are UDP 42273 for peer traffic and TCP 443 for the control plane.

What happens if a direct connection is unavailable?

An encrypted relay carries the traffic while the clients keep looking for a direct path. The relay forwards encrypted packets; it cannot decrypt them.

Which devices can join?

Baseguard has clients for Linux, macOS, Windows, iOS and Android. Servers and CI runners can enroll with node auth keys.

TRY IT ON YOUR OWN NETWORK

Connect your first two machines.

Install Baseguard, join the same organization, and put it to work.