All your devices on one secure network, from anywhere.
Reach your computers, phones and servers by name, wherever each of them is. Everything between them is encrypted, and when a network blocks the usual ways, Nardeboon finds another.
Free for up to 3 devices. No payment details needed.
Linux · Windows · macOS · AndroidiOS soon
Gets through
Its traffic doesn't look like a VPN's, and it gives nothing away to whoever probes it. When one way is blocked, it moves to another on its own: a different kind of UDP, TLS or WebSocket.
Picks the best path
It tries every way between two devices, directly or through a relay, keeps the best one, and swaps it the moment it fails.
Simple by default
Install, sign in, done. Devices find each other on their own, each gets a name, and they stay connected when a laptop sleeps or a phone changes networks.
Day to day
All your devices, in one place
A dashboard for the whole network, and apps that connect with one switch.
- Reach your computers at home or at work from anywhere
- SSH, remote desktop and files on your servers, by name
- Send your internet through a device you trust
- Share devices and your office network with your team
See every device, and how it's connected
Who's online, on which system and at which address; which devices carry your internet or an office network; whose key is about to expire.
- Search and filter by name, address, owner or tag
- Approve new devices, rename them or remove them
- Exit nodes, subnet routes and keys, at a glance
Know how each device is doing
Its traffic by the hour, the peers it reaches fastest, and the path to each one: direct or through a relay, over which transport, and why that one.
- Latency, loss and jitter to every peer, measured all the time
- Update it, or turn off its key's expiry, from its page
- Every change to it in the audit log
Apps that stay out of your way
One switch to connect. See which devices are online and how far away they are, and send your internet through one from its own row.
- Windows, macOS and Android apps; Linux from the command line
- Computers install signed updates on their own; phones ask first
- Keeps working where our servers are blocked
How it works
Up and running in three steps
- 1
Create a network
Sign up, and your private network is ready, with its own addresses.
- 2
Add your devices
Install the app on Windows, macOS or Android and sign in, or run one command on Linux. Servers can join with a key.
Download - 3
Connect
Devices reach each other by name: directly when they can, through relays when they must.
ping mypc
Everything you need
A complete private network, not just a tunnel
Access control
Tags, groups and grants, enforced on both ends of every connection. Rules can carry their own tests, end on their own, or live in Git.
Exit nodes
Send your internet through a Linux, Windows or Mac device you trust, with an optional kill switch so nothing leaks if it goes away.
Subnet routes
Reach networks behind a device, such as an office LAN or a cloud VPC. Approve two routers and one takes over when the other goes offline.
Apps for your devices
Windows, macOS and Android: connect with a switch, choose an exit node, share a computer's networks, and see where your traffic goes.
Automatic names
Every device gets a name. Split DNS sends internal domains where they belong.
Relays you own
Make any of your devices a relay for your own network, even on the free plan.
Your path, if you want it
Pin the path between two devices, direct or through a relay you pick; if it stops answering, the best one takes over.
Local first
Devices on the same network find each other and connect directly, even while our servers can't be reached.
Independent of our servers
If our servers are unreachable, your devices keep working on their last signed configuration.
Signed updates
Update devices from the dashboard and watch them install; they take only versions we signed.
API and CLI
Everything in the dashboard is in the API, every CLI command speaks JSON, and access rules can ship from GitHub Actions.
Audit log
Every important change is recorded.
Transports
Four rungs. One ladder.
Nardeboon checks which transports work on your network and starts with the fastest, going down the list only as far as it has to. Switching never changes your tunnel or drops a connection.
- nb-udp
Disguised UDPIn use
Fastest and lightest. Used wherever UDP gets through.
- nb-udp-dco
UDP in a second shape
The same packets framed differently, on a port of their own, for networks that single out the first.
- nb-tls
TLS 1.3
For networks that block UDP entirely. On a port of its own, never 443; to anyone without your network's secret, it's an ordinary website.
- nb-wss
WebSocket over TLS
Works through HTTP proxies and CDNs. The last resort.
Path selection
It picks the path, and tells you why.
Small, battery-aware probes score every candidate path. When two paths are close, Nardeboon stays put; when the active one fails, it switches immediately.
- Latency, loss, jitter and throughput, not just the first path that works
- Through a relay when a direct path won't work: one of your own devices, or a Global Relay on paid plans
- Pin the path between two devices, in the dashboard or on a device
$ nardeboon path explain hetzner-de
| PATH | TRANSPORT | RTT | LOSS | JITTER | CAPACITY | SCORE |
|---|---|---|---|---|---|---|
| via fra1 (Global Relay) | nb-tls | 61 ms | 0.1% | 2 ms | 38 Mbit/s | 92✓ chosen |
| via am-node | nb-udp | 54 ms | 1.8% | 9 ms | - | 84 |
| via tr-node | nb-wss | 48 ms | 3.2% | 14 ms | - | 79 |
| direct | nb-udp | - | - | - | - | no path |
Chose via fra1 (Global Relay): the best overall score of the paths that work. via am-node has a lower ping but loses 1.8% of packets. via tr-node has a lower ping but loses 3.2% of packets.
Best overall score: low loss and stable, even though it isn't the lowest ping.
- End-to-end WireGuard encryption between your devices.
- Relays forward encrypted packets only and never hold keys.
- We never collect traffic content or DNS queries.
- Updates are signed. The dashboard can't run commands on your devices.
Common questions
Is Nardeboon a VPN?
Not the kind that rents you a server abroad. Nardeboon puts your own devices on one private network, wherever each one is, so they reach each other as if they were in the same room. If you like, one of them can carry your internet too: that's an exit node.
Does it work when the internet is filtered?
That's what it's built for. Each connection tries several ways through, from plain UDP to traffic that looks like an ordinary website, and keeps the one that works. No tool gets through every network every day; when a way closes, Nardeboon moves to another, through a relay if it has to.
Can you see my traffic?
No. What your devices send each other is encrypted with WireGuard keys that never leave them. Our servers only tell your devices how to find each other, and relays carry packets they can't open.
What if your servers can't be reached?
Your devices keep working on their last signed settings, even after a restart, and keep trying every way back to us. Until they're back, you can't add devices or change settings.
Free for 3 devices. Fair when you grow.
Each paid plan includes a set of devices; only the devices past them cost extra. Monthly or for up to a year at a discount. Pay with crypto.
Build your private network in minutes.
Free to begin; add devices whenever you need them.