Built to get through, designed to stay simple
Everything Nardeboon does, from disguised transports to measured path selection.
Gets through restrictive networks
There is no unobfuscated mode. Every byte on the wire is disguised.
- WireGuard's telltale bytes are hidden, and its fixed handshake sizes are padded away.
- A connection proves it knows a secret in its first bytes. Anything else gets no answer, and recorded traffic can't be replayed.
- On TLS transports, an unauthenticated visitor just sees an ordinary website.
- Limited cover traffic before handshakes and while idle. Small random delays on handshakes only, never on data.
- Obfuscation is versioned, so a new disguise can ship quickly if one is ever detected.
- Each device publishes what it supports in a signed network map. Both ends verify it inside the tunnel and refuse downgrades.
Transports
Three rungs. One ladder.
Nardeboon checks which transports work on your network and climbs only as high as it needs to. Switching never changes your tunnel or drops a connection.
↑ Gets through more
- nb-wss
WebSocket over TLS
Works through HTTP proxies and CDNs. The last resort.
- nb-tls
TLS 1.3 on port 443
For networks that block UDP entirely.
- nb-udp
Raw UDPIn use
Fastest and lightest. Used wherever UDP is open.
↓ Faster
Measured path selection
- Direct and relayed paths are scored on latency, loss, jitter, throughput, stability, relay load and transport overhead.
- The best overall score wins, not just the lowest ping. Two-hop paths are coming soon.
- No flapping between near-equal paths, but an instant switch when the active one fails.
- Probes are small and few, and fewer still on metered links or low battery.
- Admins can pin the path between two devices; a pinned path never cuts a connection: it's chosen as usual while the pinned route doesn't answer.
- nardeboon path explain shows every candidate and why one was chosen.
Path selection
It picks the path, and tells you why.
Small, battery-aware probes score every candidate path. When two paths are close, Nardeboon stays put; when the active one fails, it switches immediately.
- Latency, loss, jitter and throughput, not just the first path that works
- Two-hop paths through your own nodes or Global Relays (coming soon)
- Pin the path between two devices, in the dashboard or on a device
mypc — terminal
$ nardeboon path explain hetzner-de
| PATH | TRANSPORT | RTT | LOSS | JITTER | SCORE |
|---|---|---|---|---|---|
| direct | nb-udp | — | — | — | no path |
| via relay-fra (global) | nb-tls | 61ms | 0.1% | 2ms | 92✓ chosen |
| via am-node | nb-udp | 54ms | 1.8% | 9ms | 84 |
| via tr-node | nb-wss | 48ms | 3.2% | 14ms | 79 |
Best overall score: low loss and stable, even though it isn't the lowest ping.
Relays, including your own
- Global Relays run by Nardeboon, on paid plans.
- Tick “Also use this node as a relay” to make any device a relay for your own network, even on the free plan.
- Relays only move encrypted packets: no keys, no content, and never between two different networks.
- Relay usage is metered per organisation.
Connects from anywhere
- Full NAT traversal: endpoint discovery, coordinated hole punching, PCP / NAT-PMP / UPnP port mapping and LAN peer discovery.
- IPv4 and IPv6.
- Stays connected through sleep, network changes and roaming, without you noticing.
- Connects fast through a relay if it has to, then moves to a direct path without interruption.
- Random ports, remembered between restarts.
Your network, your rules
- Organisations with several networks, members, roles and invitations, fully isolated from each other.
- Access control with tags, groups and grants, enforced on both ends. Test a policy before saving it.
- Automatic device names and split DNS.
- Subnet routers and exit nodes, with admin approval.
- One-off, reusable, ephemeral, non-expiring and tagged auth keys.
- Change a network's IP range without downtime, and roll it back if needed.
Built for operations
- A complete, documented API. The dashboard uses the same API.
- Every CLI command has --json output with a stable schema and documented exit codes.
- An audit log for every important change.
- Signed automatic updates, which you can trigger from the dashboard.
- If our control plane is unreachable, devices keep working on their last signed configuration, even after a reboot.
Build your private network in minutes.
Start free. Add devices whenever you need them.