Decide who reaches
what. Block the rest.
Rules in plain words.
Write a few rules, like engineers reach production on SSH, and everything else is blocked. Rules work with groups, tags, services and apps, and every device enforces them.
Access rules
everything else is blocked
What can they reach?
Priya · Engineering
- db-prod :22SSHallowed by rule 1
- db-prod :5432Postgresallowed by rule 1
- build-01 :443Weballowed by rule 2
- crm :443Webblocked
- wiki :443Weballowed by rule 4
Every rule is one sentence.
Who, what, and how.
Rules only ever allow. If no rule says yes, the answer is no.
group:engWhocan reachtag:prodWhatontcp 22, 5432How
*
Everyone
Every device in the network
group:eng
A group
Every device its members own
user:priya@acme.com
A person
Every device they own
tag:prod
A tag
Machines that joined with a tagged key
machine:<id>
One machine
Just that machine, by its ID
svc:grafana
A service
An internal app, whichever machine runs it
app:github
An app
An outside service, through its connector
any · tcp · udp · icmp
Protocols and ports
One port, a range like 8000-8100, or all of them.
Change rules
without holding your breath.
Tests catch a mistake before it's saved. SSH gets its own rules, so shell access is never an accident.
Tests before you save
Write down what must and must not be reachable. If a change would break one, it isn't saved.
group:eng → tag:prod:22
must reach
group:sales → svc:crm:443
must reach
group:sales → tag:prod:22
must not reach · a new rule allows it
SSH has its own rules
Shell access is listed on its own, so you can see at a glance who can log in to which machines.
group:eng → tag:prod
Engineers can SSH into production
user:amara@acme.com → *
The owner can SSH anywhere
Checked on every device.
Not one box.
There's no central firewall to get around. Each device lets in only what your rules allow, and replies to connections it started.
- New rules reach every device on their own
- Replies to your own connections always get back
- Every saved change is in the audit log
Questions about access.
Something we didn't cover? Write to us and we'll help you get set up.
Ask us anythingUntil you save a policy, everything in your network can reach everything else. Once you do, only what your rules allow gets through, so write the rules (and a few tests) first.
/ Independent · bootstrapped · no investors
Built by a person,
not a fund.
I'm Endi, and I build Underpass myself. No investors to answer to, only the people who run their networks on it. Every message that comes in reaches me directly.