One network for your devices, your applications and every connection between them.
Tetherloom joins your laptop, phone, home server, office network, cloud machines and the applications you build into one secure network. Personal and work resources share one identity and one policy, keep their own boundaries, and every connection can be explained.
What it is built for
A single system instead of a VPN per use case. Each part is designed to be used on its own and to work with the rest.
Peers that do real work
A peer is the unit of the network. One peer can be an exit, publish a subnet, offer SSH and several services, and prove which application a connection belongs to.
Networks inside your applications
An SDK embeds a rootless peer into your own application. Installations of the app form their own network, with no system VPN on the device and no change to its routes.
Several isolated networks per device
Personal, work and embedded networks can live on one device at once, each with its own identity and policy, without leaking routes or names into each other.
Gateways that keep connections
Two gateways run active-active on independent Internet uplinks. Firewall and NAT state is synchronized under an explicit continuity contract, so the flows the contract covers survive a failed uplink instead of reconnecting.
Your own management service
The management service is one process with its database embedded and its interface built in. No external database, broker or cache; it runs on your own server.
Identity you already have
Sign in with any OpenID Connect provider, or with a local account on a standalone installation. A provider confirms who signs in; device keys stay with the device.
Connectors to existing VPNs
Reach networks that still sit behind a corporate VPN through a connector, installed only when you choose it, so the rest of your network stays unchanged. Planned after the first release.
Every connection explained
Diagnostics answer why a connection works or does not, which policy allowed it and which path it takes, instead of leaving you to guess from logs.
Built to fail safely
Every change has a durable identity and a recoverable outcome; limits are applied before untrusted work is accepted; revocation stops access that is no longer allowed.
Where it is today
Early, and honest about it. Nothing here is ready for production use yet.
Management service
The self-hosted service runs with its embedded database, serves HTTPS with an imported or automatically issued certificate, and lets the first owner claim the installation and sign in.
Peers
The first Linux peer. Its privileged network helper is in place; connection paths are under review.
Gateways
The two active-active gateways with synchronized state.
SDK and apps
The embedded peer for your own applications and the desktop interface.
Testing builds
Downloads for the client systems, published here as they become ready.
Follow the project
Write to us with questions or to talk about using Tetherloom in your product. To hear when testing builds are ready, see the download page.