No inbound port needed
The server dials out to the gateway, so it can stay unreachable from the internet.
Networks
Reach anything, without opening it to the world.
Servers behind NAT with no public address, devices on a closed clinic network, machines only your VPN can see: Zedlin has a way to each of them, and they stay closed to everyone else.
WireGuard networks
A private network in one command.
Zedlin starts a WireGuard gateway on a machine of yours over SSH. Each server joins with one line, using WireGuard from its own distribution.
How it stays closed
Outbound only, and isolated.
Keys stay on the server
Its private key is generated there and never leaves.
Nothing left running
WireGuard is in the kernel. No Zedlin service stays on the machine.
Isolated by default
The tunnel interface only accepts SSH from the gateway. You decide per member whether Zedlin and other members may reach it.
Several networks
Keep customers or sites apart, each with its own gateway, subnet and port.
Status at a glance
Last handshake and traffic per member. A lost tunnel shows up as an unreachable server.
Port forwarding
Publish one service, not a whole network.
Need to reach a DICOM port or a web interface on a closed network? Forward it through a Linux machine of yours, open only to the addresses you list. People connect with whatever VPN they already use.
Also in the box
More ways through.
TCP and UDP forwards
Runs as an nginx container on the machine. Saving checks the config first and reloads without dropping connections.
Connection test
Test the path to the target from the forwarding machine, before anyone complains.
Device bridge
Some servers only your laptop can reach, say over a customer's VPN. Team jobs run through the device that starts them, while the secrets stay on the server.
Lock down Zedlin itself
Limit which addresses may reach your Zedlin server. It won't let you save a list that locks you out.
Connect what you couldn't reach.
Networks and port forwarding run on a Zedlin server you host yourself.