Private networking that always finds a way.
Connect laptops, servers and phones into one encrypted network. Nardeboon disguises every packet, measures every path, and keeps you connected even where networks fight back.
Free for up to 3 devices. No payment details needed.
Gets through
Every packet is disguised and every transport resists probing. When UDP is blocked, Nardeboon moves to TLS or WebSocket on its own.
Picks the best path
Direct or relayed (two-hop paths coming soon): every candidate path is scored on latency, loss, jitter and throughput, and a failed path is replaced at once.
Simple by default
Install, sign in, done. Devices find each other, get names, and stay connected through sleep, roaming and network changes.
Transports
Three rungs. One ladder.
Nardeboon checks which transports work on your network and climbs only as high as it needs to. Switching never changes your tunnel or drops a connection.
- nb-wss
WebSocket over TLS
Works through HTTP proxies and CDNs. The last resort.
- nb-tls
TLS 1.3 on port 443
For networks that block UDP entirely.
- nb-udp
Raw UDPIn use
Fastest and lightest. Used wherever UDP is open.
Path selection
It picks the path, and tells you why.
Small, battery-aware probes score every candidate path. When two paths are close, Nardeboon stays put; when the active one fails, it switches immediately.
- Latency, loss, jitter and throughput, not just the first path that works
- Two-hop paths through your own nodes or Global Relays (coming soon)
- Pin the path between two devices, in the dashboard or on a device
$ nardeboon path explain hetzner-de
| PATH | TRANSPORT | RTT | LOSS | JITTER | SCORE |
|---|---|---|---|---|---|
| direct | nb-udp | — | — | — | no path |
| via relay-fra (global) | nb-tls | 61ms | 0.1% | 2ms | 92✓ chosen |
| via am-node | nb-udp | 54ms | 1.8% | 9ms | 84 |
| via tr-node | nb-wss | 48ms | 3.2% | 14ms | 79 |
Best overall score: low loss and stable, even though it isn't the lowest ping.
How it works
Up and running in three steps
- 1
Create a network
Sign up and get a private network with its own address range.
- 2
Add your devices
Install Nardeboon and run nardeboon up, or use a one-time key for servers.
sudo nardeboon up - 3
Connect
Devices reach each other by name: directly when they can, through relays when they must.
ping mypc
Everything you need
A complete private network, not just a tunnel
Access control
Tags, groups and grants, enforced on both ends of every connection. Test a policy before you save it.
Automatic names
Every device gets a name. Split DNS sends internal domains where they belong.
Exit nodes
Send all your traffic through a device you trust, in the country you choose.
Subnet routes
Reach networks behind a device, such as an office LAN or a cloud VPC.
Relays you own
Make any of your devices a relay for your own network, even on the free plan.
Independent of our servers
If our servers are unreachable, your devices keep working on their last signed configuration.
Audit log
Every important change is recorded.
API and CLI
Everything in the dashboard is in the API. Every CLI command speaks JSON.
Signed updates
Update devices from the dashboard; they install only versions we signed.
- End-to-end WireGuard encryption between your devices.
- Relays forward encrypted packets only and never hold keys.
- We never collect traffic content or DNS queries.
- Updates are signed. The dashboard can't run commands on your devices.
Free for 3 devices. Fair when you grow.
Each paid plan includes a set of devices; only the devices past them cost extra. Monthly or for up to a year at a discount. Pay with crypto.
Build your private network in minutes.
Start free. Add devices whenever you need them.