Expose anything.
Reveal nothing.
ingressd connects your home to edge nodes on servers you rent. Web apps and game servers get public addresses with no port forwarding, no open ports and no home IP in DNS.
# on your VPS, with the token from the panel $ curl -fsSL https://app.ingressd.com/install/node.sh | sudo sh -s -- --token <token> ==> connected to the panel; firewall dead-man switch cancelled # at home, with the join string from the panel $ curl -fsSL https://app.ingressd.com/install/connector.sh | sudo sh -s -- <join-string>
- HTTP/1.1
- HTTP/2
- WebSocket
- TCP
- UDP
- PROXY protocol
- WireGuard
Three steps from closed router to public app.
Nothing changes on your router’s port forwards or with your ISP. The home opens the tunnels, so CGNAT and dynamic IPs stop mattering.
Install a node
Any Debian or Ubuntu VPS with a public IP. Copy the command from the panel: it installs the node and enrols it.
$ curl -fsSL https://app.ingressd.com/install/node.sh | sudo sh -s -- --token <token>Connect your home
Run the connector on any Linux box, Mac, Windows PC or Docker host at home, or import WireGuard configs on your router.
$ curl -fsSL https://app.ingressd.com/install/connector.sh | sudo sh -s -- <join-string>Publish an app
Add the app in the panel, then point your hostname at its DNS target. The panel checks origin, DNS and certificate for you.
media.example.net. CNAME k7m2q9xa.edge.example.net.
Built for more than one server and more than HTTP.
Web apps and game servers share the same tunnels. Every app is served by every node its home is attached to.
No inbound ports at home
The connector, or your router’s own WireGuard client, dials out to your nodes. Nothing listens on your home connection and your home IP never appears in DNS.
Several nodes per home
Every home keeps a tunnel to each of your nodes. Failover DNS answers with the nodes that can reach the home right now, with a 30-second TTL.
Guard rails for web apps
Each HTTP app can have a WAF (Coraza with the OWASP Core Rule Set), a bot challenge and rate limits, set per app.
Sign-in in front of any app
Access policies allow people by email, domain, group, IP range or country. Visitors sign in with a one-time code that the panel emails for you.
Game servers on TCP and UDP
Minecraft Java, Minecraft Bedrock and FiveM have presets; anything else is a port and a protocol. Keep a server public, allowlist it, or make players log in to play.
Certificates, shared
Nodes that serve the same hostname share one certificate store, so a certificate is issued once and every node can answer the ACME challenge and serve it.
See what your edge is doing.
Nodes report health, usage and logs to the panel over the same outbound connection they get their config on.
Live log preview
Watch requests to an app as they reach any of your nodes. Entries stream through the panel while you watch and are never stored there.
Usage metering
Requests and bytes per app, per home tunnel and per node, in hourly buckets. Usage is measured and shown; no plan limits are set.
Smart DNS
Send chosen services out through an exit node in another country, optionally over a VPN. Your devices keep TLS end to end.
Managed for free, or fully standalone.
Both run the same open-source node. A node can leave the panel at any time and keep serving.
Managed by the panel
The hosted panel runs your nodes for you. It keeps configuration, health and usage counters; your traffic goes from home to node to visitor and never through the panel.
- Enrol a node with one command
- Homes, apps, game servers and access policies from the browser
- Deployment checks: config, origin, DNS, certificate, live
- Live log preview and usage per app, home and node
Standalone
The same node runs on its own from one config.yaml and the ingressd CLI. No panel, no account.
- Every apply is a git commit:
ingressd history,ingressd rollback ingressd validateandingressd diffbefore you apply- Secrets encrypted at rest with age
- Leave the panel any time with
ingressd node detach
Managed edge network: coming. Anycast addresses and PoPs run by ingressd, for apps that should not depend on servers you look after. It is not available yet, and plans and prices are not set.
See pricingEvery node runs from one config file.
The panel compiles the same config.yaml a standalone node reads. Write it by hand, or take a node out of the panel and keep its config.
- Hostnames, origins and TCP/UDP ports
- WAF, bot challenge and rate limits per app
- Access policies and login-to-play
- Checked with
ingressd validatebeforeingressd apply
# one home, one web app, one game server tunnels: home: type: wireguard site: connector listen_port: 51820 transit: 100.64.0.0/30 fallback_ws: true apps: media: hosts: [media.example.net] origin: http://192.168.1.20:8096 tunnel: home waf: { mode: block, paranoia: 1 } bot_challenge: suspicious l4: minecraft: preset: minecraft_java target: { tunnel: home, address: 192.168.1.31 } access: allowlist allowlist: [198.51.100.0/24]