Outpost is a Zero-Trust network access platform that runs entirely on your servers: control plane, gateways, clients and our own Wave protocol. Policy decides who gets in, from which device, and to what. The tunnel finds its own way through DPI: TLS on port 443, UDP with rotation, MASQUE.
These are our own measurements on real networks, with date and conditions. We don't publish peak "gigabits per core" until we have measured it the same way.
The tunnel is only transport. The control plane decides who gets in, from which device and to what — and gateways enforce it live, without a restart.
Sign-in through your IdP over OIDC, a second factor, users and groups from your directory over SCIM.
The client reports disk encryption, screen lock, antivirus, firewall and OS version. That becomes a trust score with your weights and a history.
A group ACL per network — full or split tunnel, firewall rules pushed to gateways. Internal apps get their own ZTNA policies, mTLS included.
Revoke a device and its live session on the gateway is cut; the next handshake fails. Every action lands in an audit log with names.
Three ways VPNs get broken today, and what Outpost answers to each.
Fixed handshake sizes and a type byte in every packet — DPI recognises the protocol from the first packet.
Not a single constant field on the wire: the session ID is masked, everything else is ciphertext.
Structureless random bytes — exactly the class of UDP that mobile carriers drop after a few packets.
The first rung is a single TLS session with an allow-listed SNI. On UDP the client rotates its 5-tuple before the network's packet budget runs out.
L4 proxies get through, but they are a config, not a network: no users, groups, access policy, audit or SSO.
All of the device's traffic, not one app's. Users, groups, ACLs, Zero-Trust and an audit log out of the box.
Wave is our own protocol: a Noise IK handshake, AEAD on data, a masked session ID. Outside, three transports carry it, and the client walks them on its own — no support ticket, no manual config swap.
Pick what the network does — and see how the client answers:
outpost-wave-cli -dpi-calibrate. The gateway listens on a port range and replies to wherever the data came from.STREAM → DIRECT → RELAY. Order and parameters come from the control plane, per network.
A rung is accepted once traffic has crossed it both ways. A handshake the network let through while dropping data doesn't count.
If a rung dies mid-session, the client demotes it and moves to the next without dropping the tunnel.
The control plane and gateways are separate binaries. The control plane scales out, and gateways connect to it on their own: from any region, any host, even from behind NAT.
Cores behind a load balancer share PostgreSQL and Redis. Events fan out over Redis Pub/Sub; background jobs run on one core via an advisory lock — no etcd, no ZooKeeper.
A gateway opens a bidirectional gRPC stream to the control plane — it needs no inbound management ports. A new region is one Ansible role.
Grant or revoke access, change a rule — every gateway gets it without a restart. A deactivated gateway drops its peers in under a second.
Every gateway's status in the console and on the topology map; session and handshake metrics in Prometheus.
Wave's session ID comes first in every packet, so a gateway pool can sit behind an L4 load balancer (IPVS-DSR) with no sync between gateways. Built into the protocol; the deployment is ahead.
The CLI client already walks gateways and accepts the one that carries data. The apps are next.
The admin clicks "Invite" on a user's row and sends the link over any messenger. The person taps it — the app opens, signs into their account and pulls their tunnels. No config files, no QR on a monitor, no three-page instructions. For your own phone — sign in with a QR code from the console.
Choose what goes through the VPN and what goes direct. A rule reaches the tunnel without reconnecting.
We measure which property a specific network cuts on, instead of guessing.
Tunnel down — traffic doesn't leak around the VPN. Network changed — the client reconnects on its own. These are real modes: the toggle in settings reaches the platform, not just the screen.
Session speed and volume on the home screen are read from the data plane, not drawn. In-app diagnostics measure the packet size on your network and export a report without adb.
Organisations, networks, gateways and devices isolated at the query level.
Who did what to what — people and resources, not hex strings. CSV export.
Gateways and every device on one map: zoom, pan, full screen.
Offices and sites in one private network, plus smart routes.
For uncensored networks — netlink, no userspace overhead.
Embedded in the binary, RU and EN, no trackers.
Sessions, bytes, handshakes and protocol errors on /metrics.
A stand in one command, production in one Ansible role.
Every wave of blocking means tickets, manual config swaps and customers leaving for a competitor.
People in different countries and networks; the VPN gets cut, or nobody revokes it when someone leaves.
A commercial VPN means someone else's logs, someone else's servers, and blocking by IP list.
Compared with what people usually run themselves: plain WireGuard, AmneziaWG and VLESS+REALITY.
| Property | Outpost | VLESS+REALITY | AmneziaWG | WireGuard |
|---|---|---|---|---|
| All device traffic (L3 tunnel) | ✓ | ✗L4 proxy | ✓ | ✓ |
| Passes as TLS on 443 with an allow-listed SNI | ✓ | ✓ | ✗ | ✗ |
| Several transports with automatic failover | ✓data-verified | ~in client config | ✗ | ✗ |
| 5-tuple rotation within the network's budget | ✓ | ✗ | ✗ | ✗ |
| Users, groups, ACLs, audit | ✓ | ~third-party panels | ~ | ✗ |
| SSO (OIDC), SCIM, MFA | ✓ | ✗ | ✗ | ✗ |
| Active probes see a real cover site | ~in progress | ✓ | ✗ | ✗ |
Ratings are based on each project's public documentation and our audit of 2026-09-14. We give the active-probing row to REALITY: our native cover-site camouflage is on a branch, not in a release.
Don't take the table's word for it — test on your own carriers. In a week you have numbers next to what you use today.
We deploy the control plane and a gateway in the region you need — on your server or ours.
We measure your carriers: what gets cut, after how many packets, and on which property. The ladder is tuned to that.
Devices join with one link, and we measure speed next to your current solution.
Numbers for every network and a clear next step: Self-hosted, Managed or Enterprise.
We don't sell what isn't switched on for users. Here is the line as of today.
For live users on the production stand.
Code and tests are in the repository; off in the product for now.
Built in the open, measured before release.
Platform features are not split across tiers: self-hosted gets everything. We charge for hosting, SLAs, support, and the right to embed our data plane in a product you sell.
For Self-hosted, yes: an ordinary VPS with Docker will do. A stand comes up in one command, production in one Ansible role. With Managed, we run the servers.
A gateway is a separate server that dials the control plane over gRPC, even from behind NAT, so a new one comes up in one Ansible role. The ladder makes it less likely to come to that: STREAM on 443 with an allow-listed SNI holds where UDP gets cut. Automatic phone failover to a standby gateway is in progress.
Those give you a tunnel or a proxy. Outpost is the whole network: an L3 tunnel, a three-transport ladder with data verification, users, groups, SSO, ZTNA and audit in one control plane. Where we still trail is stated plainly in the comparison.
Android — Wave and WireGuard, with live users. Desktop clients for macOS, Windows and Linux. iOS is in progress.
With you: PostgreSQL on your server is the single source of truth. No mandatory telemetry leaves it. The audit log stays on your side and exports to CSV.
Self-hosted is free, with no device limit. Managed and Enterprise are priced to your load: devices, regions, SLA. Usually after the pilot, once the numbers are on the table.
Yes: white-label clients and a commercial licence for the Wave data plane are part of Enterprise.
The repository goes public at release candidate. Before that — under NDA, for a security audit or a licence-cleanliness review.
One binary: API, gRPC hub and web console.
The Rust implementation of Wave on Tokio and AWS-LC.
PostgreSQL is the single source of truth.
Android, macOS, Windows, Linux — one codebase.
The repository goes public at release candidate. Early access, a code audit or a licence-cleanliness review — under NDA, just write to us.
Provider, company or your own team — send us the region, carriers, number of devices and platforms. We'll reply with a pilot plan. NDA on request. Write in English or Russian.