Remote access for every device you run.
Reach SSH, VNC or any port you allow on any device, from anywhere. Private by default, with visibility into every connection.
Remote Access is included in the Pro, Business and Enterprise plans.
Reach devices on networks you don't control.
Kiosks, gateways and servers behind NAT, CGNAT or a customer's firewall, with no inbound ports and no VPN.
Easy setup
Install the agent and run one command on each device.
- One binary, no dependencies
- New devices join automatically
- Works behind NAT and CGNAT
Allowed ports on every device
Allow SSH, VNC, a web interface or any other port.
- TCP and HTTP ports
- Set from the dashboard
- Changes apply in seconds
One dashboard for the fleet
Every device and its live status in one place.
- Online and offline devices
- Uptime and traffic
- Remove a device at any time
Manage every device from one dashboard.
Add devices, see their live status and set the ports allowed on each one.
- Easy setup
- One command on each device
- Auto-join
- New devices join the fleet when they first connect
- Live status
- Online state, uptime and traffic
- Allowed ports
- SSH, VNC, a web interface or any service
- Works behind NAT
- CGNAT, cellular and customer networks
Control who can reach every device.
Devices are private by default. Grant access to a member, a role or a machine, and revoke it at any time.
- People and machines
- Grant access to a member, a role or a machine
- One device or many
- A single device, a group or the whole fleet
- Instant revocation
- Open connections close when access is removed
- Member sign-in
- Members sign in from the terminal for temporary access
- CI/CD with OIDC
- Pipelines connect without a stored secret
- Self-renewing credentials
- Machines renew their own certificates
- Bring your own CA
- Register an existing certificate authority
- Keys stay on the device
- Private keys never leave the machine that holds them
Reaching no devices yet Reaching 1 of 180 devices Reaching 31 of 180 devices
Give access to Robert KahnSee every connection to every device.
Who connected to which device and port, from where and for how long.
- Denied attempts
- Refused connections are recorded with the reason
- Session detail
- Duration, traffic and source address
- Log retention
- History is kept for the period set by your plan
- No traffic content
- The log stores connection details and traffic counts
- Opened (UTC)
- 30 Sept 2026, 10:12:07 UTC
- Closed (UTC)
- 30 Sept 2026, 10:13:41 UTC
- Ended
- Closed by the client
- Duration
- 1m 34s
- Requests
- 38
- Responses
- 38 2xx
- Traffic
- 24 MB to the device · 18 KB from the device
- Source address
- 203.0.113.24
Grant access by member, role or machine.
Each grant names who can connect and which devices they reach.
- Everyone, a role, one member or one machine
- One device, devices by name or every device
- Removing a grant closes open connections
Credentials for people and machines.
Each member and machine has its own credential, and private keys are never sent to us.
Setup keys
A machine uses it once, then renews its own certificate.
- Single use
- Self-renewing
- No lasting secret
CI/CD with OIDC
CI pipelines connect with no stored secret.
- GitHub Actions
- Any OIDC provider
- 15-minute certificates
Member sign-in
Members sign in from the terminal for temporary access.
- localport login
- Browser approval
- Temporary access
See every change to your team.
A record of who changed fleets, access and team settings, and from where.
- Actor, event and source IP on every row
- Filter by action, actor, outcome and time
- Visible to team admins and the owner only
Common questions.
The docs go deeper, or talk to us.
What is a fleet?
A fleet is a group of devices that only the members and machines you grant can reach. You choose which ports are allowed on each device.
Do devices need a public IP or inbound ports?
No. The agent makes outbound connections only, so devices work behind NAT, CGNAT and firewalls with no inbound ports.
Which ports can I reach on a device?
Any TCP or HTTP port you allow for that device in the dashboard, such as SSH, VNC or a web interface. A device can have up to 32 allowed ports.
What happens when someone leaves the team?
Their access ends on every fleet and their open connections close.
Does Localport update or manage software on my devices?
No. Localport gives you a private connection to every device. Use SSH, Ansible or your own tools over it.
How does someone connect to a device?
They run localport access with the device's address and a port. The port becomes available on their own machine, and they connect to it like a local service, SSH included.
Is there a record of who connected?
Yes. The access log records every connection to a device: who connected, to which device and port, from where and for how long. Refused attempts are recorded with the reason.
Do you hold our private keys?
No. Every certificate starts as a request made on the holder's machine, including in the dashboard. The private key is never sent to us.
Can we use our own certificate authority?
Yes. Register your CA with its revocation list and its identities work alongside the ones Localport issues, each in its own namespace.
Which plans include Remote Access?
Remote Access is included in the Pro, Business and Enterprise plans.
Bring your fleet online.
Create a fleet and connect your first device.