Get an endpoint
Get an endpoint
wyrred is a small, deliberate interconnection provider. We run the dynamic DNS, the publishing pool, and the overlay tunnels that put hosts on the public Internet even when their access network won't give them a static IP. One contact, one bill, one fabric.
Each service below is a managed line item. We provision it, monitor it, rotate the keys, and stand behind it. Tagged operated for what runs today; roadmap for what's on the next twelve months.
Your endpoints get a stable *.wyrred.net name that follows your
WAN IP. Sub-minute updates, IPv4 + IPv6, low-TTL records, optional CNAME flatten
so your own brand domain can ride on top.
A pool of publicly-routed nodes (the publishing pool) accepts inbound traffic on your behalf and forwards it down a private tunnel to the LAN host that actually owns the service. The host stays behind CGNAT — the service doesn't.
OperatedWireGuard-based site-to-site and host-to-fabric tunnels with managed keys, split DNS, and route distribution. Pair sites together as one flat fabric without touching the carrier on either side.
OperatedWe watch every published endpoint from the outside the way your users hit it, and we alert before they do. Per-endpoint uptime, latency, TLS expiry, and DNS drift in one dashboard.
OperatedIssuance, renewal, and chain hygiene for the names we host. Wildcards via DNS-01, full-chain validation, and pinning support — so a cert never silently breaks email or APIs again.
OperatedSingle VIP, multiple POPs, BGP-driven failover. Your service answers from the closest healthy publishing node — without you running a BGP session yourself.
RoadmapLayer-2 EVCs and dedicated cross-connects into our fabric for partners who already live in an IX-adjacent rack. Bring your AS, keep your prefixes, land in our overlay.
RoadmapBond fibre + LTE + Starlink into a single resilient uplink at the customer edge, terminated in our fabric. Fail-over without a session drop, optional QoS weighting per tunnel.
RoadmapThe flow that turns a LAN service — your NAS, your VPN, your mail server, your home lab — into something the world can dial directly.
Your edge router or host runs a tiny agent that publishes its current public IP
to a dnode. Your name yourthing.wyrred.net resolves to
that IP within seconds of any change.
If your access network won't accept inbound traffic, the same name can resolve
to a pnode in our publishing pool instead. The pnode listens on the
ports you've declared and forwards them down a WireGuard tunnel to your LAN host.
Clients hit yourthing.wyrred.net from anywhere on the Internet.
Behind the curtain, a request lands on a pnode, traverses the tunnel, and your
host answers. We watch the chain end-to-end and page ourselves, not you.
An interconnected world across five continents, without boundaries — deliberate POPs, predictable latency, and named operators on call.
If you have to read a manual to use it, we haven't finished the work. You get a name, a port, a key — and a service that answers.
One engineer owns your account end-to-end. Not a queue, not a tier-one robot.
We page ourselves before we page you. Status emails are short, factual, and only when something actually moved.
WireGuard, BIND, nginx, nftables, ACME. We pick tools that have been load-bearing for a decade, not the trend of the quarter.
Your names, your keys, your configs are exportable. If we ever stop being the right answer, you can leave in a day.
Publish from the EU, from the US, or from both. Control plane sits in DE / IT by default; customer endpoints pin to the region you actually want answering.
Tell us what you want reachable. We'll come back with a name, a price, and a date — usually inside a working day.
We deliberately don't have a self-service signup. Every account starts with a short conversation so we understand the shape of what you're publishing and whether wyrred is genuinely the right fit.