UnderpassDocs

Features

Easy names

Reach every device and service by name instead of its address, and keep using your own DNS for everything else.

Every machine and service in your network gets a name. Type db-prod instead of 100.64.0.21, anywhere: in a browser, ssh, a database client or a config file. This is sometimes called MagicDNS.

Names work as soon as a device joins, with nothing to set up.

Short and full names

Each machine answers to two names:

NameExample
Shortdb-prod
Fulldb-prod.underpass.internal, or db-prod.acme.<domain> once your workspace has its own network name

Use the short name day to day. The full name is there for tools that want one, and for HTTPS certificates.

A machine's name comes from its computer name when it joins: the first part, lowercased, keeping letters, digits and dashes, up to 63 characters. If the name is taken, it gets -1, -2 and so on. Rename a machine any time under Machines; the new name works everywhere right away.

How names are answered

Each device answers name lookups itself, on its own private address. Names never leave the device, and only resolve on devices in your network. Answers are cached for 60 seconds.

SystemHow the app hooks in
WindowsName resolution rules for your network's domains
Linuxsystemd-resolved (resolvectl)
macOSFiles in /etc/resolver

Note

On Linux, names need systemd-resolved. Without it the app logs MagicDNS needs systemd-resolved (resolvectl); machine names won't resolve, use 100.x addresses.

Your own DNS

On the dashboard's DNS page:

SettingDoesLimit
Network nameGives your workspace its own domain, like acme.<domain>3 to 40 characters: lowercase letters, digits and -, no --, unique
NameserversSend every lookup from your devices to these DNS servers8
Split DNSSend one domain, like corp.internal, to its own servers32 domains, 4 servers each
Search domainsLet short names like printer find printer.office.example16
HTTPS certificatesLet machines get certificates for their names

Your network's own names are always answered first. Split DNS domains can't overlap your network's domain.

Note

On macOS, machine names, split DNS and search domains work, but macOS keeps its own nameservers for everything else even when you set Nameservers.

DNS settings need app version 0.6 or newer on each device.