Default-deny access rules
Grant users, groups or devices access to specific subnets and ports. Everything else is blocked, and an explain tool shows why.
Yeap Access Replace the corporate VPN with zero-trust access.
Employees enter your organisation's endpoint and reach only the private networks their rules allow. Run it in our cloud or on your own servers.
Coming soon This service is in limited availability and not yet open for self-service orders.
- Default-deny access rules
- UDP with HTTPS fallback
- Cloud or self-hosted
vpn.example.comZero-trust access to private networks
Connected- Virtual IP100.64.0.12
- Routes10.20.0.0/16 via Connector
- DNScorp.internal → private zone
- TransportUDP, HTTPS fallback
Capabilities
Private networks without the open door
Each person reaches only the subnets and ports their rules grant.
IP address management
Each organisation has its own IPv4 and IPv6 space with subnets, pools and static assignments. Devices keep their virtual IP.
Split DNS and private zones
Internal names resolve from your private zones or your own DNS servers. Public domains keep using the device's resolver.
Connectors with failover
A Connector in each site dials out, so no inbound ports are opened. Two Connectors for one subnet act as primary and standby.
Works on strict networks
Tunnels use WireGuard's Noise protocol over UDP and fall back to HTTPS on port 443 when UDP is blocked.
Self-hosted option
Run the same server in your own data centre. It works without registering with us, even on isolated networks.
How it works
Up and running in three steps
- 1
Set up your organisation
Create subnets and access rules in the admin console, in our cloud or on your own server.
- 2
Add a Connector
Run a Connector in each office or data centre and approve the subnets it announces.
- 3
Invite your team
Members install the client, enter your endpoint and sign in.
Specifications
The details
| Clients | Linux now. Windows, macOS, Android and iOS in development. |
|---|---|
| Encryption | WireGuard Noise IK. Sign-in fields encrypted with HPKE. |
| Transport | UDP, with automatic fallback to QUIC and TLS on port 443 |
| Addressing | 100.64.0.0/10 by default, IPv6 ULA, your own subnets |
| Overlapping subnets | Mapped (NAT) on the Connector |
| Sign-in | Passwords and TOTP. Custom sign-in scripts when self-hosted. |
| Deployment | Yeap Cloud, or self-hosted for a single organisation |
| Administration | Web admin console, read-only role, audit log |
FAQ
Frequently asked questions
Can I use Yeap Access now?
It is in early access. Contact us to request an invitation.
How is it different from a traditional VPN?
A traditional VPN puts a device on the whole network. Yeap Access denies everything by default and only opens the subnets and ports each user, group or device is granted.
Do I need to open ports on our office firewall?
No. Connectors only make outbound connections.
Can we run it on our own servers?
Yes. The self-hosted server keeps your data on your servers and does not need to be registered with us.
Which devices are supported?
A Linux client is available today. Windows, macOS, Android and iOS clients are in development.