airmshPrivate access
Zero trust network access, scoped to what you allow.
Reach a specific private service without publishing the rest of a server or treating a network address as permission.
For teams giving developers, operators, or approved devices access to internal websites, APIs, and databases.
Get startedQuick answers
What does zero trust network access mean in Airmsh?
For a private Endpoint, the gateway checks the authenticated source device and a signed, short-lived policy for the selected service. An encrypted tunnel alone is not the permission. See the security model.
Does access to one Endpoint open the whole server?
No. The grant is for the configured service address, port, and protocol. Terminal, Files, other ports, and an entire subnet are separate from that grant. See the Endpoint setup guide.
What happens when access is removed?
New flows are blocked. Existing resource flows close when the gateway receives the revocation or its short-lived policy expires. Revocation cannot recall data already copied. See revocation and limits.
What is actually checked?
An Airmsh device has its own identity. The control service coordinates a signed, short-lived access policy for the selected service. The gateway checks the authenticated source device and the resource policy before admitting traffic.
An Endpoint is tied to one gateway device, service address, port, and protocol. Allow rules may name users, groups, or devices; deny rules take precedence. Access to one Endpoint does not grant Terminal, Files, an entire subnet, or other ports.
Connect, verify, revoke
Install Airmsh on the service host and the requesting device. Create the Endpoint, grant the intended person or device access, and connect Endpoint access in the app. The client receives only routes for resources it is authorized to use.
A request without a matching identity or policy is denied. Removing access blocks new flows; the gateway also rechecks policy and closes flows on revocation or policy expiry. A service can still require its own login.
Illustrative workflow
What this looks like
A developer needs dashboard.company.internal:8080. An owner creates an Endpoint to 127.0.0.1:8000 on an online server and allows that developer. The developer connects Endpoint access and opens the address copied from the app. A teammate without permission cannot open it; port 22 and other server services remain outside this grant.
Limits to know
- This is service-scoped access, not automatic discovery of a whole VPC or subnet. The current connector is same-organization and supports configured services only.
- The tunnel encrypts traffic between devices, but an HTTP backend remains HTTP. For browser HTTPS, the backend needs a certificate that the client trusts.
- Removing access cannot recall data already downloaded or copied.
Next step