A private network for your whole team.
Access from IAM. No bastion host.
Frazer Access connects your people's laptops and phones, and your agents, to devboxes, VMs, clusters and VPCs over WireGuard, peer to peer. Who reaches what is rendered from IAM, so ssh to a box or psql to a private database works from a laptop, and removing a person ends their access in one operation. HA VPN brings your office onto the same networks.
$ frazer access connect
Signed in to Acme as lena@acme.example
✓ lena-mbp connected to Acme's private network
100.88.0.4 · fd3a:91c2:5e07::4
DNS lena-mbp-acme.access.frazer.run, *.acme-production.internal
$ ssh oncall-1
$ psql -h storefront.db.acme-production.internal# Nothing else on this laptop: the frazer CLI carries its own
# client (userspace, no root, no system extension)
$ frazer ssh jump-1
$ frazer devboxes ssh lena-api
$ frazer databases connect orders --role readonly$ frazer network vpn-tunnels create office --gateway vint-hill \
--peer-ip 203.0.113.7 --ike-psk-from-secret office-psk --bgp-asn 65010
office-sf-0 IPsec IKEv2 if 0 Established BGP up
office-sf-1 IPsec IKEv2 if 1 Established BGP up
Learned 192.168.40.0/22 from AS 65010
Advertised 10.20.0.0/20, 10.20.17.0/24One network per organization.
Peer to peer, with rules from IAM.
Frazer runs the control plane in your organization's cell. It hands every device and resource its keys, its policy and its names, and then they talk to each other directly over WireGuard. Relays run by Frazer carry traffic only when no direct path exists.
Access comes from IAM.
Never from hand-written rules.
Frazer renders the access policy from your organization's members, groups and role bindings, and tests it in the plan. When a role changes, the policy changes with it.
- Members
- → users who sign in with Frazer
- Groups
- →
group:entries - Resources
- → tags:
tag:devbox-…,tag:vm-…,tag:cluster-…,tag:vpcgw-… - Role bindings
- → grants:
devbox.userreaches only your own boxes,cluster.vieweronly the API port
Leaving the organization, in one operation
- Membership ends
- Devices deleted
- Keys expired
- Policy re-rendered
- SSH certificates revoked
- Boxes stopped
// Rendered from IAM · revision 37
// Change roles, groups or AccessPolicy, never this file
{
"groups": {
"group:acme-oncall": ["lena@acme.example", "kenji@acme.example"]
},
"grants": [
// devbox.user: only your own boxes
{"src": ["lena@acme.example"], "dst": ["tag:devbox-lena-api"], "ip": ["*"]},
// database.client: endpoint storefront
{"src": ["group:acme-oncall"], "dst": ["10.20.4.10/32"], "ip": ["tcp:5432"]}
],
"autoApprovers": {
"routes": {"10.20.0.0/20": ["tag:vpcgw-acme-prod-vpc"]}
},
"tests": [{"src": "amara@acme.example", "deny": ["10.20.4.10:5432"]}]
}Pick the path by what you reach.
Frazer Access for people, VPN for offices.
| To reach | From | Use | How it works |
|---|---|---|---|
| A devbox, VM or cluster API | A laptop or phone | Frazer Access | WireGuard, peer to peer. Who reaches what comes from IAM roles; a relay carries the traffic only when no direct path exists. |
| A whole VPC network | A laptop | VPC attachment | An HA pair of gateways in the network advertises its subnets, and split DNS sends *.internal names to the network's resolver. |
| Your VPC | Your office network | HA VPN | Two gateways per site with two public addresses, IPsec IKEv2 to your router and BGP over every tunnel. WireGuard as a second option. |
| The internet, from a fixed address | A laptop | Exit | A Frazer regional exit with a static IP for your organization, or an exit you run. |
| Your servers, to manage them | Frazer's control plane | Frazer Link | Not Frazer Access. A hub-and-spoke path that Frazer alone configures, which works before any member exists and never depends on Frazer Access. |
A private network, run for you.
Ruled by your roles.
Names, not addresses
Devices, boxes, VMs and clusters by short name and under access.frazer.run;
*.internalnames resolve through the network's VPC attachment.VPC attachments
A VPC attachment puts an HA pair of gateways in a network. Overlapping ranges are refused at plan time.
One SSH authority
Short-lived certificates from your organization's SSH CA, for people and agents alike.
Nothing to install
The frazer CLI carries its own client, in userspace without root, and works next to another company's VPN.
Relays and exits
Relays carry only encrypted packets, and only when no direct path exists. Regional exits give a static IP per organization, or you run your own.
Post-quantum on every connection
Every handshake mixes an ML-KEM-768 key exchange with X25519, end to end, and session keys rotate every two minutes.
Works on any network
IPv6 first, so carrier-grade NAT, satellite internet and IPv6-only Wi-Fi need no settings.
Phones, agents and CI runners
Phones connect with the Frazer app; agent sessions and CI runners join as their own nodes under the same rules.
Who reaches what.
With the defaults written down.
Who may do what
- Members
- Join a device with Frazer sign-in. A device reaches only what its owner's roles grant.
- devbox.user
- Reaches only the person's own boxes.
- cluster.viewer
- Reaches only the cluster's API port.
- AccessPolicy
- Rules beyond IAM, kept as a resource with tests that run in every plan.
- Gateways
- Approved automatically by their tag; a range that overlaps another attached network is refused.
What is logged
- Every connection to a box, with the person, the device and the path.
- Every policy revision, rendered from IAM the same way every time, with drift recorded.
- Firewall, route and peering changes, each through a plan and an approval.
- Offboarding as one operation, from membership to stopped boxes.
At the cap
- Free for members' devices and Frazer resources.
- A Frazer exit node costs $5 a month with its static IPv4; relay traffic has no meter.
- No per-GB network fees. VPN is included within fair use.
- A control-plane outage or a bad policy edit never cuts Frazer's management path to your servers.
Free for your people.
No per-GB fees.
Frazer Access costs nothing for members' devices and Frazer resources, and HA VPN is included within fair use. A Frazer exit node, with a static address of its own, has one monthly price.
See every priceFrazer Access and VPN, answered.
Do people have to install anything?
No. The Frazer app's Connect switch covers the whole laptop, and so does nothing at all: the frazer CLI carries its own client, so frazer ssh, port forwarding, database connections and kubectl to private clusters run in userspace without root. It also works next to another company's VPN.
Who runs the control plane and the relays?
Frazer does. The control plane runs in your organization's cell, upgraded in rings and backed up. Relays are Frazer's own, in every region; they see only encrypted packets, and Frazer never sends your traffic through a third party's public relays.
What happens when someone leaves?
One operation. Their membership ends, their devices are deleted, their keys expire, the policy is re-rendered, their SSH certificates are revoked and their boxes stop.
Is Frazer Access how Frazer reaches my servers?
No. Frazer manages your servers over Frazer Link, a separate hub-and-spoke path that works before any member exists. Both use WireGuard and share nothing else, so a Frazer Access outage or a bad policy edit never cuts management.
Is Frazer Access post-quantum?
Yes, by default. Every handshake mixes an ML-KEM-768 key exchange with X25519, so traffic recorded today stays private if quantum computers break X25519 later. Organizations that need FIPS 140-3 validated cryptography turn on the FIPS profile, an organization policy.
Can I connect my office network?
Yes. HA VPN runs two gateways per site with two public addresses, IPsec IKEv2 to your router and BGP over every tunnel, with WireGuard as a second option. At your own sites, an existing VLAN can also join a network as a VLAN attachment.