Choose The Plan That Fits Your Gateway
The Free plan is free forever. Starter, Pro, and Ultimate are recurring subscriptions — monthly or yearly — that raise tunnel, route, preset, group, and retention limits. Install first on your own hardware, then subscribe when you need more room for the routing policies you actually want to run.
Plans
Install on your own hardware first. Start free forever, or activate Starter, Pro, or Ultimate when you need more routes, presets, tunnel groups, or telemetry history. Cancel any time.
Switch to annual billing for 33% savings, about 4 months free compared with monthly.
Free
- 1 VPN tunnel
- 5 domain routes
- 1 hour telemetry history
Placeholder to keep CTA alignment stable.
Starter
- 3 VPN tunnels
- 3 WireGuard server profiles
- 20 domain routes
- 2 app presets
- 1 day telemetry history
Billed monthly. Exact charge shown at checkout.
Pro
- 10 VPN tunnels
- 10 WireGuard server profiles
- 60 domain routes
- 10 app presets
- 7 days telemetry history
Billed monthly. Exact charge shown at checkout.
Ultimate
- Unlimited VPN tunnels
- Unlimited WireGuard server profiles
- Unlimited domain routes
- Unlimited app presets
- 30 days telemetry history
Billed monthly. Exact charge shown at checkout.
All prices shown are in EUR. Cancel any time from your billing portal. Access remains active until the end of the already-paid period.
Compare Plan Limits
| Plan limit | Free | Starter | Pro | Ultimate |
|---|---|---|---|---|
| VPN tunnels WireGuard tunnels imported from a provider that you can use as exits for domain rules, app presets, per-device defaults, or tunnel groups. | 1 tunnel | 3 tunnels | 10 tunnels | Unlimited tunnels |
| WireGuard server profiles Client configs issued by the built-in WireGuard server. Linked profiles keep the same device identity and per-device policy off-network; unlinked profiles appear separately and follow global policy until linked. | Not included | 3 profiles | 10 profiles | Unlimited profiles |
| Domain routes Manual service and domain rules that send matching traffic through a specific tunnel or direct. Supports exact domains and wildcard suffixes. | 5 domain routes | 20 domain routes | 60 domain routes | Unlimited domain routes |
| Per-device default routes Sets a default outbound for an entire device so its traffic follows one path unless a domain rule or app preset overrides it. | 1 device route | 3 device routes | 10 device routes | Unlimited device routes |
| App presets One-click maintained domain bundles for popular services. You pick the exit; TLSOps keeps the preset list current. | Not included | 2 presets | 10 presets | Unlimited presets |
| Tunnel groups Named groups of tunnels with health and throughput-aware selection. TLSOps promotes the top-scoring challenger for new connections without changing the rule itself. | Not included | 2 groups | 10 groups | Unlimited groups |
| Telemetry retention How far back the dashboard shows per-device traffic, DNS, and latency data. | 1 hour | 1 day | 7 days | 30 days |
| Hardware resets Number of times the license can be transferred to a different hardware fingerprint per 30-day window. | Not included | 1 per month | 3 per month | Unlimited |
App presets
App presets turn supported services into maintained domain bundles so you can route by service without manually tracking every hostname.
Tunnel groups
Tunnel groups run health and throughput probes across member tunnels and promote the top-scoring challenger for new connections. Existing sessions only switch immediately when interruption is enabled.
Install First. Upgrade Only If You Need To.
Review installation requirements, bring the appliance online, and only subscribe when you need more routing room than the free forever plan provides. Questions? Read the FAQ or email us.