Identity-aware networking

Invisible servers.
Own DNS names.

Stop risky port forwarding. Tuurio Shield turns internal IP addresses into secure URLs reachable globally without VPN clients.

Set up in 3 min
mTLS & WireGuard
tuurio-shield --live-monitor
▶ Relay handshake: zt.tuurio.net [ESTABLISHED]
▶ Identity: kita-sued.office.zt.tuurio.net
Active tunnel
Internal: 192.168.1.10:80
Status: Healthy (MTU 1280)
Auto-renewing TLS certificates via hub...

Network setup without network stress.

Forget firewall tickets and router modifications. Tuurio Shield uses outbound tunnels accepted by standard firewalls.

01
Copy smart key

Generate an enrollment key in the dashboard. It includes all settings for mTLS and DNS provisioning.

02
Start Docker

Start the agent with one command. It configures WireGuard and certificates automatically.

03
Open URL

Your app is reachable at name.config.tenant.zt.tuurio.net. Secure, fast and simple.

Enterprise-ready in 60 sec

Our agent runs as a lightweight Docker container. It persists identity and self-heals after disconnects.

mTLS encryption
Cloud DNS sync
Auto-renew TLS
No inbound ports 
# Identity remains persistent in /data
docker run -d --name tuurio-shield \
  --restart unless-stopped \
  --cap-add=NET_ADMIN \
  -v tuurio_data:/data \
  -e TUURIO_ENROLL_KEY='{...}' \
  ghcr.io/tuurio/agent:latest

App connectors

For permanent infrastructure like printers, admin panels or local DBs. Includes 24/7 monitoring and aggressive keep-alive.

Support sessions

Temporary technician access. Tunnels are created on demand and removed automatically after expiration.