Products / Devices & developers

Hoq Connect

A private network between your machines, built on WireGuard and the Tailscale client.

Open Hoq ConnectLive16 featuresconnect.hoq.app

What it does

Hoq Connect puts your servers, laptops and phones on one private network. Each machine gets a private address and talks to the others directly over WireGuard, using the open-source Tailscale client. Hoq runs the control plane that hands out keys and rules.

To add a Linux server you copy a one-line command from the dashboard. It installs the Hoq node agent for x86-64 or ARM64, joins the network with a pre-auth key and keeps itself up to date. Other devices join with a standard Tailscale client pointed at Hoq's login server; a device that joins without a key waits for you to approve it.

Access rules are written with groups, tags and hosts. You can test a rule before it goes live and edit the policy as source. Machines can offer subnet routes and act as exit nodes once you approve them, and MagicDNS gives every machine a name.

The dashboard shows machines, a topology map, connections, activity, an audit log and monthly usage.

In numbers

3control-plane servers on three continents

2CPU architectures for the Linux agent: x86-64 and ARM64

15 mina keyless device waits for approval before it is dropped

Specifications

Protocol	WireGuard, through the open-source Tailscale client.
Linux install	One command: curl -fsSL … \| sudo sh. Needs systemd; x86-64 and ARM64.
Other devices	Any Tailscale client that accepts a custom login server can join. Devices that join without a key wait for approval.
Access rules	Groups and tags, hosts, rules, rule tests and an editable policy source.
Routing	Subnet routers and exit nodes, each approved in the dashboard.
Names	MagicDNS names for every machine, managed in the DNS tab.
Control plane	Runs on three servers in Australia, the United States and Spain, with the database replicated between them.
Billing	Metered per machine, averaged across the month, with a free allowance per network.
Plans	Included in the Team and Business organization plans.

Features

16 features, all shipped. Listed from the product's code and documentation; each row shows the day it was last checked.

Machines 4
Machine list	Every machine with its address, online state, last seen, expiry, routes and tags.
Topology map	See machines and how they connect.
Expire a machine	Force a machine to sign in again.
Approve new devices	Devices that join without a key park for about 15 minutes until approved.

Joining 3
Join links	A /join link bakes the key and login server into the installer.
Pre-auth keys	Create keys to add devices, in the Add a device tab.
Self-updating agent	The Linux agent checks for new versions and updates itself.

Access 4
Groups and tags	Name sets of people and machines to write rules against.
Rules and tests	Write allow rules and test them before they apply.
Policy source	Edit the whole policy as text.
Users	See and manage the people on the network.

Network 3
Subnet routes	Let a machine route to a LAN behind it, once approved.
Exit nodes	Send a device's internet traffic through a chosen machine, once approved.
MagicDNS	Machine names and DNS settings for the network.

Records 2
Activity and audit	What changed, who changed it, and when.
Usage	Machines per month and what they cost.

Works with

Hoq ID and platformYou sign in with Hoq ID, and an organization's members share its network.
Hoq DevicesHoq appliances and servers can sit on the same private network.

Your data

Where it is kept	Machine records and policy are in the Connect control plane's database on its three servers. Your traffic goes machine to machine and does not pass through Hoq unless a relay is needed.
Getting it out	The policy can be copied from the Source tab. A full export is not documented.
If you leave	Not documented yet.

APIs and standards

Linux installer: /install.sh and /join/{token}
Standard Tailscale clients with a custom login server
Standard: WireGuard
Standard: DNS

Compared

Checked 2026-11-01	Hoq Connect	Tailscale	ZeroTier	Cloudflare Zero Trust
Protocol	WireGuard via the Tailscale client	WireGuard¹	Its own protocol²	WireGuard or MASQUE³
Free plan	Free machine allowance per network; amount not published	Up to 6 users, unlimited devices⁴	10 devices, 1 network⁵	50 users⁶
Paid price	Per machine per month; price not published	$8 per user per month (Standard)⁴	$18 per month for 10 devices, then $2.00 per device⁵	$7 per user per month⁶
Access rules	Groups, tags, hosts, rules, rule tests, policy source	ACLs or grants in a policy file, all plans⁷	Flow rules; not on Free⁸	Gateway network policies⁹
Exit nodes	Yes, approved in the dashboard	Yes, all plans¹⁰	Yes, set up by hand¹¹	Limited⁹
Relays when direct fails	Not published	DERP relays in 28 locations, 18 countries¹²	4 root servers, locations not published²	All traffic passes through Cloudflare, 348 cities¹³
Sign-in for admins	Hoq ID: emailed code or passkey	Apple, Google, GitHub, Microsoft, Okta, OneLogin, OIDC¹⁴	OIDC on Essential and up⁵	Email PIN, Entra ID, OIDC, SAML, social¹⁵
Client apps	Hoq agent for Linux; other platforms through Tailscale's clients	Windows, macOS, Linux, iOS, Android¹⁶	Windows, macOS, Linux, iOS, Android¹⁷	Windows, macOS, Linux, iOS, Android¹⁸