it's a vpn based on wireguard that lets you connect to your infra without needing to port forward (usually) on your devices. they connect using their hostname, or the IP assigned to them and you can setup ACL rules to configure what users and devices can access