PLY
Talk to us
EN

Multipath IP transport

One tunnel. Several physical exits.

PLY takes all macOS IP traffic into a system tunnel and spreads it across independent links: wired, cellular, satellite. It leaves through your own Linux server. Applications never notice, because there is nothing in them to change: no SDK, no SOCKS, no code edits.

How it worksTalk to us
  • TCPany port
  • UDPany port
  • IPICMP and the rest
Route schematic3 paths carrying
This shows behaviour, not live telemetry. Mute a path and watch the tunnel hold on the ones that remain.

How to read this page

Colour means the physical medium

Violet is satellite, ochre is cellular, teal is wired. A colour keeps the same meaning in every schematic, in the client mock-up, and in the labels, so the legend only has to be read once.

State shows up in how a line is drawn, never in its colour. A muted satellite path stays violet instead of disguising itself as the wired one.

  • Satellitekind:satellite
  • Cellularkind:cellular
  • Wiredkind:wired

From application to uplink

One packet, four handoffs

None of the four asks anything of the application.

  1. 01 · Client

    The application uses the ordinary network

    A browser, a terminal, a call, or a protocol you wrote yourself sees a system interface. PLY neither parses nor rewrites TCP and UDP.

  2. 02 · Packet Tunnel

    The system hands over raw IP

    A Network System Extension brings up utun and passes packets to the Rust client over a local bridge that admits only the same user.

  3. 03 · Transport

    The scheduler spreads packets across links

    Verified paths carry encrypted UDP datagrams. The scheduler reads each packet's importance from its header and spends redundancy to match. Acknowledgements, FEC, and congestion control keep working as a link degrades.

  4. 04 · Egress

    Linux routes the traffic or applies NAT

    A persistent TUN releases permitted traffic into a routed network, or through a chosen uplink with MASQUERADE.

Walk through the steps

What changes in the network

The network itself runs over several paths, not one application

  • A tunnel at the IP layer

    IPv4 and IPv6, TCP, UDP, DNS, ICMP, and the other permitted protocols all go inside. A proxy that understands three of them will not do.

  • Verified physical egress

    A path counts as live once the server has seen its probes arrive from a separate public address.

  • Two server modes

    forward sends traffic out through an uplink with NAT. tun routes it onward with the addresses left alone.

  • Rights checked per packet

    A device gets a fixed address, one permitted mode, and a list of networks. The source has to match the address it was issued.

See the capabilities

macOS 14+ client

An interface that will not pass two rows off as two links

The main screen answers one question first: does each path have a verified physical exit. Latency, loss, bandwidth, and queue depth come after that. A check that never ran shows a blank, not a success.

Look at the client

Where it earns its keep

Built for networks that move

  • A working day over several links

    Calls, remote sessions, file sync and browsing share one tunnel. Connection setup and interactive traffic get the protection; a background upload does without it.

  • Field crews

    Laptops and phones on the move get one stable corporate network instead of whatever the nearest tower offers.

  • Vessels and remote sites

    Satellite alone is expensive and jittery. Add any second link and the tunnel rides both.

  • Office failover

    A wired line plus a modem, bonded. Nobody notices the day the fibre is cut.

See the use cases

Get started

Tell us what your network looks like

Send us the shape of your setup: which links you have, what runs over them, where it hurts. We answer with something concrete, not a brochure.

Talk to us