Now enrolling · bring your own device

Your devices.
One proxy endpoint.

Plug a SIM stick into a Raspberry Pi, run one command, and every phone, Pi, and modem you own becomes a managed exit behind a single HTTP or SOCKS5 URL. Rotate IPs, pin sessions, and lock egress to the hosts you approve.

  • Raspberry Pi + USB modem
  • Android tethering
  • Hosted eSIM
david@laptop — zsh

How it works

Tailscale-grade enrollment, proxy-grade output.

No port forwarding, no static IPs, no per-device config. The agent handles the carrier, the gateway handles the rest.

  1. step 1

    Enroll a device

    Run the installer on a Pi or phone. It dials the modem, opens a WireGuard tunnel to the gateway, and reports carrier, signal, and public IP.

    curl -sSL https://exitfleet.com/install.sh | sh
  2. step 2

    Get one endpoint

    The gateway hands you HTTP and SOCKS5 URLs. Pick a pool, a rotation policy, and a sticky TTL. Nothing to configure on the device.

    http://user-x:••••@gateway.exitfleet.com:8000
  3. step 3

    Route per request

    Encode session, TTL, and pool in the username. Rotate an exit's IP on demand with a modem reset, and see old → new in the console.

    user-x-session-a1b2-ttl-600-pool-de

Control plane

Everything a proxy fleet needs, none of the modem babysitting.

Rotate on demand

One click or one API call resets the modem and re-dials. The console shows the old IP struck through and the new one verified.

Sticky sessions

Pin a session to one exit for a TTL you choose. Re-pin automatically if the exit drops, or fail the request loudly.

Pools and tags

Group exits by country, carrier, or purpose. Endpoints route to a pool, so adding hardware never changes client config.

Egress ACLs

Allowlist or blocklist by domain, wildcard, IP, or CIDR. RFC1918 and direct-to-IP are blocked by default, on every endpoint.

Username routing

Session, TTL, and pool travel in the proxy username. Works with any HTTP client, headless browser, or scraper framework.

Full audit trail

Every rotation, every blocked attempt, every device heartbeat is logged with who, what, and which exit.

Pricing

Pay for exits, not for bandwidth.

You already own the SIMs and the data plans. We charge for the control plane, per active exit.

BYOD
Your hardware, our control plane.
$9/ exit / month
  • Unlimited devices, pay per active exit
  • HTTP + SOCKS5 endpoints
  • Rotate, sticky sessions, pools
  • Egress ACLs and audit log
  • Community support
Start enrolling
Team
Most teams
For teams running a real fleet.
$49/ month + $7 / exit
  • Everything in BYOD
  • Multiple workspaces and roles
  • API keys and webhooks
  • Exit health alerts
  • Priority support
Start a team
Hosted eSIM
No hardware. We provision carrier exits for you.
Soonusage-based
  • Carrier eSIMs in EU + US
  • Same endpoints and policies
  • Mix with your own devices
  • Data billed per GB
  • Join the waitlist
Join waitlist

Trust

Infrastructure you can put in a vendor review.

This is not an anti-detection tool. It is a control plane for network hardware you already own.

Private by construction

Traffic rides a WireGuard tunnel from your device to the gateway. We never see plaintext beyond the proxy hop you configure.

Built for compliant use

Ad verification, price monitoring, QA on real carrier networks. Egress ACLs and audit logs exist so your legal team can say yes.

Safe defaults

Private ranges and direct-to-IP requests are blocked out of the box. Turning them off is explicit, logged, and per endpoint.

Two Pis. One command each. One URL.

Open the console and walk through the fleet with sample data.

Open the console