Per-node pricing, unlimited sites & instances. Free forever, Custom is talk-to-sales.
Full refund within 7 days if license not extracted.
Paid customer tickets answered within 24h.
AES-256-GCM encryption, keys never leave your node.
Electronic invoices / PDF receipts on request.
Side-by-side capabilities per plan → see detailed features
| Feature | Free | Personal | Team | Business | Custom |
|---|---|---|---|---|---|
| Quotas | |||||
| Nodes per license | 1 | 1 | 1 | 1 | 1 |
| Max nodes per account | 1 | unlimited | unlimited | unlimited | unlimited |
| Users per node | 1 | 1 | 10 | unlimited | unlimited |
| Websites | unlimited | unlimited | unlimited | unlimited | unlimited |
| Database instances | unlimited | unlimited | unlimited | unlimited | unlimited |
| Hosting / Reverse Proxy / App Runtimes | |||||
| Nginx site management | ✓ | ✓ | ✓ | ✓ | ✓ |
| Apache multi-version (httpd 2.2 / 2.4) | ✓ | ✓ | ✓ | ✓ | ✓ |
| PHP multi-version + FPM pool | ✓ | ✓ | ✓ | ✓ | ✓ |
| Java / Python / Node.js runtimes | ✓ | ✓ | ✓ | ✓ | ✓ |
| Nginx reverse proxy | ✓ | ✓ | ✓ | ✓ | ✓ |
| HAProxy load balancing | ✓ | ✓ | ✓ | ✓ | ✓ |
| Backend health check | ✓ | ✓ | ✓ | ✓ | ✓ |
| File manager (whole system) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Scheduled tasks / systemd units | ✓ | ✓ | ✓ | ✓ | ✓ |
| Rclone file sync | ✓ | ✓ | ✓ | ✓ | ✓ |
| Supervisor process control | ✓ | ✓ | ✓ | ✓ | ✓ |
| Per-user isolation (dedicated system accounts) | ✓ | ✓ | ✓ | ✓ | ✓ |
| DD re-install (in-place whole-machine OS swap, no virtualization / IPMI needed) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Hosting operations (quota / traffic / WHMCS) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Databases / Cache | |||||
| MySQL / MariaDB multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| PostgreSQL multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| MongoDB multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| Redis multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| Memcached multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| FTP multi-instance | ✓ | ✓ | ✓ | ✓ | ✓ |
| XtraBackup physical backup | ✓ | ✓ | ✓ | ✓ | ✓ |
| DB replication (MySQL / PG / Mongo) | ✕ | ✕ | ✕ | ✓ | ✓ |
| SSL Certificates | |||||
| Domain certs: auto issue + auto renew | ✓ | ✓ | ✓ | ✓ | ✓ |
| Wildcard certificates | ✓ | ✓ | ✓ | ✓ | ✓ |
| IP certificates | ✓ | ✓ | ✓ | ✓ | ✓ |
| Multiple validations (email / DNS / file) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Pre / post issue hooks (any DNS provider) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Push certificates to child nodes | ✓ | ✓ | ✓ | ✓ | ✓ |
| Self-managed ZeroSSL key + cert API | ✕ | ✕ | ✕ | ✕ | ✓ |
| Security | |||||
| System firewall (nftables inbound) | ✓ | ✓ | ✓ | ✓ | ✓ |
| WAF (ModSecurity + OWASP CRS) | ✓ | ✓ | ✓ | ✓ | ✓ |
| SSH 2FA (Google Authenticator / YubiKey) | ✓ | ✓ | ✓ | ✓ | ✓ |
| SSH key login / system user management | ✓ | ✓ | ✓ | ✓ | ✓ |
| Panel 2FA + step-up verification | ✓ | ✓ | ✓ | ✓ | ✓ |
| Kernel tuning (sysctl) / swap | ✓ | ✓ | ✓ | ✓ | ✓ |
| Port forwarding (SSH / iptables / FRP) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Tamper protection (kernel-level, per file / dir / UID) | ✕ | ✕ | ✓ | ✓ | ✓ |
| JA3 / JA4 TLS fingerprint blocklist | ✕ | ✓ | ✓ | ✓ | ✓ |
| Cross-site Mesh | |||||
| Encrypted underlay (in-house Noise IK) + BGP EVPN + VXLAN | ✕ | ✓ | ✓ | ✓ | ✓ |
| Layer-2 across sites (zero terminal config) | ✕ | ✓ | ✓ | ✓ | ✓ |
| IPv6 / dual-stack + cross-family relay | ✕ | ✓ | ✓ | ✓ | ✓ |
| Egress selection (exit via a chosen site) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Link compression + dictionary self-learning | ✕ | ✓ | ✓ | ✓ | ✓ |
| Branch edge router (RouterOS CHR) onboarding *2 | ✕ | ✓ | ✓ | ✓ | ✓ |
| Mesh topology view + layered diagnostics | ✕ | ✓ | ✓ | ✓ | ✓ |
| Virtualization / VPS | |||||
| Docker (KVM virtualization) | ✕ | ✕ | ✓ | ✓ | ✓ |
| ESXi virtualization *3 | ✕ | ✕ | ✓ | ✓ | ✓ |
| One-click provisioning / re-install (iPXE) *4 | ✕ | ✕ | ✓ | ✓ | ✓ |
| Web console | ✕ | ✕ | ✓ | ✓ | ✓ |
| Auto IP allocation / IP binding isolation | ✕ | ✕ | ✓ | ✓ | ✓ |
| Snapshots + scheduled snapshots | ✕ | ✕ | ✓ | ✓ | ✓ |
| Off-site DR + scheduled DR | ✕ | ✕ | ✓ | ✓ | ✓ |
| Rescue system (ESXi) *3 | ✕ | ✕ | ✓ | ✓ | ✓ |
| VM monthly traffic cap / port mapping | ✕ | ✕ | ✓ | ✓ | ✓ |
| Content Delivery (CDN) | |||||
| CDN sites (in-house Rust edge) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Cache rules / stale-while-error (always online) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Multi-backend + fallback + health monitor | ✕ | ✓ | ✓ | ✓ | ✓ |
| Request / response header rewrite, content replace, redirect | ✕ | ✓ | ✓ | ✓ | ✓ |
| IP / CIDR rule sets (allow / deny) | ✕ | ✓ | ✓ | ✓ | ✓ |
| GeoIP rules (country / city / ASN / ISP / connection type) *1 | ✕ | ✓ | ✓ | ✓ | ✓ |
| Rate limiting (global / site / URL) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Human verification (PoW / captcha / JS challenge) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Escalate matched rules to the system firewall | ✕ | ✓ | ✓ | ✓ | ✓ |
| High-perf origin fetch (browser fingerprint + HTTP/3 + proxy) | ✕ | ✕ | ✕ | ✓ | ✓ |
| CDN plans / traffic packages for resale | ✕ | ✕ | ✕ | ✓ | ✓ |
| Domains / DNS | |||||
| Domain list / expiry reminders / whois | ✕ | ✕ | ✕ | ✓ | ✓ |
| All record types (A / AAAA / TXT / wildcard…) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Per-record CDN toggle | ✕ | ✓ | ✓ | ✓ | ✓ |
| GeoDNS (continent / country / region / ISP) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Split by rDNS / search engine / connection type | ✕ | ✕ | ✕ | ✓ | ✓ |
| TTL down to 60s · push zones to child nodes | ✕ | ✕ | ✕ | ✓ | ✓ |
| In-house mail server (standalone binary, not Postfix/Dovecot) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Mail domains / users / quotas | ✓ | ✓ | ✓ | ✓ | ✓ |
| Aliases and forwarding (multi-target fan-out) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Catch-all (per domain + global) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Webmail + TLS/SSL | ✓ | ✓ | ✓ | ✓ | ✓ |
| Semantic mail search (vector retrieval) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Monitoring / Analytics / Logs | |||||
| Dashboard (CPU / RAM / disk / network realtime) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Connectivity test | ✓ | ✓ | ✓ | ✓ | ✓ |
| Node heartbeat alerts (email / webhook) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Website monitor (IP / domain / SSL expiry / status / SLA) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Alert channels (email / WeCom / DingTalk / Lark / SMS) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Self-heal actions (restart service / run script) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Web analytics (PV/UV/IP/sessions/heatmap/funnel/replay) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Site logs (cache hit / JA3 / region / upstream) | ✕ | ✓ | ✓ | ✓ | ✓ |
| WAF defense logs | ✕ | ✓ | ✓ | ✓ | ✓ |
| Multi-node / Collaboration | |||||
| Node list + batch command execution | ✓ | ✓ | ✓ | ✓ | ✓ |
| Web terminal (local and remote nodes) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Node resource monitoring (CPU / RAM / disk / net) | ✓ | ✓ | ✓ | ✓ | ✓ |
| One-click deploy NK to a new node via SSH | ✓ | ✓ | ✓ | ✓ | ✓ |
| Multi-user + user-group permissions | ✕ | ✕ | ✓ | ✓ | ✓ |
| Per-user / per-group quotas (disk / sites / instances / mail) | ✕ | ✕ | ✓ | ✓ | ✓ |
| Sync groups (rules / CDN sites / forwarding) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Private DNS engine (PowerDNS) | ✕ | ✕ | ✕ | ✓ | ✓ |
| Backups | |||||
| Manual backup (rclone + xtrabackup) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Scheduled backup (sites / databases / VMs) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Multi-target remotes (S3 / FTP / SFTP / Google Drive / OneDrive / WebDAV) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Backup quota (sold by capacity) | ✕ | ✕ | ✕ | ✓ | ✓ |
| AI Assistant | |||||
| AI troubleshooting chat (can act on the system) | ✕ | ✓ | ✓ | ✓ | ✓ |
| Multiple model providers | ✕ | ✓ | ✓ | ✓ | ✓ |
| On the Roadmap | |||||
| Kubernetes cluster integration | in dev | in dev | in dev | in dev | in dev |
| Ceph distributed storage | in dev | in dev | in dev | in dev | in dev |
| MinIO object storage | in dev | in dev | in dev | in dev | in dev |
| App 1-click install (WordPress / Joomla …) | in dev | in dev | in dev | in dev | in dev |
| Support | |||||
| Official technical support | None | 5/mo | 10/mo | 100/mo | Per contract |
| Community Q&A | ✓ | ✓ | ✓ | ✓ | ✓ |
| Ticket support | ✕ | ✓ | ✓ | ✓ | ✓ |
| Email support | ✕ | ✕ | ✓ | ✓ | ✓ |
| Phone support | ✕ | ✕ | ✕ | ✓ | ✓ |
| Response priority | None | Medium | High | Top | Dedicated contact |
| Response time | — | 5×6 (09:00-16:00) | 5×8 (09:00-18:00) | 7×24 | 7×24 + SLA |
| Commerce Backoffice (Custom only) | |||||
| Billing (orders / payments / plans) | ✕ | ✕ | ✕ | ✕ | ✓ |
| Open API (WHMCS / your own finance / CRM) | ✕ | ✕ | ✕ | ✕ | ✓ |
| Ticket system | ✕ | ✕ | ✕ | ✕ | ✓ |
| Third-party software / licences | |||||
| *1 Commercial GeoIP database (MaxMind GeoIP2) — Country / city / ASN work out of the box with the free GeoLite2 database, which NodeKeeper downloads and refreshes monthly — no extra purchase needed. However ISP, domain and connection type (residential / hosting / mobile) exist only in MaxMind's commercial GeoIP2 database. Without it, rules built on those three fields simply never match; everything else is unaffected. Subscribe directly from MaxMind, or let us purchase it for you at $500 per order. | |||||
| *2 RouterOS CHR licence (MikroTik) — This licence is not included. You can still use the feature without it — MikroTik's free tier is functionally complete (management, routing, DHCP, firewall); the only limit is 1 Mbps per interface, which is fine for validation and small sites but not for production bandwidth. For more throughput buy a perpetual licence from MikroTik (P1 / P10 / PU, tiered by per-interface bandwidth); refer to mikrotik.com for the current tiers and pricing. A licence binds to a single instance and cannot be shared. | |||||
| *3 VMware ESXi licence (Broadcom) — NodeKeeper manages an ESXi host you already own; it neither resells nor includes the ESXi licence itself — obtain that directly from Broadcom / VMware (the free-tier policy has changed repeatedly in recent years; their current announcement governs). You do not need ESXi to run virtual machines: the built-in Docker (KVM) path covers power control, console, snapshots, traffic caps and port mapping. Only the ESXi-specific items marked *3 (ESXi onboarding, ESXi rescue system) require an ESXi host of your own. | |||||
| *4 Windows licence (Microsoft) — Provisioning Linux needs no extra licence at all. When installing Windows, the Windows licence is yours to provide — we neither supply nor resell it. It installs, boots and works unactivated; you simply get the persistent "Activate Windows" watermark, personalisation (wallpaper / themes) stays locked, and Microsoft may restrict some updates. Put your own key in the unattend file at provisioning time and it activates automatically. | |||||
Companies from Internet / Gaming / E-commerce / SaaS / AI run NodeKeeper in production.