Private Networks Across Every Server You Run

Scope & Capabilities

Encrypted private networks across bare metal, virtual machines and containers in any location: subnets in zones, route tables, security groups, NAT gateways, your own public IPs forwarded to private services, peering, private DNS and traffic monitoring.

• One private network across your own servers wherever they run: bare metal, virtual machines or containers, in any data centre, cloud or office, set up through Fleet Manager
• Every server reaches every other directly over WireGuard encryption; private keys are generated on your servers and never leave them
• Zones for your locations: servers in one zone talk over their local network, traffic between zones is encrypted end to end
• Servers behind NAT or without inbound access connect through a relay you choose, with no port forwarding on their side
• Subnets per zone with addresses assigned for you, and private DNS names for every server in the network
• Route tables per subnet: send traffic to a NAT gateway for internet access, or to a server that forwards to a VPN, appliance or office network
• Stateful security groups on every server: allow rules by protocol, ports and source range or group, for traffic in and out
• NAT gateways: give private servers internet access that leaves through one known address, without changing how each server reaches the internet itself
• Public IPs: register an address one of your servers already holds and forward its ports to a service on a private server
• Network peering between networks of a project
• Monitoring: every connection's last handshake and traffic, traffic over time within and between zones, through NAT gateways and public IPs, and the busiest servers
• Self-repairing: changes reach every affected server within seconds, and a server whose networking was changed by hand is put back
• Quotas per organization you can lower for cost control, and every change recorded in the audit trail