01 · Place the connection
Connect a device, or connect a location
Install a supported app or agent on a device that should participate directly. Use a gateway when approved resources sit behind an existing router or cannot run Fibmesh software themselves. The current tunnel protocol is WireGuard; a manual WireGuard profile is the separate, more limited Compatibility Mode.
- On the device
- The supported app or agent joins the host itself.
- At the location
- An enrolled gateway reaches approved resources on its LAN.
- Enrolled colleagueApproved private membership
- Fibmesh nodeEncrypted network path
- Site gatewayIts own enrollment and permissions
- LAN resourceFile server, printer, scanner or supported equipment
Policy: Approve the destination and return route. Downstream equipment does not automatically receive a Fibmesh device identity.
Return path: Use a known resource address or supported private name. Routed access does not carry every local broadcast or make automatic printer discovery work across sites.
02 · Compare the runtime
Choose the method for your environment
Compare each method’s fit and deployment checks. Scroll horizontally when needed; focus the table and use the arrow keys.
| Method | Good fit | Check before deployment |
|---|---|---|
| Native desktop app | A person using a supported laptop or desktop | OS version, networking permissions and other VPNs |
| Headless agent | A supported server, VM or unattended compute host | Service ownership, updates, credentials and recovery access |
| Mobile app | A supported phone or tablet joining the private network or using supported outgoing routing | VPN lifecycle, background limits and platform exceptions |
| Gateway | Office, branch, cloud or LAN resources reached through one managed host | Approved destinations, forwarding, address overlap and return routes |
| Compatibility Mode | An assessed device using a manually handled WireGuard profile | Manual lifecycle, revocation, routing and reduced diagnostics |
03 · A native participant
Join directly with an app or agent
Local keys · authorised policy · reported status
The device enrols in the correct workspace and establishes its identity. Keys are generated locally; the backend receives the public key by default. The administrator grants the required access, and the native networking service applies the authorised policy. The visible app reports status rather than performing privileged route changes itself.
Enrollment does not automatically grant access to every resource or alter the default internet route. Check the product setup and supported release for the intended job.
Understand device and gateway enrollment →04 · An approved path to the LAN
Reach resources through a gateway
The gateway needs legitimate access to the target network. Approve a destination or subnet, check for overlapping address ranges, and establish the return path. Its own enrollment does not give every downstream device a Fibmesh identity.
Check the resource and protocol
This can make a storage server, network printer or scanner reachable across locations. Application accounts, drivers and supported network protocols still matter. Broadcast-based discovery does not automatically cross a routed private network.
Check the traffic and deployment
For public access through a gateway, assess forwarding rules and the replies separately. A gateway can also carry selected outgoing traffic or full-tunnel traffic when the product and release support that configuration. Fibmesh edge hardware remains a pilot/development deployment option.
05 · A manual lifecycle
Use Compatibility Mode deliberately
A manually managed profile has a smaller feature set than a native app. Do not expect dynamic policy refresh, complete route/DNS conflict handling or the same diagnostics. Follow the approved key-handling and removal procedure; never send an endpoint private key to the backend by default.
06 · Three separate decisions
Choose the path separately from the method
- Identity
- Joining the workspace establishes identity.
- Permission
- Network permissions decide reachability.
- Routing
- Routing decides where packets travel.
Current private connections use Fibmesh nodes; direct P2P is planned. Private IPv6 is in Networks scope, while automatic assignment needs release verification.
07 · Verify the release
Before installation or automation
Package and platform
Confirm the exact package, supported OS, required privileges and removal procedure on Downloads.
Implemented controls
Product CLI & API guides distinguish implemented repository commands from proposed controls.
Public integration support
Generated internal clients are not a supported public SDK.