Sign-in helpTalk to Fibmesh
MenuClose

Fibmesh Networks / How it works

How a private
connection works.

A device gets an identity. Policy permits a destination. An approved route carries the traffic—and the reply needs a way back.

Follow a connection Architecture guide · Confirm platform and deployment support during assisted setup.

01 / Give the device an identity

A device of its own.
A place in your network.

Illustrative enrollment · example values
work-laptopEnrolled device
Device ID
device-example-01
Private IPv4
100.96.1.24
Private IPv6
Part of the product scope. Confirm assignment support for your deployment.

Enroll each supported device in the correct workspace. Its keypair is generated locally; the backend receives the public key, not the endpoint private key by default. Joining another access group does not create another device identity.

A gateway has its own enrollment. The resources behind it keep their existing LAN addresses. The example IPv4 above is private shared address space, not a public IP; that address range alone does not mean the connection uses NAT.

02 / Grant the intended access

Joining is one step.
Permission is another.

An administrator grants the access a person or device needs. The backend is the source of policy. A supported native executor validates signed policy and applies authorised networking changes locally; the app shows state and diagnostics.

Workspace
The organisation boundary for administration, enrolled devices and resources.
Access group
Organises membership and intended private reachability. Also called a network in the underlying model.
Resource
An enrolled host or a destination behind an approved gateway route. Its application permissions stay with its owner.

Keep group and route scope as small as the job permits. Verify enforcement on the deployed client and gateway: a route record alone does not prove per-user or per-port isolation. A network connection does not sign you into the application.

What changes when a device leaves?

Remove the relevant membership and revoke affected enrollments. Check observed state as well as the administrative change. Revocation does not imply instantaneous deletion across offline devices. Retire application accounts separately when the work ends.

Follow a contractor’s access from joining to handover →

03 / Follow the traffic

There and back.
Every hop matters.

A Fibmesh routing node is part of the service. A site gateway connects an office or cloud network. They play different roles in the path.

Follow one connectionIllustrative path · no network settings change
Connection / Enrolled server

A private connection to an enrolled host

  1. 01Your laptopOwn device identity
  2. 02Fibmesh routing nodeApproved private path
  3. 03Enrolled serverOwn device identity

The laptop sends the approved private traffic through its WireGuard tunnel. The Fibmesh routing node forwards it over the server’s tunnel. The server’s application and host firewall still decide what it accepts.

Two tunnel legs. The routing node is a trusted part of the path; application encryption protects the application session across it.

Connection / Office resource

A private connection to equipment on a LAN

  1. 01Your laptopEnrolled client
  2. 02Fibmesh routing nodeApproved private path
  3. 03Office gatewayEnrolled site connector
  4. 04Office NASExisting LAN address

The client reaches an approved office destination through Fibmesh and the office gateway. The NAS keeps its LAN address and does not need a Fibmesh app. Only the agreed destination range is routed.

WireGuard protects the tunnel legs. The final gateway-to-NAS hop uses the local network; use the storage service’s own encryption where available.

Connection / Return traffic

The reply needs a route back to the client

  1. 01Office NASResponds to the request
  2. 02Office gatewayReturn route or supported NAT
  3. 03Fibmesh routing nodeReturn tunnel path
  4. 04Your laptopReceives the reply

The destination must be able to send its reply back through the office gateway. Use a return route, or a supported source-NAT arrangement when the LAN cannot route the client’s private address. NAT alone does not create the required routes.

With source NAT, the NAS usually sees the gateway’s LAN address. Application accounts remain necessary to identify the person using it.

Connection / Ordinary browsing

Private access can leave internet traffic on the ISP

  1. 01Your laptopStarts an internet request
  2. 02Existing ISPCurrent internet route
  3. 03Public websiteOrdinary destination

In the private-resources-only configuration, unrelated internet traffic keeps the existing ISP path. Joining Networks does not automatically select an internet exit or assign a public IP.

This illustrates the private-only choice. Outbound is a separate option for changing the eligible internet route.

Enrolled server path selected.

Understand the trust boundary

Private routing.
Application protection.

Explore the security model →
01 / Two tunnel legs

The routing node is trusted.

WireGuard protects each configured tunnel between an endpoint and its gateway. A Fibmesh routing node terminates those tunnels; it is not an opaque relay carrying an end-to-end encrypted peer tunnel. Keep application encryption such as HTTPS or SSH enabled.

02 / The local network

A final LAN hop needs protection too.

For a resource behind a site gateway, the final LAN hop uses the local network. Retain the resource’s own authentication, encryption and firewall rules.

03 / Current architecture

Direct connections are a future path.

Direct peer-to-peer connectivity is planned. Current connections use Fibmesh routing nodes. A future direct path depends on compatible clients, local conditions and approved access; seamless fallback is not promised for every connection.

04 / Find the resource

A familiar name.
The same access rules.

Private workspace DNS lets supported clients find internal resources by name through a configured private resolver. The resource still needs a valid record, a working route and an application listening for the connection.

Illustrative lookup · fictional private name
  1. files.team.examplePrivate resource name
  2. Private resolverFinds the configured record
  3. 10.20.0.20Office file server

Split DNS sends selected private names to the private resolver. It is separate from choosing an internet exit, and resolving a name does not grant access. If the IP works but the name does not, check the record, resolver reachability and client DNS configuration.

Private DNS does not imply automatic printer discovery, public DNS hosting or a browser-trusted HTTPS certificate. Confirm private-zone and record support for the deployed release.

05 / Choose the route deliberately

Private resources.
A separate internet choice.

Connecting to Networks does not automatically change every internet connection. Start with the destinations you need to reach.

Illustrative routing choicesSeparate destinations. Separate decisions.
Private resources only

Keep work resources private. Leave ordinary browsing on its usual path.

Use Fibmesh to reach the private resources you have permission to use. Other internet traffic follows the device’s existing connection.

Understand private access →
  1. 01Your device
  2. 02Approved private route
  3. 03Work resource

Joining a private network does not, by itself, move all your internet traffic through Fibmesh.

Selected destinations

Bring the destinations you need into reach.

Reach selected office or cloud resources through a supported gateway. Define the destination ranges, check for address conflicts and verify the return path.

Explore the hybrid-cloud example →
  1. 01Your device
  2. 02Approved gateway route
  3. 03Office or cloud subnet

A gateway route does not grant access to an entire cloud account or remove provider firewall rules.

Internet through an exit

Give outgoing traffic a chosen way out.

Where supported, Outbound can route internet traffic through an eligible exit. Assess the destination scope, exit location and source address your application needs.

Explore Outbound →
  1. 01Your device
  2. 02Supported exit
  3. 03Internet destination

Exit routing is a separate capability. It needs its own entitlement and supported client configuration.

Planning examples, not dashboard settings. Availability and combinations depend on the product, platform and approved configuration. Connecting cloud resources uses existing internet connectivity; a dedicated cloud interconnect is a separate service.

Put the model into practice

Verify one path.
Then build from it.

Identify the resource, its owner and the devices that need access. Confirm a supported release, workspace eligibility, local firewall rules and a working internet connection. For a site or cloud subnet, check destination ranges, overlapping addresses and return routing.

Compare devices & gateways →Check release availability →

Networks is available with assisted setup. These diagrams explain the architecture; confirm supported platforms and service locations for your deployment. Manual WireGuard profiles remain Compatibility Mode.

Next / Getting started

Make the first
connection useful.

One device, one private resource and one clear permission. Use the setup guide to prepare, connect and verify the result.

Plan your first connection ↗Discuss your setup →
Back to Networks overview →Networks CLI & API scope →