01 / Address allocation
Choose the identity your clients need.
IPv4 and IPv6 are two address families. Dual-stack gives a supported target both. IPv6-only needs clients and destinations that can use IPv6; it does not automatically supply an IPv4 address or translation.
A device or gateway address
Choose dual-stack for IPv4 and IPv6, or IPv6-only where the required destinations are reachable that way. A public address is distinct from the device ID and private addresses used inside Networks.
A routed subnet
Allocate IPv4 and IPv6 separately. IPv6 prefixes range from /48 through /64. Route the block to your infrastructure, then assign addresses or downstream subnets to workloads.
Choose a routed block →02 / Delivery method
Direct assignment and LAN forwarding solve different jobs.
Direct routed delivery
The supported endpoint receives the assigned public address through the tunnel. Packets retain that destination address all the way to the endpoint; no public-address NAT is required there.
Gateway forwarding
The public address reaches a gateway, which forwards permitted traffic to a private LAN target. NAT can preserve the equipment’s existing configuration, with a trade-off in original-client source visibility.
WireGuard is currently the only supported tunnel protocol for Public IP delivery. Confirm the Fibmesh-supported client or gateway for your setup.
Think of two layers: your ISP carries the outside of the encrypted tunnel, while the Fibmesh public address identifies traffic inside it. NAT on the ISP connection does not mean the assigned public address must also be translated.
A fully routed address can still have a firewall. It can also be used for inbound access without changing ordinary outgoing routes. The underlying ISP transports the encrypted tunnel and may itself use NAT.
03 / Traffic policy
Start with a preset. Keep incoming access separate.
Explore a traffic preset Illustration · no settings are changed
| Preset | New incoming connections | New outgoing connections | Existing ISP |
|---|---|---|---|
| Inbound access | Permitted by rules; replies use Fibmesh | Ordinary outgoing traffic keeps its route | Unrelated outgoing traffic |
| Selected outbound | Blocked by default; enable separately | Chosen destinations use the assigned source | Other destinations |
| Full tunnel | Still governed by inbound rules | Eligible internet traffic uses Fibmesh | Documented local/platform exceptions |
Inbound plus selected outbound is a useful combination: host a service and call a partner API from the same address. Blocking new inbound connections must still allow replies to connections you started.
What counts as a selected destination?
Use agreed destination IPs and CIDR ranges. Domain- or application-based routing requires separate client support. Routes must select both the correct path and the assigned source address; choosing a tunnel route alone is insufficient.
Can a plug-in connector route every device at a site?
Not by simply joining the LAN. Quick Connect forwards selected incoming traffic to a configured target, or through per-port mappings on supported software. To control a device’s new outgoing connections, its traffic must actually traverse the gateway through routing changes or a protected downstream network.
Illustrative service configurations. Confirm the supported client or gateway and available controls during setup; these are not live configuration switches.
04 / Incoming access
An address makes a destination. Rules decide what enters.
Managed inbound access starts closed. Add the permitted source ranges, protocols and ports for the application. Full tunnel does not open inbound access, and an outgoing allowlist does not publish a service.
Confirm protocol support and any reserved platform ports. Fully open exposure, where supported, is an explicit advanced choice. Keep application authentication and the host firewall; essential network control traffic must be handled correctly too.
Understand the firewall boundary →05 / Address families and failures
Decide what happens outside the happy path.
- IPv6-only and IPv4
- Full-tunnel setup needs an explicit IPv4 policy: block it, use a separately supported translation service, or deliberately leave IPv4 on the ISP. The last option is split-family routing and must be shown as such.
- Tunnel interruption
- A kill switch should block traffic assigned to Fibmesh when its tunnel fails. If fallback is allowed, the destination may see the ISP’s address instead. Agree this behaviour before relying on allowlists.
- Mobile platforms
- OS-managed VPNs have lifecycle and routing constraints. Confirm local-network and system-traffic exceptions. “Full tunnel” is not a promise that every system packet takes the same path on every platform.
- Encryption
- The tunnel protects the endpoint-to-Fibmesh leg. Use TLS or other application encryption for protection beyond the tunnel peer.
Domains and applications
An IP address and a web address have different jobs.
You can point a domain you control at an assigned IPv4 address with an A record, or at an assigned IPv6 address with an AAAA record. For example, files.studio.example could name the server at 203.0.113.24. Both are documentation examples.
The application or a reverse proxy you operate supplies HTTPS and its certificate. A Public IP does not automatically create a Fibmesh subdomain, select apps by hostname or supply a certificate. A DNS record also does not choose a non-standard service port.
For one HTTPS link to a web app, consider Publish. For an IP address with supported TCP or UDP services, choose Public IPs and configure the service boundary.
Compare a public link with a Public IP →Before handover
Test the paths you intend to use.
Test permitted and denied incoming connections, selected and unselected outgoing destinations, the public source seen by the destination, IPv4 and IPv6 separately, and tunnel loss and recovery. For gateway delivery, also check the return path and MTU.
Reservation and delivery have different lifecycles. Pausing delivery does not release the reserved address. Releasing it means updating DNS and external references; retaining it does not promise seamless sessions or automatic moves between regions.
Use the setup and troubleshooting checklist →
Inspect assignments through the API →
Discuss your traffic requirements →