Connection paths
Connect people, places and approved resources.
Connect the organisation around the resources it uses.
- Remote employeeSupported enrolled device→WireGuard
- Fibmesh routing nodeIdentity and permitted routes→WireGuard
- Office / cloud gatewaySelected destination ranges→Private network
- Business resourcesApps, storage and devices
Networks provides a private path across existing internet connections and providers. A site or cloud gateway can bring approved subnet resources within reach.
This is routed connectivity, not one broadcast LAN or a dedicated cloud circuit. Each destination needs a working return path and the appropriate application permissions.
Explore Networks →Expose the service that needs an outside audience.
- Partner systemUses a public service endpoint→Application traffic
- Fibmesh public deliveryPublic address + firewall→WireGuard
- Business server / gatewayTunnel delivery to the target
Use Public IPs for an address-based service that an external system must reach without enrolling into your private network.
For browser-facing applications, Publish offers a hostname-based alternative. Public reachability requires authentication, patching and an explicit inbound policy.
Explore Public IPs →Choose the source external services see.
- Company device / routed LANEligible outgoing traffic→WireGuard
- Fibmesh exitSelected internet exit→Internet
- Cloud / SaaS serviceObserved public source
Outbound serves internet-routing needs. Public IPs is another option when a specific allocation or selected-destination source identity is the central requirement.
Outbound’s current profile model is full tunnel. Do not assume destination-by-destination rules, concurrent department profiles or a verified kill switch.
Explore Outbound →Put it to work
Build the network around a distributed organisation.
A company’s resources no longer sit behind one office router. People move between locations, applications run in different clouds, and some equipment stays on site. Fibmesh gives these connections a common place to be managed, while each resource keeps its intended audience.
Give staff a path to work
Use Networks for approved access to applications, servers, storage and supported peripherals. People can join with supported devices; sites can join through gateways.
Work from anywhere →Connect offices and clouds
Keep resources with the providers and locations that suit them. Use Networks through supported hosts or gateways for selected private routes between working environments.
Hybrid cloud networking →Connect to external systems
Use Public IPs for server reachability, or an agreed Outbound source for a cloud or SaaS allowlist. Choose incoming and outgoing policies deliberately.
Stable outgoing identity →Keep incoming services separate from outgoing routing. Current Outbound profiles use full tunnel; confirm platform and address-family support before changing staff traffic. Compare the connection options →

Your first working result
One team reaches one approved application.
Build the first rollout around a useful working path. Verify private resource access independently from public service exposure and outgoing internet routing.
- Use the real application from a supported device
- Verify both permitted and denied resource access
- Record the owner, recovery process and removal procedure
A practical first deployment
Prove one end-to-end working path.
Inventory people and resources
Choose a team, supported devices, one application and any gateway. Record destination ranges, application accounts and the person responsible for the resource.
Choose private and public paths
Start with the minimum required access. Separate resource access from internet routing; connecting a private network does not inherently reroute everyone’s browsing.
Verify and expand
Check permitted and denied access, return routing, actual application use, loss of connection and removal. Add another site or service after that path is understood.
Questions, answered
Before you connect.
Is this a replacement for our ISP or a private leased line?
No. Fibmesh runs over supported existing connectivity. It does not provide an access circuit, dedicated cloud interconnect or a blanket performance guarantee.
Can printers, scanners and storage be reached remotely?
Supported IP services can be reached through an approved gateway route. Drivers, application support and permissions still apply. This is not automatic broadcast discovery, USB sharing or a local Ethernet extension.
Can we give different departments different Outbound profiles?
The current Outbound implementation supports one active profile per organisation. Do not assume simultaneous department-specific exits or a complete per-application routing policy.
What about identity, security and automation?
An enrolled device has its own identity; reaching a resource also requires the relevant permission and application login. Security explains the trust boundaries, and the developer reference describes current CLI/API scope. Confirm specific enterprise controls and contractual commitments before procurement.
Bring a representative team, one resource and your network constraints. Build a rollout plan from the connection you can demonstrate.
Plan your first deployment →