Managed lighthouses
Every new Managed Nebula network includes a managed lighthouse at no extra cost. A lighthouse is the component that lets hosts discover each other and establish connections. With a managed lighthouse, Defined Networking runs this infrastructure for you, so there's nothing to install, configure, or keep online.
What you get automatically
When you create a network, a managed lighthouse is provisioned automatically. You can begin enrolling hosts right away. Your network is ready to operate without standing up any servers of your own.
Enabling the managed lighthouse
New networks are dual-stack (IPv6 + IPv4) and are assigned a managed lighthouse by default, so most networks need no action to turn it on.
The managed lighthouse is reachable at an IPv6 address, which is why a dual-stack network is required. If your network already has both IPv6 and IPv4 addressing, you can enable the managed lighthouse yourself:
- In the admin panel, go to Settings → Networks and click your network's name to open the Edit network page.
- Check the Use managed lighthouses box.
- Save your changes.
To stop using the managed lighthouse, uncheck Use managed lighthouses on the same page and save. Only do this if your network has at least one self-hosted lighthouse: a network with no reachable lighthouse cannot establish new connections between hosts. The admin panel warns you when a change would leave the network without lighthouse coverage, but it does not prevent you from saving it.
Upgrading an IPv4-only network
Older networks that use IPv4 addressing only cannot host a managed lighthouse until they are upgraded to dual-stack. First, update every host to DNClient v0.9.3 or later. Then contact us and we'll help you convert the network to dual-stack. Once the upgrade is complete, you can enable the managed lighthouse from the Edit network page as described above.
The managed lighthouse:
- Is highly available and maintained by Defined Networking
- Requires no public IP, open ports, or always-on server on your side
- Handles peer discovery for every host on your network
What the managed lighthouse can and cannot see
The managed lighthouse learns the internet address where each of your hosts can currently be reached, which is what lets it answer discovery queries. It takes no part in the encrypted handshake between two hosts and holds none of their key material, so it cannot read or modify traffic between them. Its certificate is signed by your network's CA but carries no role or tag, so your firewall rules never grant it access to your hosts. Additionally, it is assigned an IP address outside of your network CIDR so that Nebula will refuse to exchange any Layer 3 traffic with the managed lighthouse.
Because peer discovery runs through it, the managed lighthouse is infrastructure your network depends on. Hosts that have already established tunnels keep communicating if it becomes unreachable, but a host cannot find a peer it isn't already talking to until discovery recovers. For added resiliency, you can host your own lighthouses in addition, or in lieu of, Defined's managed lighthouse.
The managed lighthouse as a relay
By default, a network's lighthouses also act as relays, forwarding traffic between two hosts that cannot establish a direct connection. This applies to the managed lighthouse just as it does to a lighthouse you run yourself, and can be disabled in the network's settings.
While it is enabled, some of your host-to-host traffic may travel through Defined Networking's infrastructure. That traffic stays encrypted end-to-end between the two hosts: a relay knows which hosts are talking and how much, but cannot read or alter what they send.
When to run your own lighthouse
The managed lighthouse is the right choice for most networks. You may want to run your own lighthouse instead (or in addition) if you need:
- Full control over the infrastructure that handles peer discovery
- A lighthouse inside a specific network, region, or data center
- To keep all coordination infrastructure on hardware you operate
You can self-host one or more lighthouses alongside the managed lighthouse. See Enrolling a lighthouse for the step-by-step self-hosted setup.
A network can use the managed lighthouse, self-hosted lighthouses, or both at the same time. Adding your own lighthouse does not remove the managed one.