Mesh VPN
A mesh VPN is a virtual private network where every host can open an encrypted tunnel directly to any other host it is allowed to reach, instead of sending everything through a central VPN server. A coordination service helps hosts find each other, and from then on traffic flows between them.
A mesh VPN is a kind of overlay network: it runs on top of the networks hosts already use. Managed Nebula is built on Nebula, which Slack originally built to connect its own infrastructure and released under the MIT license in 2019.
How it works in Managed Nebula
- Identity: Each host has a certificate from the network's certificate authority and a private key that never leaves it.
- Discovery: Lighthouses tell hosts where to reach each other, without seeing their traffic.
- NAT traversal: Hosts punch through NAT to connect directly, and fall back to a relay when they can't.
- Access control: Each host's firewall denies inbound traffic unless a rule on its role or tags allows it.
Architecture covers each of these in detail.
An example
Say an engineer at a coffee shop needs to reach a Postgres server in a private VPC with no public IP. Their laptop asks a lighthouse where the database host is. If both NATs allow hole punching, the two connect directly. If not, traffic goes through a relay. Either way, the two hosts verify each other's certificates, and the database host's firewall only lets the laptop in if a rule on the database role allows TCP 5432 from the laptop's role. The coffee shop network and the relay only ever see encrypted UDP.
Mesh VPN vs traditional VPN
| Traditional VPN | Mesh VPN | |
|---|---|---|
| Setup | A central VPN server, plus a client on each device | A certificate authority and a lighthouse, plus a client on each host |
| Traffic path | Through a central VPN server | Directly between hosts, or through a relay |
| Failure impact | A server outage disconnects everyone | Existing tunnels keep working; the control plane isn't in the data path |
| Access model | Often the whole network once connected | Per-host firewall rules |
| Inbound ports | The VPN server accepts connections | Only lighthouses and relays, and none with a managed lighthouse |
| Scaling | Add and size more VPN servers | No central server, but lighthouses and relays need capacity |
Managed Nebula runs the certificate authority and a lighthouse for you. The blog has a longer comparison.
When to use a mesh VPN
The most common use is remote access to internal services. Teams also use one to connect workloads across clouds and to reach IoT devices and vehicle fleets behind carrier-grade NAT.
If everyone only needs to reach one office network, a traditional VPN may be simpler to run. A mesh VPN also isn't a consumer privacy VPN: it connects your own hosts, and it doesn't hide your IP address from websites.
Other mesh VPNs
Tailscale, NetBird, and Netmaker build on WireGuard. ZeroTier, like Nebula, uses its own protocol. See how Managed Nebula compares with Tailscale, ZeroTier, NetBird, Netmaker, and WireGuard.