Skip to main content

Overlay network

An overlay network is a virtual network built on top of one or more existing networks. Each host gets a second address on the overlay, and traffic between overlay addresses is wrapped up and carried across whatever physical networks sit underneath, which are called the underlay.

Say a laptop on home Wi-Fi has the address 192.168.1.23 and a server in AWS has 10.0.4.17. On a Managed Nebula overlay they might also be 100.100.0.5 and 100.100.0.9, and they talk to each other using those addresses. When the laptop moves to an office or a phone hotspot, its underlay address changes. Its overlay address doesn't, so nothing that connects to it needs to know.

The overlay in Managed Nebula​

  • Addresses: Each host gets an overlay IP from the network's range, and that address is part of its certificate, so a host can't claim someone else's.
  • Interface: DNClient adds a virtual network interface to the host. Applications use overlay addresses like any other IP, with no changes.
  • Transport: Packets sent to an overlay address are encrypted and carried over UDP, directly to the other host or through a relay.

Choosing the overlay range​

The overlay range must not overlap any underlay range your hosts use, or traffic meant for the overlay can end up on the local network instead. Home routers usually use 192.168.0.0/16, and cloud VPCs commonly use parts of 10.0.0.0/8 and 172.16.0.0/12.

That's why we recommend a range inside 100.64.0.0/10, the shared address space reserved for carrier-grade NAT (CGNAT) in RFC 6598. It's rarely used on home or cloud networks. New networks default to 100.100.0.0/22, which has room for 1,022 hosts. The range can't be changed after the network is created, so leave room to grow. See Choosing a CIDR for the details.

Reaching hosts that aren't on the overlay​

Some things can't run DNClient, like a managed database such as AWS RDS, a printer, or an industrial controller. For those, a Linux host on the overlay can act as a router. You create a route that names the router and the subnet behind it, such as 192.168.86.5/32 for a single database, and a tag like needs:rds. Only hosts with that tag can use the route, and the route's own firewall rules decide which ports they reach. See Extend network access beyond overlay hosts.

Overlay network vs mesh VPN​

The two terms are often used interchangeably, but they describe different things. "Overlay" describes the addressing: a separate network laid on top of the real one. "Mesh" describes the topology: hosts connect directly to each other instead of through a central server. Nebula is both, while some overlays route all traffic through a hub. See Mesh VPN.

On this page