Every server, VPC subnet, and cluster becomes reachable by name from anywhere — without a single inbound port open to the internet. Bastion hosts, jump boxes, and allowlisted office IPs become unnecessary.
Any Linux box or VM in your VPC, office, or data center becomes a subnet router with a single flag. The entire range joins your network — hundreds of databases, internal services, and admin panels become reachable by name or IP, without installing anything on any of them.
The fastest way to shrink your attack surface is to stop listening on the internet entirely. With access flowing through the mesh, the bastion's public IP, the VPN endpoint, the temporary firewall rule for a migration — all of it goes away. If nothing accepts inbound connections, there's nothing to scan, brute-force, or zero-day.
Pick the pattern that fits the resource. All three run on the same identity and the same ACL engine.
Install the client on the host itself. It joins the mesh, gets a stable name and IP, and is reachable by anyone the ACL allows.
One machine advertises an entire VPC or office subnet. Hundreds of resources become reachable without touching any of them.
Route outbound traffic through a trusted node — fixed source IP for partner allow-lists, or a compliant region for regulated data.
From multi-cloud backbones to a single contractor's scoped endpoint.
AWS, GCP, and Azure ranges on one network — no transit gateways or inter-cloud peering to maintain.
VPCs, office LANs, and data center racks join with one command per site, approved centrally.
Every advertised resource resolves under one domain. Humans stop maintaining hosts files.
Edge sites and LTE devices join without port forwarding or carrier negotiations.
Zero public listeners to patch or defend. Access is outbound-only from each node.
Who reaches which range, port, and tag — decided by policy, visible in pull requests.
AmneziaWG end to end, including the hop across the public internet between sites.
Contractors get an identity that reaches exactly one service and expires Friday.
Run migrations from a laptop over the overlay — no public endpoint, no temp firewall rule.
API servers, nodes, and pod networks stay private, reachable from laptop or CI.
The rack in the office and the region in the cloud behave like one network.
Devices behind LTE or CGNAT phone home through the mesh — reachable and patchable.
Advertise your first subnet in under ten minutes.