Glossary

Short definitions of the terms used throughout these docs. Each one links to a page with the details.

Managed Nebula

The parts of Managed Nebula and the software that runs it.

Admin panel: The web interface at admin.defined.net for managing hosts, roles, tags, routes, API keys and audit logs.
Certificate authority: The CA that signs every host’s certificate. Defined Networking creates, rotates and secures it for you.
DNClient: The client software hosts run to join a Managed Nebula network and pick up its configuration.
DNClient Desktop: The Mac and Windows app for connecting to Managed Nebula networks, with enrollment codes and SSO.
DNClient Server: The command-line version of DNClient for servers, which can join one or more networks.
dnclientd: The background service behind DNClient Desktop that runs DNClient and reports its status.
Firewall rules: Inbound rules on roles and tags that decide which hosts can reach which ports, denying everything else.
Host: Any single device on a network, like a server or laptop, identified by its certificate.
Lighthouse: A host that tells other hosts where to find each other, without seeing their traffic.
Mobile Nebula: The Android and iOS app for joining Nebula and Managed Nebula networks.
Relay: A host that forwards encrypted traffic between two hosts that can’t connect directly.
Role: A host’s main purpose, like webserver, which carries the firewall rules for every host with that role.
Tag: A key:value label on a host, like region:us-west-1, used in firewall rules and to apply configuration.

Networking concepts

General networking terms, and how each one works in Managed Nebula.

Certificate rotation: Replacing certificates on a schedule. Defined Networking rotates host certificates and CAs automatically.
CGNAT range: 100.64.0.0/10, the address space reserved for carrier-grade NAT, and the recommended place for an overlay’s IPv4 range.
CIDR notation: A compact way to write a block of IP addresses, like 100.100.0.0/22.
Cipher: The algorithm that encrypts traffic. Managed Nebula uses AES-256-GCM between hosts.
Handshake: The exchange in which two hosts check each other’s certificates and agree on encryption keys.
IPv6 overlay: IPv6 addresses for hosts on the overlay, on IPv6-capable and dual-stack networks.
Mesh VPN: A VPN where hosts connect directly to each other instead of through a central server.
MTU: The largest packet a link can carry, and why the overlay’s is smaller than the underlay’s.
NAT traversal: How hosts behind routers and firewalls connect directly, with relays as a fallback.
Overlay network: A virtual network with its own addresses, built on top of existing networks.
Peer-to-peer connection: A direct encrypted tunnel between two hosts, with no server in the middle.
PKI: The system of certificates and keys that lets hosts prove who they are without shared secrets.
Port forwarding: Opening a router port to reach a device behind it, which Managed Nebula hosts don’t need.
Remote access VPN: A VPN that connects users to a network through a central gateway, and how Managed Nebula replaces it.
Site-to-site VPN: A VPN that links whole networks through gateways, and how Managed Nebula connects sites instead.
Split tunneling: Sending only some traffic through a VPN. Managed Nebula only carries overlay and route traffic.
Symmetric NAT: NAT that blocks direct connections between hosts, which Managed Nebula works around with relays.
Tunneling: Carrying one network’s packets inside another’s. Managed Nebula builds an encrypted tunnel between each pair of hosts.
Underlay network: The real networks an overlay runs on, like home Wi-Fi, a cloud VPC or the internet.
Zero trust networking: Granting access by verified identity rather than network location.
ZTNA: Zero trust network access: access to specific resources by identity, instead of the whole network.