# Managed lighthouse

A managed lighthouse is a [lighthouse](/docs/glossary/lighthouse/) that Defined Networking runs and maintains for your Managed Nebula [network](/docs/glossary/network/), so your [hosts](/docs/glossary/host/) can find each other without you running a server with a public IP address. Every new network gets one automatically, at no extra cost.

It does the same job as a lighthouse you host yourself. It learns the internet address where each host can be reached and answers when other hosts ask, and it also acts as a [relay](/docs/glossary/relay/) for hosts that can't connect directly. It takes no part in the [handshake](/docs/glossary/handshake/) between two hosts and holds none of their keys, so it can't read their traffic. Its certificate carries no role or tags, so your firewall rules never give it access to your hosts.

The setting is **Use managed lighthouses**, on a network's **Edit network** page under [Settings > Networks](https://admin.defined.net/settings/networks). While the lighthouse is being set up, the page shows it as **Pending**, and then as **Active**. Managed lighthouses are reached over IPv6, so they need an IPv6-capable network. An older IPv4-only network has to be updated to dual-stack first, which needs DNClient 0.9.3 or later and Mobile Nebula 0.10.0 or later on every host.

You can run self-hosted lighthouses alongside the managed one, for example to keep discovery inside a particular data center. Adding your own doesn't remove the managed lighthouse. Unchecking **Use managed lighthouses** does, so only do that if the network has a self-hosted lighthouse, or hosts won't be able to find new peers. [Config overrides](/docs/glossary/config-override/) don't apply to managed lighthouses.

For details, including what the managed lighthouse can see, see [Managed lighthouses](/docs/get-started/managed-lighthouses/). To run your own, see [Enrolling a lighthouse](/docs/get-started/enrolling-a-lighthouse/).