Managed lighthouse

A managed lighthouse is a lighthouse that Defined Networking runs and maintains for your Managed Nebula network, so your hosts can find each other without you running a server with a public IP address. Every new network gets one automatically, at no extra cost.

It does the same job as a lighthouse you host yourself. It learns the internet address where each host can be reached and answers when other hosts ask, and it also acts as a relay for hosts that can’t connect directly. It takes no part in the handshake between two hosts and holds none of their keys, so it can’t read their traffic. Its certificate carries no role or tags, so your firewall rules never give it access to your hosts.

The setting is Use managed lighthouses, on a network’s Edit network page under Settings > Networks. While the lighthouse is being set up, the page shows it as Pending, and then as Active. Managed lighthouses are reached over IPv6, so they need an IPv6-capable network. An older IPv4-only network has to be updated to dual-stack first, which needs DNClient 0.9.3 or later and Mobile Nebula 0.10.0 or later on every host.

You can run self-hosted lighthouses alongside the managed one, for example to keep discovery inside a particular data center. Adding your own doesn’t remove the managed lighthouse. Unchecking Use managed lighthouses does, so only do that if the network has a self-hosted lighthouse, or hosts won’t be able to find new peers. Config overrides don’t apply to managed lighthouses.

For details, including what the managed lighthouse can see, see Managed lighthouses. To run your own, see Enrolling a lighthouse.