Skip to content

Network

A network in Managed Nebula is one overlay network: a set of hosts that share an IP address range and can reach each other, as far as their firewall rules allow. An account can have more than one network. Hosts on different networks can’t communicate, but every network in an account uses the same roles and tags.

Networks live under Settings > Networks in the admin panel. When you add one, Managed Nebula generates its IPv6 range for you, and you can also give it an IPv4 range, which makes it dual-stack. A network holds at most one IPv4 range. Once a range is set it can’t be changed, so read Choosing a CIDR before you pick one. The form also has these settings:

  • Use managed lighthouses: Defined Networking runs a managed lighthouse for the network. It’s on by default.
  • Use self-hosted lighthouses as relays: lighthouses you run yourself also act as relays.
  • Use P-256 elliptic curve cryptography: signs the network’s certificates with ECDSA P-256 instead of Ed25519. This can’t be changed after the network is created.

Editing a network adds a Host advanced config section, which applies config overrides to every host, lighthouse, and relay in it.

Each host belongs to one network, chosen when the host is created. It can’t be moved afterward, so changing a host’s network or address range means migrating to a new network. A network can’t be deleted while it still has hosts, lighthouses, relays, an endpoint SSO provider, or a join key that uses it.

Networks created before IPv6 support are IPv4-only and use version 1 Nebula certificates. Their Edit network page has an Update network button that makes them dual-stack and moves them to version 2 certificates.