Peer-to-peer connection

A peer-to-peer connection is a direct link between two devices, where neither one acts as a central server for the other. In Managed Nebula, every pair of hosts that talks gets its own encrypted tunnel, and their traffic goes straight from one to the other.

Traditional remote access VPNs work the other way. Every client connects to a central VPN server, so traffic between two clients goes up to the server and back down, even when the two machines are on the same desk.

How a connection is set up

When a host first sends traffic to another host, it asks a lighthouse where that host can be reached. Both hosts then send packets toward each other to open a path through their routers and firewalls (NAT traversal), and once packets get through, they check each other’s certificates and agree on keys in a handshake.

Tunnels are created on demand like this, so a host only keeps tunnels open to the peers it actually talks to.

Going direct means traffic takes the shortest route available. Two hosts on the same office LAN talk over the LAN rather than across the internet, and no central server limits bandwidth or adds latency. It also means there’s no single box whose failure takes everyone offline: once tunnels are up, they keep working even if Defined Networking’s API is unreachable (see Architecture).

When a direct connection isn’t possible

Some networks, such as those behind symmetric NAT or carrier-grade NAT, can’t be reached directly. Traffic then goes through a relay. The tunnel is still between the two hosts and still end-to-end encrypted, so the relay only passes along packets it can’t read.

A network built from peer-to-peer connections between many hosts is a mesh VPN.