Skip to content

Route

A route in Managed Nebula sends traffic for one or more subnets through a chosen host, called the router, so hosts on the overlay can reach machines that can’t run DNClient. Typical targets are managed cloud services like a database, printers, and other devices you can’t install software on. In Nebula’s own config these are called unsafe routes.

Routes are on the Routes page of the admin panel. A route has:

  • Router: the host that forwards traffic between the overlay and its local network, usually a Linux host with IP forwarding turned on. A route with no router can’t be reached.
  • Routable CIDRs: the subnets reached through the router, such as 192.168.86.0/24 for a whole VPC or 192.168.86.5/32 for one machine. With Automatically install checked, the route is installed on subscribed hosts for you.
  • Tags: hosts, lighthouses, and relays with these tags subscribe to the route. Only subscribed hosts can use it.
  • Firewall rules: which roles and tags may reach each subnet through the router, on which ports and protocols. If one router serves several routes, their rules are combined on it, so limit each rule to its route’s CIDRs.

Traffic between a subscribed host and the router travels through the encrypted Nebula tunnel. From the router to the destination it’s ordinary traffic on the router’s local network, which is the underlay, so the router usually also needs NAT or masquerade rules on its own firewall. Routes are one way Managed Nebula connects a whole site without a site-to-site VPN gateway.

Routable CIDRs are IPv4 subnets, so the router needs an IPv4 overlay address. On an IPv6-capable network, that means a dual-stack network with an IPv4 range (see IPv6 overlay). Deleting a router host leaves its routes without one until you choose another. For a full walkthrough, including the Linux firewall setup on the router, see Extend network access beyond overlay hosts. API keys need the routes scopes to manage routes.