Tunneling

Tunneling means carrying one network’s packets inside another network’s packets. The original packet is wrapped in a new header, sent across the network in between, and unwrapped at the far end as if it had traveled there directly. VPNs use tunneling, almost always with encryption, so private traffic can cross the internet without being read along the way.

Tunnels in Managed Nebula

DNClient adds a virtual network interface to each host. Applications reach other hosts through it using their overlay addresses, the same way they’d use any other network. Each packet sent to an overlay address is encrypted and carried inside a UDP packet across the underlay, and the receiving host decrypts it and passes it to its own operating system.

There’s no shared tunnel to a central server. Each pair of hosts that talks gets its own tunnel, created with a handshake the first time one of them sends traffic to the other. Tunnels go directly between the two hosts when NAT traversal can open a path, and through a relay when it can’t. Only the two hosts can decrypt what’s inside either way.

Once a tunnel is up it doesn’t depend on Defined Networking’s API, so it keeps working if the API is unreachable. See Architecture.

Wrapping a packet adds headers, which makes the tunneled packet bigger than the original. The overlay uses a smaller MTU than the network underneath to leave room for them.

A traditional VPN typically sends all of a device’s traffic through one tunnel to a VPN server. Managed Nebula only tunnels traffic meant for the overlay and its routes, and sends it straight to the host it’s for. See Split tunneling.