Overlay in Four Shapes
The overlay takes the shape the estate needs — hub-and-spoke, a hub pair, direct tunnels between the spokes that need them, or every site to every site — drawn on the console canvas and written to both ends of every tunnel.
Walk through a single flow
- 1Hub-and-spoke: every site dials one hub, and every flow between sites is inspected there.
- 2Dual hub: a second hub holds host routes only, so it never quietly attracts traffic; the console moves the spokes across after a silence threshold and a health check, and moves them back once the preferred hub has been stable.
- 3Spoke shortcuts: the hub stays the rendezvous point, and two spokes that need each other hold a direct tunnel. The console learns each site's address from the hub's own view of the tunnel, so no discovery service is involved.
- 4Full mesh: the same shortcut, applied to every pair, capped at eight sites so the key fan-out stays bounded.
- 5Where both sites sit behind a NAT that rewrites ports, a relay in the console's own stack carries the packets. It matches a handshake against an allow-list without holding a key, so it can forward the traffic and never read it.
Technical notes
Traffic on a shortcut does not pass the hub, so the hub's inspection does not see it — each site's own engine does. That is the trade a shortcut makes: the shortest path, inspected at both ends rather than in the middle. The console says so on the card before the shape is chosen.
A direct tunnel is held only while it handshakes and while it is actually the faster path; when it stops doing either, both sides are rewritten and the pair goes back through the hub, then tries again later. A pair the console cannot make direct says why on the link — both ends behind a port-rewriting NAT, or an address it has not observed yet.