Stable addressing and local name resolution

Stable addresses, one per machine

On a VIGIL network, each machine is assigned an address that stays attached to it. It depends neither on the physical network of the moment, nor on the internet provider, nor on whether the machine sits behind a home NAT, on a mobile hotspot or wired into a remote site. This address is the one other members use to reach it, wherever it is.

Two address families coexist, distributed by the controller in the signed network map:

• An IPv4 address taken from the CGNAT space 100.64.0.0/10 (RFC 6598), reserved for large-scale address sharing and never routed on the public internet.
• An IPv6 address taken from a ULA prefix (Unique Local Address, fd00::/8, RFC 4193) derived from the network, specific to your organization and not routable outside the mesh.

The assignment is deterministic and durable: a machine that reboots, changes Wi-Fi or switches to 5G keeps the same VIGIL address. That is what allows a service, a firewall rule or a bookmark to stay valid over time, even as the machine's physical location varies.

Why a dedicated private space

The choice of the 100.64.0.0/10 range is not incidental. Unlike the classic RFC 1918 ranges (10.0.0.0/8, 192.168.0.0/16), widely used by home routers, corporate routers and other VPNs, the CGNAT space is rarely present on users' local networks. By settling there, VIGIL sharply reduces the risk of address collisions: your mesh address almost never conflicts with the subnet of the café, the hotel or the client site you happen to be plugged into.

• Less overlap with home and corporate networks, so fewer ambiguous routes to arbitrate.
• A space large enough (more than four million addresses) to cover large fleets without renumbering.
• A clean separation between "what is mine on the mesh" and "the local network of the moment", which makes reasoning and access rules easier.

IPv6 ULA plays a complementary role: it provides a vast, stable address space, derived from the network, for uses that natively prefer IPv6 — without ever exposing those addresses outside the encrypted mesh.

MagicDNS: resolution stays on the machine

Remembering IP addresses makes no sense for a human. VIGIL associates a short name with each machine and lets you reach it by that name. Resolving these names — MagicDNS — happens entirely locally, straight from the signed network map the controller distributes.

The important point is that this resolution relies on no external DNS server. The name-to-address mapping is already present on the machine, in the network map, and the agent serves it itself:

1. 1
   The controller distributes a signed network mapIt contains, for each machine on the network, its name and its VIGIL addresses. The signature guarantees the map has not been tampered with.
2. 2
   The agent resolves VIGIL names locallyWhen an application asks for a network name, the agent answers straight from the map, without emitting a single query to an external resolver.
3. 3
   No DNS query leaves the nodeNobody outside — not the internet provider, not a public resolver, not the VIGIL infrastructure — learns which device is trying to reach another.

Names that don't belong to the VIGIL network — a public website, a third-party service — keep being resolved by your system's usual resolver. MagicDNS only handles the mesh's namespace; it does not hijack the rest of your DNS traffic.

Renaming and internal names

Names are administered, not guessed. Each machine carries a stable internal name, chosen at enrollment and changeable afterwards, and this name is what serves as the anchor: renaming it updates the signed network map without changing the underlying VIGIL address. Your address-based accesses therefore stay valid even after a rename.

• One short name per machine, resolved the same way everywhere on the network.
• A rename propagates through the signed network map the controller redistributes; it requires no reconfiguration on the client side.
• The namespace is private to the network: two distinct organizations can use the same names without interference, each in its own mesh.

The whole forms a coherent directory: stable addresses on one side, readable names on the other, both distributed by the controller and served locally — without any information about your resolutions ever leaving your machines.