Documentation

Create and organize your networks

A VIGIL-MESH network is the basic unit around which everything is organized: a single logical link that connects its members as if they were plugged into the same switch. Every machine on it receives a stable address, broadcast and multicast flow across it, and the access policy applies to it. This page explains what a network concretely is, how it addresses its machines, how to attach a remote LAN to it through subnet routes, and how to structure several networks without getting lost.

What a VIGIL network is: a single logical link

A VIGIL-MESH network is not a mere grouping of machines: it is a broadcast domain. All its members share a single logical link and reach each other directly, wherever they physically are — behind a home NAT, on a mobile hotspot or on a remote site. From the applications' point of view, belonging to the same VIGIL network amounts to being plugged into the same switch, but without cables and without exposure on the internet.

Technically, VIGIL-MESH is a layer 3 (L3) overlay that adds first-class broadcast. It is not a true stretched L2 with its fragilities (flooded ARP, spanning-tree, MAC learning), but an encrypted overlay that makes IP broadcast and multicast reach every member of the network as if on a local link.

One broadcast domain per network

Each network behaves like a single segment: what one member broadcasts, the other members of the same network receive. Two distinct networks never interfere.

Members, not locations

Membership follows the machine's identity, not its physical address of the moment. A laptop keeps its place in the network whether it changes Wi-Fi or switches to 5G.

One policy per network

Who talks to what, which services are published, which multicast flows circulate: everything is described at the network level and distributed to its members.

The most visible practical consequence is that device discovery and link-local protocols work across the network as on a LAN. The details of this broadcast — mDNS, SSDP, WS-Discovery, business multicast — are covered in L2 broadcast and encrypted multicast.

Addressing: stable addresses, one per machine

As soon as a machine joins a network, the controller assigns it an address that stays attached to it. This address depends neither on the physical network of the moment nor on the internet provider: it is how the other members reach the machine, wherever it is. Two address families coexist, distributed in the signed network map.

Family	Space	Role
IPv4	100.64.0.0/10 (CGNAT, RFC 6598)	Stable per-machine address, never routed on the public internet
IPv6	ULA prefix fd00::/8 (RFC 4193)	Prefix derived from the network, per-machine host, not routable outside the mesh

The choice of the CGNAT range 100.64.0.0/10 is deliberate: rarely present on users' local networks, it strongly reduces the risk of address collision with the subnet of the café, the hotel or the customer site you are plugged into. The IPv6 ULA additionally offers a vast and stable space for natively IPv6 uses.

You rarely reach your machines by their address: each one carries a short name resolved locally by MagicDNS, with no DNS query ever leaving the node. The complete workings of addressing and name resolution are detailed in Addressing and MagicDNS.

Subnets and routes to a remote LAN

Not every machine you need to reach can necessarily run a VIGIL agent: a printer, a PLC, a camera, a legacy server, a whole site LAN. For these cases, a member of the network acts as a subnet router: it advertises one or more ranges of the local LAN, and the mesh routes traffic to those ranges through it.

1
Choose a gateway machine on the remote siteA VIGIL node already enrolled, up and running on the LAN to publish — ideally an always-on machine close to the equipment to reach.
2
Declare the subnet routes it advertisesThe range or ranges of the local LAN (for example the cameras' or PLCs' subnet) that this gateway makes reachable from the VIGIL network.
3
Approve the routes on the controller sideAn advertised route only takes effect once approved: it is an explicit administration decision, not a side effect of enrollment.
4
Allow access through the policyMembers only reach the routed ranges if the network's access policy permits it. The route opens the path; the ACL decides who takes it.

A single gateway can publish several ranges, and a site can have several gateways for redundancy. Keep in mind, though, that a node routing a subnet relays the traffic of the entire published LAN: size it accordingly and reserve this role for machines whose availability you control.

Good organizational practices

A well-partitioned network is easier to reason about and administer than a single network stuffed with rules. A few principles avoid most of the later headaches.

Partition by real broadcast domain: if two groups have no reason to see each other in broadcast or multicast, make them two networks rather than one network segmented by ACL.
Name legibly: a meaningful network name (site, environment, team) saves mistakes when the console holds several of them.
Reserve subnet routes for equipment that cannot carry an agent; wherever possible, enroll the machine directly to benefit from the stable address and the fine-grained policy.
Document the LAN ranges published per site to spot overlaps at a glance before they bite.
Separate sensitive environments (production, OT) into their own network rather than relying solely on rules to isolate them.

Once your networks are in place, the next step is to define on them who talks to what. That is the role of the access policy, described in Policies and access control lists (ACL).

How many networks can I create?

As many as your organization needs. The right number follows from partitioning into broadcast domains: one network per set of machines that genuinely need to see each other in broadcast, not one giant network carved up with rules.

Can a machine belong to several networks?

A network is a broadcast domain: membership is reasoned about network by network. To make two networks talk to each other, you go through the access policy and, where relevant, through routes — not by merging the two broadcast domains.

Do I need to open ports to publish a remote LAN?

No. The subnet gateway is an ordinary VIGIL node: it needs no inbound port. It joins the mesh outbound and routes traffic to its local LAN, without exposing anything on the internet.