Documentation
Create and organize your networks
A VIGIL-MESH network is the basic unit around which everything is organized: a single logical link that connects its members as if they were plugged into the same switch. Every machine on it receives a stable address, broadcast and multicast flow across it, and the access policy applies to it. This page also explains how a gateway reaches explicitly selected LAN devices without ever publishing an entire subnet implicitly.
What a VIGIL network is: a single logical link
A VIGIL-MESH network is not a mere grouping of machines: it is a broadcast domain. All its members share a single logical link and reach each other directly, wherever they physically are — behind a home NAT, on a mobile hotspot or on a remote site. From the applications' point of view, belonging to the same VIGIL network amounts to being plugged into the same switch, but without cables and without exposure on the internet.
Technically, VIGIL-MESH is a layer 3 (L3) overlay that adds first-class broadcast. It is not a true stretched L2 with its fragilities (flooded ARP, spanning-tree, MAC learning), but an encrypted overlay that makes IP broadcast and multicast reach every member of the network as if on a local link.
One broadcast domain per network
Each network behaves like a single segment: what one member broadcasts, the other members of the same network receive. Two distinct networks never interfere.
Members, not locations
Membership follows the machine's identity, not its physical address of the moment. A laptop keeps its place in the network whether it changes Wi-Fi or switches to 5G.
One policy per network
Who talks to what, which services are published, which multicast flows circulate: everything is described at the network level and distributed to its members.
The most visible practical consequence is that device discovery and link-local protocols work across the network as on a LAN. The details of this broadcast — mDNS, SSDP, WS-Discovery, business multicast — are covered in L2 broadcast and encrypted multicast.
Addressing: stable addresses, one per machine
As soon as a machine joins a network, the controller assigns it an address that stays attached to it. This address depends neither on the physical network of the moment nor on the internet provider: it is how the other members reach the machine, wherever it is. Two address families coexist, distributed in the signed network map.
| Family | Space | Role |
|---|---|---|
| IPv4 | 100.64.0.0/10 (CGNAT, RFC 6598) | Stable per-machine address, never routed on the public internet |
| IPv6 | ULA prefix fd00::/8 (RFC 4193) | Prefix derived from the network, per-machine host, not routable outside the mesh |
The choice of the CGNAT range 100.64.0.0/10 is deliberate: rarely present on users' local networks, it strongly reduces the risk of address collision with the subnet of the café, the hotel or the customer site you are plugged into. The IPv6 ULA additionally offers a vast and stable space for natively IPv6 uses.
You rarely reach your machines by their address: each one carries a short name resolved locally by MagicDNS, with no DNS query ever leaving the node. The complete workings of addressing and name resolution are detailed in Addressing and MagicDNS.
Gateway access to exact LAN hosts
A printer, PLC, camera, or legacy server cannot always run the VIGIL agent. A Windows or Linux node on the same LAN can act as its gateway. Enabling it never publishes the subnet automatically: only checked devices are authorized, each through an IPv4 /32 route.
- 1Choose a gateway machine on the remote siteA VIGIL node already enrolled, up and running on the LAN to publish — ideally an always-on machine close to the equipment to reach.
- 2Choose the physical LAN interfaceIn the gateway panel, select the Ethernet or Wi-Fi interface actually connected to the devices. Tunnel, virtual, and VIGIL interfaces are excluded.
- 3Check each authorized deviceSelect only the LAN neighbors that must be reachable. VIGIL binds authorization to the interface, exact IPv4 /32, and observed MAC address; no other LAN host is included.
- 4Allow access through the policySelecting a host only opens the gateway path. Members can reach it only when the network access policy permits it; the ACL remains the final decision.
A gateway can authorize several devices, but every entry remains an independent /32. Disabling the gateway removes those authorizations after confirmation; enabling it again requires a new selection.
Good organizational practices
A well-partitioned network is easier to reason about and administer than a single network stuffed with rules. A few principles avoid most of the later headaches.
- Partition by real broadcast domain: if two groups have no reason to see each other in broadcast or multicast, make them two networks rather than one network segmented by ACL.
- Name legibly: a meaningful network name (site, environment, team) saves mistakes when the console holds several of them.
- Reserve gateway access for equipment that cannot carry an agent; wherever possible, enroll the machine directly to benefit from stable identity and fine-grained policy.
- Authorize only the required hosts and preferably give them fixed DHCP leases, even though MAC verification already suspends an unexpected reassignment.
- Separate sensitive environments (production, OT) into their own network rather than relying solely on rules to isolate them.
Once your networks are in place, the next step is to define on them who talks to what. That is the role of the access policy, described in Policies and access control lists (ACL).