Documentation
One local network across multiple sites, over the internet
Two workshops, an office and a warehouse, an integrator and its customers: the need is always the same — extend the LAN over the internet so that machines on two sites (or ten) see and discover each other as if they shared the same switch. VIGIL-MESH builds that multi-site network machine by machine: every computer runs the agent and joins a single logical LAN, with discovery, multicast and stable names — no MPLS, no IPsec tunnels, no port to open.
The need: several sites, one network
Two workshops, one production line
The CAD workstations of the first workshop must talk to the machines and servers of the second, both ways, without a remote-access ritual for every file exchange.
An office and a warehouse
The ERP runs at the office; the label printer, the scanners and the logistics workstation live at the warehouse. All of it has to behave like one network.
An integrator and its customers
Equipment installed at dozens of customer sites to maintain, each behind the site’s box or 4G router, with no IT staff on location.
In every one of these cases, connecting two sites hits the same wall: each site lives behind its NAT — fiber box, 4G router, sometimes a carrier’s CGNAT or a Starlink uplink — and the local network stops dead at the building’s door. Connecting two networks over the internet becomes an infrastructure project, when the need fits in one sentence: the machines should see each other.
The classic approaches, and why they weigh you down
MPLS
The carrier-grade private network: dependable, but expensive, contractual, slow to roll out — and impossible to extend to a customer site or a 4G-only location.
Site-to-site IPsec VPN
Router-to-router tunnels, configured on both ends, with stable public addresses required and address plans to keep in sync. It works — until the one firmware update too many. Our detailed comparison: site-to-site VPN, the mesh way.
Port forwarding
Exposing the NAS or the server through a box redirection: NAT breaks half the use cases, every open port is attack surface, and CGNAT makes the whole exercise impossible.
With VIGIL-MESH: one logical LAN, machine by machine
Every machine — Windows workstation, Linux server, Android phone, NVIDIA Jetson, even a plain browser (WASM) — runs the agent and joins the network. Together they form a single logical LAN, whatever their site: same stable addresses, same discovery, same rules. There is no router to configure and no box to touch.
- Zero inbound ports: every machine connects outward and traverses NAT, CGNAT, 4G/5G or Starlink.
- End-to-end encryption with QUIC/TLS 1.3, Ed25519 identities and a hybrid post-quantum key exchange; when a relay (a “vigie”) is needed, it is blind: it only sees encrypted packets.
- Broadcast and multicast cross the mesh: mDNS, SSDP or DDS behave as on a local network — see broadcast and multicast in the mesh.
- Every machine gets a stable address and a short name resolved by MagicDNS — see addressing and DNS.
- Identity-based ACLs decide who reaches what across sites; the web console shows the machines, the real-time topology and the audit trail.
Concrete case: site B’s printer, invisible from site A
The NAS and the label printer live on site B’s network, behind the box. From site A: nothing. mDNS/SSDP discovery does not cross the internet, the NAS’s 192.168.1.x address means nothing outside the site, and a port forward on the box would expose the NAS to the whole internet.
Even with a classic hub-and-spoke VPN, the discovery multicast is lost along the way: you end up typing IP addresses by hand — which change the first time a box is replaced, and everything has to be redone.
- 1Create a network and enroll site AInstall the agent on the site A workstations and enroll them into a VIGIL-MESH network — with an enrollment key, no network configuration.
- 2Enroll one machine on site BA workstation or mini-PC on site B, which sees the NAS and the printer on the local LAN, runs the agent and joins the same network. No rule to create on the site’s box.
- 3Publish the NAS and the printer through that machineIf they cannot run the agent themselves, the site machine publishes them host by host: they become reachable by the network’s members, under ACL control. (If the NAS is a standard Linux machine, it can also carry the agent directly.)
- 4Give them a nameWith MagicDNS, the NAS and the printer are reached by a short name, resolved from any site of the network: no more IP addresses to remember, no address plans to reconcile.
- 5Verify from site AMount the NAS share and print a page: discovery and traffic go through the mesh, encrypted end to end — direct as soon as the path exists, through a blind vigie otherwise.
