Documentation

Machine-to-machine (M2M) network: 4G/LTE fleets, no public IP

A fleet of machines that must talk to each other — mobile robots, drones, sensors, gateways — and not a single public IP address among them: that is everyday machine-to-machine over 4G/LTE. VIGIL-MESH gives every machine an identity and a stable address on a private network: machines reach each other, discover each other and exchange in real time — encrypted end to end, with no open port and no server to host.

M2M today: fleets behind 4G

Machine-to-machine is no longer about modems dialling each other: it is entire fleets of mobile or isolated equipment, each behind a carrier's network, that must form one coherent system.

Mobile robots: AGVs and AMRs

A fleet coordinating with itself and reporting to its supervision, from one warehouse or worksite to the next — see connecting a robot fleet.

Drones and teleoperated machines

MAVLink telemetry, video, commands — beyond radio range, over the mobile network: see flying a drone over 4G.

Field sensors and gateways

Isolated stations, roadside cabinets, sites without IT: a Linux or Jetson gateway carries the agent and connects the site's equipment, host by host.

The wall: CGNAT, symmetric NAT, changing addresses

M2M runs into a reality of mobile networks: no machine on them is reachable from the outside. The classic workarounds solve it at a steep price.

On 4G/LTE, every machine sits behind the carrier's CGNAT: no public address, no port forwarding possible — the details are on the CGNAT and remote access page.
NAT there is often symmetric: even knowing the address is not enough, it changes with every outbound connection.
A private carrier APN solves it — through a dedicated M2M contract, carrier by carrier, country by country, with its recurring cost.
A central VPN server also solves it — but all machine-to-machine traffic detours through it: doubled latency, a single point of failure, a server to host and defend.

Machine to machine, literally

The mesh gives M2M back its literal meaning: machines talk to each other, with no application server in the middle. Fleet onboarding takes four steps.

1
Embed the agentLinux x86 or ARM, NVIDIA Jetson, Android: the agent installs on the on-board computer or the equipment's gateway, and starts with it.
2
Enroll at staging or deploymentOne single-use key per machine, generated from the console: the machine joins the network with its own cryptographic identity, individually revocable.
3
Every machine gets a stable addressA fixed overlay address and a MagicDNS name: “agv-07” stays “agv-07”, whatever the carrier, the country or today's address. Your software points at names, not IPs.
4
Write down who talks to whomACLs deny by default: the fleet talks to its supervision, robots of the same site see each other, and nothing else — see policies and ACLs.

Device discovery and real time

An M2M network does not just move bytes: it must let machines find each other, and let the flows keep up.

Automatic discovery

mDNS and SSDP cross the mesh: a machine joining the fleet is discovered by the others, like on a LAN — see the broadcast domain.

ROS 2 and DDS

DDS discovery relies on multicast — which crosses: a fleet's ROS 2 nodes see each other with no peer configuration — see the VPN for robotics and ROS 2.

Telemetry and command

Real-time flows — MAVLink, commands, sensors — benefit from QUIC datagrams and the most direct path — see real time and datagrams.

Field serial links (beta)

The RS-232/RS-485 instrument of a remote device reads like a local port — see the remote serial port.

Where it embeds

The agent is software: it needs an operating system, however modest. The common embedded platforms are covered.

NVIDIA Jetson — the go-to platform for robots and smart cameras: installing on Jetson.
Linux x86 and ARM — on-board computers, gateways, industrial boxes: installing on Linux.
Android — rugged terminals, shop-floor tablets, mobile equipment.
Windows — supervision stations and special machines that embed a PC.

Frequently asked questions

Can two machines on 4G really talk to each other?

Yes. The agent first attempts a direct path through NAT traversal; when both links sit behind strict CGNAT — common on 4G — traffic goes through relays, the vigies, which do not hold the keys and only see opaque packets. Either way, the session is encrypted end to end, machine to machine.

Do we need a special SIM card or a private carrier APN?

No. A consumer SIM is enough: the agent only needs an outbound connection, whatever the carrier. That is precisely the advantage over private APNs — no dedicated M2M contract per carrier, no dependency on a country or a plan.

Does device discovery work like on a local network?

Yes: broadcast and multicast are replicated, encrypted, to the machines of the same broadcast domain. mDNS, SSDP and ROS 2's DDS discovery see the fleet's machines as if they shared a switch.

Does the agent run on a microcontroller?

No. The agent needs an operating system: Linux (x86 or ARM), NVIDIA Jetson, Android, Windows. A bare sensor or a microcontroller board is connected through a site gateway that carries the agent — with each reachable device declared individually.

And tomorrowOperate these machines with an AI assistant →

The same network that connects them lets each software announce its capabilities — and an MCP assistant see and operate them, under your control, machine by machine.