Documentation

Company private network: multi-site and remote work, no VPN hardware

Connecting headquarters, workshops, remote sites and home offices on a single private network, without buying a VPN concentrator or site-to-site boxes: that is what a software-agent mesh does. Every machine — server, workstation, shop-floor gateway — gets an identity and joins the network through outbound connections only: zero inbound ports, post-quantum end-to-end encryption, and access decided machine by machine from a console.

The company private network, without the machine room

A company private network has historically meant hardware: a VPN concentrator in a DMZ for road warriors, IPsec tunnels between routers for the sites, and firewall rules to maintain at every change. The need itself has not changed — three populations must reach each other as if they shared a building.

Sites with each other

Headquarters, branches, workshops, warehouses: file servers, ERP and supervision must be reachable across sites — see one LAN across several sites.

Remote work, industrial included

The design office reaching the CAD server, the automation engineer following the SCADA from home: the remote computer joins the network, not the other way round — see remote work for SMBs.

Contractors and service teams

An integrator or machine builder works on one specific machine, for the duration of the contract, without seeing the rest of the network — see industrial remote maintenance.

What the hardware approach really costs

VPN concentrators and site-to-site boxes work — a whole generation of companies was built on them. But their architecture carries structural costs that grow with the network.

A port exposed on the Internet: the concentrator listens publicly, and every CVE on the appliance becomes an emergency — it is the most scrutinised attack surface on the market.
A single choke point: all remote traffic converges on the concentrator, which becomes both a bottleneck and a single point of failure.
One box per site: purchase, IPsec configuration, renewals, monitoring — the hardware and staffing cost grows with the number of sites.
Overly broad access: a tunnel often grants a whole network, when the right answer would be “this machine, this service, this team”.

How it works: agents, enrollment, ACLs

1
Install the agent on each machineWindows, Linux (desktop or server), Android, NVIDIA Jetson — and the browser itself can become a node of the network (WASM) for access with nothing installed.
2
Enroll with a single-use keyFrom the console, the “Add a machine” assistant hands you a key that expires on its own. One command on the machine, and it joins the network with its own identity.
3
Machines connect directlyThe agent traverses NAT, CGNAT and 4G/5G links without opening any port. When no direct path can be established, relays — the vigies — carry opaque packets: they do not hold the keys.
4
Write down who talks to whatACLs deny by default: every flow is explicitly authorised — machine, group, service. See policies and ACLs.
5
Name your machinesEvery machine gets a stable overlay address and a MagicDNS name: no more IPs kept in a spreadsheet, your tools point at names that never move.

Every session is encrypted end to end: QUIC/TLS 1.3, Ed25519 keys, hybrid post-quantum key establishment. Nobody but the two endpoints sees the content — not even the relays.

Concentrator, boxes, agent mesh: the comparison

	VPN concentrator	Site-to-site boxes	Agent mesh
Hardware to buy	The central appliance	One box per site	None
Port exposed on the Internet	Yes, permanently	Yes, on every router	None, anywhere
Adding a site	New tunnel to configure	New box to install	Enroll the site's machines
Remote worker	VPN client to the hub	Not covered	Same agent as the servers
Access granularity	Often the whole network	Subnet to subnet	Machine by machine, service by service
Traffic path	Everything through the hub	Site to site	Direct between peers whenever possible

For a product-by-product comparison — Tailscale, ZeroTier, OpenVPN, Hamachi — see VIGIL-MESH against the mesh VPN market.

A full LAN, not just tunnels

Once the machines are enrolled, everything that speaks IP works between them — as if they shared the same switch.

File shares and internal apps

SMB servers, intranet, ERP, databases: reachable at their MagicDNS name, from any authorised site or workstation.

Console and audit log

Machine inventory, real-time topology, per-member roles and an audit log: who accessed what, and when.

SSH terminal in the browser

Every online machine offers an SSH terminal right in the console — see the Administration tab.

Discovery and real time

Broadcast and multicast cross the mesh: mDNS, SSDP, printer and device discovery — see the broadcast domain.

Frequently asked questions

Do we need to host a VPN server or install an appliance somewhere?

No. The network is built agent to agent: every machine makes outbound connections and peers connect directly whenever possible. When no direct path can be established, traffic goes through relays — the vigies — which do not hold the keys and only see opaque packets. There is no concentrator to size and no port to expose on the Internet.

How do we connect a remote worker's computer?

Like any other machine: install the agent (Windows, Linux, Android), enroll it with a single-use key generated from the console, and let ACLs decide what that computer may reach. Nothing to configure on the home router or firewall: the agent only makes outbound connections.

Can we migrate gradually from our existing VPN?

Yes. The mesh coexists without conflict with a VPN concentrator or IPsec boxes already in place: you can migrate service by service and site by site, then decommission the old equipment once nothing uses it anymore.

Does employee Internet traffic go through the private network?

No. The mesh only carries traffic between the machines of your network: regular web browsing leaves through each computer's local connection. VIGIL-MESH is a company private network, not a consumer VPN that hides your IP address.

And tomorrowOperate these machines with an AI assistant →

The same network that connects them lets each software announce its capabilities — and an MCP assistant see and operate them, under your control, machine by machine.