Documentation
The next-generation mesh VPN
A mesh VPN connects your machines directly to one another, peer to peer, instead of routing all traffic through a central hub the way a classic star-shaped (hub-and-spoke) VPN does. It is shorter, faster and more resilient. VIGIL-MESH is a mesh VPN that goes further: it restores the encrypted IP broadcast and multicast that L3 mesh VPNs on the market are missing, relies on a blind relay and a private vigie you can host, encrypts with QUIC/TLS 1.3 using a post-quantum key exchange, and layers an integrated application platform on top of the network.
From the classic VPN to the mesh VPN
A classic enterprise VPN works in a star: each workstation opens a tunnel to a central gateway (a VPN concentrator), and all traffic climbs up through that single point before coming back down to its destination. The model is simple to administer, but it concentrates the load, lengthens paths and makes the concentrator a mandatory transit point — and a single point of failure.
A mesh VPN turns this around: each machine establishes a direct, encrypted connection with the other members of the network, without going back through a concentrator. Traffic takes the shortest path, latency drops, and there is no longer a central bottleneck to size. This is the principle shared by all modern mesh VPNs, VIGIL-MESH included.
| Classic VPN (star-shaped) | Mesh VPN | |
|---|---|---|
| Topology | Tunnels to a central concentrator | Direct peer-to-peer connections |
| Traffic path | Climbs up then back down through the hub | Shortest, machine to machine |
| Point of failure | The central concentrator | No mandatory transit point |
| Latency | Weighed down by the central detour | Reduced by the direct path |
| Scaling | Limited by the hub | Spread across the peers |
What VIGIL-MESH adds to a mesh VPN
Mesh VPNs on the market most often stop at unicast IP routing: two machines talk to each other, and that is it. VIGIL-MESH starts from this common base and adds a layer of functions that, together, make it a VPN alternative rather than just one more VPN.
Near-L2 broadcast and encrypted multicast
VIGIL-MESH remains an L3 overlay, but it treats each network as a broadcast domain: broadcast, multicast and link-local IP reach every member as if on a switch, and this broadcast is encrypted end to end. This is the function that most L3 mesh VPNs are missing.
Blind relay and private vigie
When the direct path is not yet established, traffic goes through a relay (the vigie) that is structurally blind: it does not hold the keys and never sees the content. You can host your own private vigie, dedicated to your workspace.
Post-quantum encryption
Sessions are end-to-end QUIC/TLS 1.3 connections, with a hybrid X25519 + ML-KEM768 key establishment. The exchange resists — starting today — a future decryption by a quantum computer.
Zero inbound ports on the node side
No node opens an inbound port: connections are always established outward. Nothing to expose, nothing to forward on the site firewall, less attack surface.
Integrated application platform
Beyond the network, VIGIL-MESH integrates publications, sites, mail, no-code databases, MCP connectors and a no-code studio. The mesh is no longer just a pipe: it is the foundation on which you publish and run services.
Console, ACL and audit
A single console manages devices, access policies and real-time topology, with an audit log — the operation of an enterprise mesh VPN, without multiplying tools.
Mesh VPN and device discovery
On a local network, devices find each other on their own: the printer announces itself, the TV shows up, the networked game is discovered. This discovery relies on IP broadcast and multicast — precisely what purely L3 mesh VPNs drop. Because it replicates encrypted IP multicast, VIGIL-MESH restores these use cases across the network:
- mDNS/Bonjour — printers, Chromecast, AirPlay and file shares discovered from one site to another.
- SSDP/UPnP and WS-Discovery — TVs, media boxes, cameras and ONVIF devices.
- Local network (LAN) games — game and lobby discovery works as if on a single segment.
- Business multicast — announcements from controllers, sensors and proprietary services over UDP multicast.
Enterprise mesh VPN: security and operation
An enterprise mesh VPN is not judged on connectivity alone, but on how it is governed day to day. VIGIL-MESH centralizes administration without centralizing traffic: the control plane decides, while the data always goes directly, peer to peer.
- Single console: device inventory, real-time topology and link status in one place.
- Access policies (ACL): who can reach whom, network by network, service by service.
- Audit log: memberships, revocations and policy changes are traced.
- Strong authentication (MFA) and immediate revocation of a member, who then instantly loses access to broadcasts as well as to direct flows.
A mesh VPN you can partly host yourself
One of VIGIL-MESH's strengths lies in the private vigie. Where many mesh VPNs route relayed traffic through a shared infrastructure you do not control, you can deploy your own vigie: a relay dedicated to your workspace, self-configured against the controller, and structurally blind to your data.
- 1Deploy the vigieInstall the vigie on your own server or VM. It does not hold the keys to your sessions.
- 2It self-configuresThe vigie registers with the controller and attaches to your workspace, without manual network configuration.
- 3Your relay, your trafficRelayed traffic from your workspace goes through your vigie; the direct peer-to-peer path takes over as soon as it is available.