Skip to main content

Gateways and the mesh

Ciyora VPN is a mesh: devices and gateways connect directly to each other, rather than through one central concentrator.

Paths​

  • Direct. Two peers reach each other over UDP, traversing NAT where the networks allow it.
  • Relayed. When no direct path is possible, traffic goes through an encrypted relay. It stays end-to-end encrypted; the relay forwards packets it cannot read.

The topology page in the console draws each device's current path, and the device page shows its path and latency.

Site gateways​

A site gateway is a node in an office, data centre or cloud network that advertises that network's subnets into the mesh, so people can reach hosts that cannot run Ciyora Client.

  • It dials out: it registers with Ciyora Fabric over an outbound connection using an enrolment key and receives its peers from there. No inbound ports are opened.
  • The subnets it advertises are routes. New routes wait for approval; overlapping routes are flagged.
  • Gateways at the same site can back each other up.

Access controls​

Who can reach what is defined by an access policy of groups, hosts, tags and ports. The policy denies anything it does not allow. Each save creates a new version, so you can compare and roll back.

Enrolment keys​

Devices and gateways join with an enrolment key. Keys can expire, be single-use or reusable, be ephemeral (the device is removed when it goes offline) and carry tags. The console shows the full key only once.

DNS​

Split DNS sends lookups for internal domains through the tunnel to your resolvers. You can also add private DNS records, and DNS security can block known-malicious domains.