Private mesh networking between your services
Connect all your servers and services on a private LAN that is never exposed publicly.
Instead of exposing every database and panel to the internet, put your services on a private network and keep the public door closed.
What a mesh gives you
Every server can reach every other over a private, encrypted link.
Services talk to each other on private addresses that are not reachable from the internet.
You can harden public ports aggressively: a database port is only open to the mesh.
How it works here
Your services join our WireGuard mesh on a private interface (typically 10.x address space). You get:
A private IP per service.
Direct connectivity to your other services and to managed databases and storage.
No configuration per pair — adding a service adds it to the network.
Why this matters for security
Our zero public exposure default means the safest place for a database, cache, or admin panel is on the private network, reachable only over the mesh. That removes an entire class of attack: there is nothing to scan, nothing to brute-force, nothing to exploit remotely.
Practical uses
App servers → managed database over the private address.
Workers → message queue, without public listeners.
Admin panel → your workstation over the VPN, with no public login page at all.
Backups → backup host over the mesh, not the internet.
Firewall rules for the mesh
If you firewall aggressively, remember to allow the mesh interface and the mesh subnet, and never block established traffic to it. Breaking the mesh severs monitoring, backups and management. See Firewall basics.
Connecting your own devices
Your laptop or phone can join the mesh via the VPN — see Setting up your VPN — so you reach private services the same way the servers do.
Related reading