Networking
An encrypted mesh between your nodes, plus port forwarding, frp, SSH tunnels, the host firewall and reverse proxies — managed from the panel instead of scattered config files on each machine.
On this page: Mesh between sites · Ports and entry points · Several offices · Plans
Nodes join an encrypted underlay built on the Noise framework (Nodekeeper's own implementation). On top of it, BGP EVPN and VXLAN give your nodes one shared network, with relays for nodes behind NAT, IPv6 and DHCP. A VM keeps its address when it is restarted on another host.
A node joins with a one-time token and pulls its configuration from the main panel, so it needs only outbound access.
Direct paths where the network allows it, relays where it does not.
A mesh client lets people connect to the same network from their own devices.
| Tool | Use it for | Plan |
|---|---|---|
| System firewall | Inbound port rules on each host (nftables); the panel's own management ports are protected from deletion | Free |
| iptables / frp / SSH forwarding | Publishing a service on another host or behind NAT | Free |
| nginx and HAProxy reverse proxies | HTTP(S) and TCP entry for sites and applications, with health checks | Free |
| Self-hosted CDN edge | Caching, origin rules, rate limits and IP / GeoIP rules in front of your sites | Personal |
After a VM moves to another host, its address stays the same inside the mesh. Re-pointing CDN or port-forwarding entries on other nodes is not part of the tested recovery flow — check them after a failover.
Manage several offices from one panel over the NK mesh; each office boots its PCs from its own site. Office PCs do not boot across a wide-area link; storage traffic stays inside each site. Office PCs
| From plan | Networking |
|---|---|
| Free | Host firewall, iptables / frp / SSH forwarding, nginx and HAProxy reverse proxies |
| Personal | Mesh between nodes, self-hosted CDN edge, rate limits and IP / GeoIP rules |
| Pro | Mesh client for remote staff |
| Business | Multi-office management for office PCs, sync groups |
The trial is a monthly subscription whose first month is $0: card required, once per account; cancel before day 30 and you are not charged.