Identity, transport, and enforcement live in different components, run in different places, and fail independently. This page walks through what each plane does — and what it deliberately cannot do.
NSD authenticates identities, distributes signed configuration, and reconciles policy. It never touches production traffic and never holds a node's private keys — a control-plane compromise cannot decrypt or reroute your data.
Every client tunnel terminates at an NSGW first. Policy is evaluated at ingress — before traffic ever reaches a site — and unauthorized flows are dropped at the gateway, not inside your network.
NSN runs next to your workloads and enforces ACLs on egress — the last and authoritative decision point. Even if control-plane policy lags or is contested, the site node decides what reaches your services.
NSC authenticates the user against NSD via your IdP. Device identity is bound to the session.
NSD pushes signed, scoped configuration: which gateways, which routes, which names resolve.
NSC opens a WireGuard tunnel to the nearest NSGW. mTLS 1.3 secures the control channel.
NSGW evaluates the flow against current policy. Unauthorized flows never leave the gateway.
NSN applies its own ACL on egress, proxies to the workload, and emits a per-flow audit record.
WireGuard private keys are generated on-device and on-node, and never transmitted — not to NSD, not to our cloud. Compromising the control plane yields configuration metadata, not the ability to decrypt traffic.
Data-plane tunnels use WireGuard (Noise protocol, modern AEAD). The control channel between every component is mutually authenticated TLS 1.3 with short-lived certificates.
When direct connectivity fails, managed PoPs relay encrypted packets without terminating them. Termination at a PoP is opt-in, per-tunnel, and visibly flagged in the audit stream.
Every authorized flow produces a structured record: identity, device, source, destination, matched policy, bytes transferred. Export to your SIEM via Prometheus-shaped telemetry or webhooks.
NSD 负责身份认证、分发签名配置并协调策略。它从不接触生产流量,也从不持有节点的私钥——控制面被攻破也无法解密或改道你的数据。
每一条客户端隧道都先在 NSGW 终结。策略在入口处评估——早在流量抵达任何站点之前——未授权的流量在网关处被丢弃,而不是进入你的网络内部。
NSN 运行在你的工作负载旁,在出口处执行 ACL——最后且最终的决策点。即便控制面策略滞后或存在争议,站点节点仍决定什么能抵达你的服务。
NSC 通过你的 IdP 向 NSD 认证用户。设备身份与会话绑定。
NSD 下发签名的、按范围限定的配置:使用哪些网关、哪些路由、哪些名称可解析。
NSC 向最近的 NSGW 打开一条 WireGuard 隧道。mTLS 1.3 保护控制通道。
NSGW 依据当前策略评估该流量。未授权的流量永远走不出网关。
NSN 在出口处施加自己的 ACL,代理至工作负载,并生成逐流审计记录。
WireGuard 私钥在设备本地、节点本地生成,从不传输——不发给 NSD,也不发给我们的云。攻破控制面只能得到配置元数据,而非解密流量的能力。
数据面隧道使用 WireGuard(Noise 协议,现代 AEAD)。各组件之间的控制通道采用双向认证的 TLS 1.3,并使用短生命周期证书。
当直连失败时,托管 PoP 在不终结加密数据包的前提下进行中转。在 PoP 处终结为可选项,按隧道启用,并在审计流中显式标记。
每一条已授权的流量都会产生一条结构化记录:身份、设备、来源、目标、命中的策略、传输字节数。可通过 Prometheus 形态的遥测或 webhook 导出到你的 SIEM。