How your devices find each other

Most devices sit behind a router that lets traffic out but not in. That's good for security, and it's why a classic VPN needs a server with an open port that everyone connects through. We wanted devices to talk straight to each other instead, with nothing open to the internet.

The coordinator only introduces

Each device keeps a connection to our coordination service. It hands out keys and addresses, and tells each device where its peers might be reached. It never carries your traffic.

Finding a public address

A device can't see its own public address from inside its network, so it asks: it sends a small STUN request from its WireGuard port and learns the address and port the outside world saw. That, plus its local addresses, is what it tells its peers.

Punching through

Two devices then send each other small encrypted pings at the same moment. Each router sees an outgoing packet first, so it lets the matching reply in, and the path opens. The timing matters: one side asks the other, through the relay, to start sending, then waits half a relay round trip before sending its own, so both sides' first packets cross in flight.

Once a ping gets an answer, the devices switch to the direct path. If it goes quiet, they send on both paths until one answers, so nothing drops in between.

When there's no direct path

Some networks block it outright. Then traffic goes through an encrypted relay. It only ever sees WireGuard ciphertext, only forwards between devices of the same workspace, and lets a device in with a signed ticket that lasts 10 minutes, so a removed device loses access within 10 minutes.

When the network changes

Open the laptop on a new network and it notices: it asks for its public address again, reconnects to the relay, and tries the direct path anew. The tunnel itself never restarts, which is why a call or an SSH session survives the switch.