Skip to content

NETWORK OVERVIEW

Dashboard

Inventory and the latest server connectivity checks.

Registered servers—Servers in this installation

Verified connections—Checked within the last five minutes

Strict Filtering—Servers on restricted networks

Server status

Next step

Check connectivity before deployment

Review node health, registered trust and mesh readiness. An old result does not confirm current connectivity.

SERVER INVENTORY

Servers

Network role and connection status for each server.

Search by name or IPNetwork role

Server name	Address	Network role	Status	Actions

Install a node over SSH

Fresh Ubuntu 24.04 amd64 only. Existing installations are refused. The agent always uses TLS port 8000. Installed mesh tunnels keep running when the panel is offline.

Installation operation ID

Register a server

MESH OPERATIONS

Mesh management

Drafts, readiness checks and deployment history.

Run administrative operations in sequence. Failed requests are not retried automatically.

Create a mesh

Automatic selection uses AmneziaWG for all members if any member is Strict. For an Open-only network, either engine is available.

New mesh IDPrivate subnetMTU selectionManual MTUUnderlay PMTU

Automatic mode calculates MTU from the entered PMTU, IPv4/IPv6 overhead, S4 and maximum content padding. Network measurement is not yet automatic; an estimated PMTU is not a measured result.

UDP portConnection engine

Select members.

Shared AmneziaWG settings

Valid random settings are generated automatically for each new mesh, including padding, headers, timings, signature packets and the shared protection key. All members use the same saved settings. You can review or edit them below.

Parameter generationAdd random packet trailers

Generated parameters are fixed for the mesh and stored in the draft. Automatic MTU uses the final parameters on the server.

Custom parameters

Use the values below (automatically filled)

Advanced AWG 3+ settings

These settings apply to all mesh members. Blank fields use engine defaults. Zero also selects defaults for device timings, but PersistentKeepalive=0 disables keepalive.

Header protectionProtect message headers

When enabled, S1 through S4 must each be at least 12. The shared key is separate from the WireGuard key and is encrypted for each member.

HeaderProtectionKey

Content paddingContentPaddingAddition

Maximum padding is deducted from the MTU budget: MTU + IP/UDP/WG overhead + S4 + padding ≤ PMTU.

Timings [AWG 3+]

RekeyAfterTime · SecondsRekeyTimeout · SecondsRejectAfterTime · SecondsKeepaliveTimeout · SecondsMaxHandshakeAttempts · CountPersistentKeepalive · Seconds

Enter a number or ascending range, up to 65535. Ranges cannot mix zero with positive values. RejectAfterTime must exceed RekeyAfterTime and the sum of KeepaliveTimeout and RekeyTimeout.

Message headers · H1–H4

Shared numbers or ranges for initiation, response, cookie and data messages. Ranges must not overlap. Blank fields use the base parameters.

H1H2H3H4

Custom signature packets · I1–I5

Sent before the handshake in order from I1 to I5. Blank means no packet. Tags: <b 0x0102>, <r 16>, <rd 8>, <rc 8>, <t>. No real payload data; applies to all members. Each packet is limited to min(2048, PMTU−28) bytes.

I1I2I3I4I5

DisableCookies · Disable the cookie mechanism

Off by default. Enabling this changes the engine cookie protection behavior.

Mesh members

Select at least two trusted servers.

Deploy a verified draft

Read a fresh check or the existing deployment first. Advance sends or tracks one member at a time. Stopping does not remove existing interfaces.

Deployment ID

Mesh details

Enter an existing mesh ID to view its draft and status.

Technical result details