EmberNet Endpoint
EmberNet Endpoint is the software that joins a machine to the EmberNet platform as a first-class endpoint. Install it on a host, whether a Windows workstation, a Linux facility gateway, an edge compute node, or a Raspberry Pi, and that machine becomes securely addressable from anywhere on the EmberNet fabric, without your operations team having to publish a route.
It runs on Windows and Linux, built from the same design and the same auth model on each platform.
What it does
EmberNet Endpoint connects the host to the EmberNet fabric over three transports:
| Transport | Role |
|---|---|
| Flux | The primary path. The always-available zero-trust overlay. Rides outbound TCP/443, so it works on restrictive networks that filter other traffic. Never torn down. |
| ArcNet | The kernel-level encrypted IP tunnel. Fast, but it needs UDP the network has to permit, so it is ranked below Flux — and at most sites it is carried over Flux rather than running beside it. |
| Bellows | An operator-toggled parallel tunnel for legacy point-to-point deployments. |
Flux and ArcNet are the failover pair, and the polarity matters: Flux is the one that should be carrying traffic. Flux is always up, so failover isn't a matter of starting something — if Flux stops connecting, traffic is already on ArcNet and the dashboard is told within seconds. An endpoint sitting on ArcNet is the state worth investigating.
Bellows sits outside that. It's a parallel tunnel toggled per endpoint from the dashboard, and it deliberately never affects which path the endpoint reports as active.
Once connected, workloads running on the host can reach EmberNet-hosted services directly, and the host itself is reachable from the rest of your fabric, all under the zero-trust model enforced by the platform.
Where it sits in the stack
┌──────────────────────────┐
│ EmberNET Dashboard │ ← https://dashboard.embernet.ai
└────────────┬─────────────┘
│
┌─────────┴─────────┐
│ EmberNet fabric │
│ (Flux / ArcNet) │
└─────────┬─────────┘
┌──────────────────────┼──────────────────────┐
│ │ │
┌────────┴────────┐ ┌─────────┴────────┐ ┌─────────┴────────┐
│ Windows Endpoint│ │ Linux Endpoint │ │ Embedded probes │
└─────────────────┘ └──────────────────┘ └──────────────────┘
The endpoint is a client of the mesh, and on most deployments it is more than that. It joins the fabric and makes its host reachable, and where it is enabled it also runs an in-process edge router, so the device carries fabric traffic rather than only riding it. That is the shipping configuration on facility gateways; a client-only endpoint is the simpler case, not the default one.
Choose your platform
- Windows: a single signed installer, a tray app, and a local web UI. For engineer laptops, control-room HMIs, and factory-floor kiosks.
- Linux: a headless daemon with an operator CLI and a local web UI. For facility gateways, edge nodes, and any Linux host that needs to be on the fabric.
Key characteristics
- Zero-touch after enrollment. Enroll once with your Microsoft account via the device-code flow; the endpoint configures its tunnels and keeps them healthy on its own.
- Split-tunnel by default. The endpoint claims routes only for EmberNet-assigned subnets. Your normal network keeps working exactly as before.
- Local-only control surface. The management UI and API listen on loopback (
127.0.0.1) only, never exposed to the network. - Automatic failover. If the preferred fast path is blocked, traffic moves to the always-available Flux overlay and back automatically, with the active path reported to the dashboard.
- Managed from the dashboard. Enrolled endpoints appear in the EmberNet Dashboard, where you can see their status and manage them at fleet scale.