Zero-Trust Mesh Networking
EmberNet secures every connection between edge nodes, cloud services, and users with a zero-trust mesh. There is no site-to-site VPN to build, no port to forward, and no static firewall rule to maintain.
The principles
Never trust, always verify. Every connection request is authenticated and authorized regardless of where it came from. There is no trusted network, and being inside the perimeter grants nothing.
Least privilege. Services and users get the minimum access they need. Policy is defined per service, per user, and per tenant, and the default is deny.
Assume breach. The architecture takes for granted that something will eventually be compromised. Identity is checked on every connection rather than only at the edge, so a foothold on one host does not become lateral movement across a flat network.
How the mesh works
Each node and service is issued a cryptographic identity when it enrolls. From there:
Nodes establish outbound connections to the fabric. Nothing dials in, so there is no inbound port to open and no public IP on your equipment.
Connections are mutually authenticated with TLS, using certificates the platform issues and rotates on its own.
Routing follows identity, not IP address or network location. This is the property that eliminates lateral movement: there is no address space to scan, because reachability is not a function of addressing.
Policy then decides which identities may talk to which services.
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Edge Node A │ │ Edge Node B │ │ Edge Node C │
│ ┌────────┐ │ │ ┌────────┐ │ │ ┌────────┐ │
│ │ Mesh │──┼─────┼──│ Mesh │──┼─────┼──│ Mesh │ │
│ │ Agent │ │ │ │ Agent │ │ │ │ Agent │ │
│ └────────┘ │ │ └────────┘ │ │ └────────┘ │
└──────────────┘ └──────────────┘ └──────────────┘
│ │ │
└────────────────────┼────────────────────┘
│
┌────────────────┐
│ Mesh Control │
│ Plane │
└────────────────┘
The implementation is Flux, and it is managed from the Flux Console in the dashboard.
What this buys you
| Property | What it means in practice |
|---|---|
| No inbound ports | No firewall exceptions, no port forwarding, no exposed equipment |
| No VPN | No site-to-site tunnels to build, document, or maintain |
| Automatic certificates | Issued on enrollment, rotated before expiry, revocable instantly |
| NAT traversal | Works through carrier-grade NAT with no configuration |
| Network agnostic | Runs over cellular, satellite, WiFi, or ethernet |
| Everything over 443 | Passes through restrictive client networks without special handling |
Access policies
A policy grants a source identity access to a target service. Everything not granted is denied.
Allow:
Source: @engineering-team
Target: @edge-dashboard
Protocol: HTTPS
Ports: 443
Four kinds are in play:
| Type | Controls |
|---|---|
| Service to service | Which platform services can reach each other |
| User to service | Which users can reach which services |
| Tenant to tenant | Cross-tenant traffic, denied by default |
| External access | Access originating outside the mesh |
Managing identities, services, routers, and policies is covered in Flux.
Certificates
Certificates are issued when a node enrolls, rotated before they expire, and revocable immediately if a host is compromised. Validity periods are deliberately short, which limits how useful a stolen certificate is.
Short-lived certificates make clock accuracy load-bearing. A node with significant skew fails validation, and the symptom looks like a network problem rather than a time problem.
Monitoring and troubleshooting
The dashboard shows node connectivity and latency, certificate validity and rotation schedule, policy evaluation logs, and connection attempt history.
| Symptom | Likely cause | What to do |
|---|---|---|
| Node won't join the mesh | Outbound 443 blocked | Verify outbound HTTPS from the node itself |
| High latency | Congestion or routing | Check the network path and available bandwidth |
| Certificate errors | Clock skew | Fix NTP on the node |
| Access denied | No policy grants it | Review policy; remember the default is deny |
Access denied is the one that trips people up, because it looks like a failure and is usually the system working correctly. Check for a missing grant before suspecting anything else.
Next steps
- Flux: the mesh implementation and its console
- ArcNet: the layer-3 IP tunnel ranked beneath it
- Connectivity: connecting industrial devices
- Architecture: how this fits the wider platform