Skip to main content

Flux: Zero-Trust Mesh

Flux is EmberNet's zero-trust networking fabric. It connects your edge sites, devices, and cloud into one secure overlay where nothing is reachable unless it is explicitly authorized, and where you never open an inbound port or expose a device to the public internet.

Flux is what makes the rest of the platform work across sites: it's how a dashboard in the cloud reaches a gateway on a plant floor, how a remote app's interface opens without a VPN, and how a site keeps talking to the center through firewalls and carrier-grade NAT.

Flux is the primary transport, not a fallback. Every endpoint keeps it up unconditionally and it is the path the platform expects to be carrying traffic. ArcNet is the Layer 3 IP tunnel ranked beneath it — faster in principle, but it needs UDP that industrial networks routinely filter, and at most sites it is carried over Flux rather than running beside it. A site reporting ArcNet as its active path has lost Flux and is degraded.

How it works​

  • Identity, not IP. Every node, service, and user on the mesh has a cryptographic identity. Access is granted between identities, not between addresses, so there is no flat network to scan or lateral movement to exploit.
  • Outbound-only. Edge sites dial out to the mesh; nothing dials in. There are no inbound firewall rules, no port forwards, and no public IPs on your equipment.
  • Everything over 443. Flux traffic rides standard HTTPS ports, so it passes through restrictive client networks and VPNs without special firewall changes.
  • Encrypted end to end. Traffic is encrypted between identities across the whole path, not just to a gateway.

What it gives you​

  • Multi-site reach: the dashboard and central services reach every site as if it were local, with no site-to-site VPN to build or maintain.
  • App interfaces from anywhere: an app deployed at a remote site opens directly in the dashboard, served back securely through the mesh. See the App Store.
  • Remote access: open a shell or a device console at a remote site without standing up jump hosts.
  • Resilience: sites reconnect automatically through outages and address changes; there's no static tunnel to break.

Managing the mesh: the Flux Console​

Platform staff manage Flux from the Flux Console in the dashboard (under the Zero Trust Network category). It's a live view of the overlay with full management of its building blocks:

ObjectWhat it is
IdentitiesThe cryptographic identities on the mesh: nodes, services, and users. Creating one issues an enrollment token the endpoint uses to join.
ServicesThe things that can be reached over the mesh, each with its own access rules.
Edge RoutersThe mesh's routers, which carry traffic between identities.
Service PoliciesWhich identities may dial (use) or bind (host) which services. Deny by default.
Edge-Router & Service-Edge-Router PoliciesWhich identities and services may use which routers.
Configs & Config TypesService configuration, such as how a service is addressed.
Posture ChecksRequirements an endpoint must satisfy before it's trusted (OS, process, MFA, and more).
Auth Policies, JWT Signers, Certificate AuthoritiesHow identities authenticate, including third-party and OIDC sign-in.

Each object can be created, edited, and removed directly from the console.

Tenant drill-down​

On All Clients, the console shows the whole mesh across every tenant. Select a client in the header and it drills down to just that tenant's identities, services, routers, and policies, and anything you create there is tagged to that tenant automatically. Tenant administrators and engineers see a read-only, tenant-scoped view of their own mesh.

Relationship to the App Store​

Flux is not something you deploy from the App Store. It is part of the platform itself. App Store apps ride on Flux: when you open a remote app's GUI, that session travels over the mesh.

Next steps​