Rover software
Software
Hardware decides where packets land. Software decides who is allowed to send them. Every Rover node runs the same policy plane and reports to the same control plane, whether it is a router on a wall, a switch in a closet, or a gateway in a rolling case on the back of a truck.
Five layers
One network across carriers you do not control
Nodes join an encrypted overlay that spans sites, carriers, and clouds, over whichever transport the path allows. A branch office, a teleworker, and a field kit share one addressable network even when the path underneath each of them is a different provider on a different continent, and a node that cannot run one protocol comes up on another.
Verify, then segment
Users and devices authenticate against your directory, RADIUS, or an API before the network answers. After access, VLAN and DNN segmentation keep a compromised endpoint inside its own blast radius instead of the whole site.
Every node is a measurement point
Client health, RF conditions, path quality, and uplink state stream back continuously. Scheduled and on-demand throughput tests run from the node against targets you choose, which measures the circuit as delivered rather than as a laptop on a crowded channel sees it.
eBPF policy that survives the WAN
Filtering runs in the kernel through eBPF, classifying and dropping on the data path rather than hauling packets through a userspace proxy. DNS and content policy apply per SSID and per group, and enforcement stays local when the uplink drops, so a site that loses its circuit does not also lose its controls.
Zero Touch Provisioning
Nodes pull their configuration on first boot from private or hybrid cloud. Keys, policy, and segmentation arrive with it, so the person unboxing the kit does not need to be the person who understands the network.
Transport
No single tunnel survives every network
A tunnel that cannot establish has no security properties at all. Networks block UDP, middleboxes fingerprint handshakes, a peer's policy mandates one protocol, a carrier breaks another. Rover carries several transports and brings up the one the local network actually permits, so the overlay re-forms instead of waiting for a path that is never coming.
Different failure modes
Carrying one protocol means inheriting its blind spots. Several protocols fail in different places, and a site that loses one keeps the others.
Chosen against the threat
A small audited codebase, a validated implementation, and an unremarkable wire profile are three different requirements. Which matters depends on who is watching and what they are permitted to do about it.
Measured as connected
Availability is whether traffic moved, not whether the preferred protocol was available. The node tries what works where it is standing.
What runs the overlay
Five transports, one policy plane
Policy, identity, segmentation and telemetry do not change with the protocol underneath. The transport is a question of what the path allows and what the programme requires.
Default
- WireGuard
- The default where nothing argues against it. Small enough to read, no suite to negotiate down, and in the Linux kernel rather than beside it
- Tailscale
- The same WireGuard data plane with a coordination plane on top, so keys and access rules follow identity from your directory rather than a config file
When the path or the programme requires it
- IPsec
- Where a policy names it, where third-party gear terminates the other end, or where a programme needs an implementation with a validation record behind it
- ZeroTier
- Peer-to-peer, for estates already running it or where a direct path between two nodes beats hauling traffic through a fixed hub
- sing-box
- Where VPN protocols are blocked or fingerprinted outright. Carries the tunnel inside transports that present as ordinary traffic, with a wide protocol set to draw on
Also available for interoperability with what is already in place: L2TP and OpenVPN. They are supported because estates exist, not because they are recommended.
The default, in detail
WireGuard is the default because of how little there is to get wrong
The case is not speed. It is surface area. That argument holds where the network lets it run, which is why it is a default rather than the whole answer.
What it is
- Codebase
- Roughly 4,000 lines, against hundreds of thousands in OpenVPN and IPsec stacks
- Cryptography
- Noise protocol framework, fixed cipher suite
- Negotiation
- None. There is no suite to downgrade an endpoint into
- Handshake
- 1-RTT, with forward secrecy
- Kernel
- Merged into mainline Linux in 5.6, March 2020
- Author
- Jason A. Donenfeld
- Platforms
- Linux · macOS · Windows · Android · iOS
Where it stops
- UDP only
- A network that drops UDP drops WireGuard with it, whatever the cryptography is worth
- Recognisable
- The handshake has a distinctive shape. Somewhere that is a problem, and somewhere it is the reason the session never comes up
- No key distribution
- It assumes you already know which public key belongs to which peer and has no opinion about how that key arrived
- No identity
- A key is not a person. Who holds it, and whether they still should, is a question asked somewhere else
Control plane
Deployment
- Hosting
- Private or hybrid cloud, customer-controlled
- Provisioning
- Zero Touch Provisioning on first boot
- AAA
- Directory · RADIUS · API
- Multi-tenant
- VRF separation per tenant or per program
Telemetry
- Interface
- O-RAN O1 with VES event streaming
- Scope
- Routers, switches, and gateways report to one plane
- Tests
- Scheduled and on-demand throughput and latency
- Operations
- 24 × 7 × 365 NOC, SOC 2 portal