Rover software
Software
Hardware decides where packets land. Software decides who is allowed to send them. Every Rover node runs the same policy plane and reports to the same control plane, whether it is a router on a wall, a switch in a closet, or a gateway in a rolling case on the back of a truck.
Five layers
One network across carriers you do not control
Nodes join an encrypted overlay that spans sites, carriers, and clouds, over WireGuard or ZeroTier. A branch office, a teleworker, and a field kit share one addressable network even when the path underneath each of them is a different provider on a different continent.
Verify, then segment
Users and devices authenticate against your directory, RADIUS, or an API before the network answers. After access, VLAN and DNN segmentation keep a compromised endpoint inside its own blast radius instead of the whole site.
Every node is a measurement point
Client health, RF conditions, path quality, and uplink state stream back continuously. Scheduled and on-demand throughput tests run from the node against targets you choose, which measures the circuit as delivered rather than as a laptop on a crowded channel sees it.
eBPF policy that survives the WAN
Filtering runs in the kernel through eBPF, classifying and dropping on the data path rather than hauling packets through a userspace proxy. DNS and content policy apply per SSID and per group, and enforcement stays local when the uplink drops, so a site that loses its circuit does not also lose its controls.
Zero Touch Provisioning
Nodes pull their configuration on first boot from private or hybrid cloud. Keys, policy, and segmentation arrive with it, so the person unboxing the kit does not need to be the person who understands the network.
Protocol
Why WireGuard carries the overlay
The case for WireGuard is not speed. It is how little of it there is to get wrong.
What it is
- Codebase
- Roughly 4,000 lines, against hundreds of thousands in OpenVPN and IPsec stacks
- Cryptography
- Noise protocol framework, fixed cipher suite
- Negotiation
- None. There is no suite to downgrade an endpoint into
- Handshake
- 1-RTT, with forward secrecy
- Kernel
- Merged into mainline Linux in 5.6, March 2020
- Author
- Jason A. Donenfeld
- Platforms
- Linux · macOS · Windows · Android · iOS
Also supported
- ZeroTier
- Peer-to-peer overlay, for estates already running it or where direct reachability beats a fixed hub
- IPsec
- Where a peer, a policy, or an existing estate requires it
- L2TP
- Legacy interoperability
- OpenVPN
- Legacy interoperability
- Stealth
- Where the transport itself has to be unremarkable to a middlebox
Control plane
Deployment
- Hosting
- Private or hybrid cloud, customer-controlled
- Provisioning
- Zero Touch Provisioning on first boot
- AAA
- Directory · RADIUS · API
- Multi-tenant
- VRF separation per tenant or per program
Telemetry
- Interface
- O-RAN O1 with VES event streaming
- Scope
- Routers, switches, and gateways report to one plane
- Tests
- Scheduled and on-demand throughput and latency
- Operations
- 24 × 7 × 365 NOC, SOC 2 portal