Answers to the questions teams ask most often about CloudVpn, followed by the known limitations of release 1.0.0. For a guided deployment see the Quick Start; for every option see the User Guide.
General
What is CloudVpn?
One of the four relay modes of Cloud Spectra Gateway. A relay in your own Oracle Cloud (OCI) tenancy terminates a WireGuard tunnel from each of your devices, gives each device its own private tunnel address, and translates the devices' traffic to the relay's own address. Devices connected with a full tunnel all reach the internet from the relay's single public IPv4, and nothing on the internet can reach them through it. See the Overview.
Is CloudVpn a separate product?
No. It is a mode of the relay that is part of Cloud Spectra Gateway, under the same licence and the same per-vCPU billing as the other modes. Each relay runs one mode.
How is it different from CloudAddress?
CloudAddress transfers the relay's address to one device: the device wears it, nothing is translated, and inbound connections to the address reach that device. CloudVpn shares the address among many devices: each keeps its own tunnel address, the relay translates their traffic, and inbound connections stop at the relay.
How is it different from CloudVpc and CloudConnector?
CloudVpc makes one device a member of the relay's VPC, wearing a private VPC address. CloudConnector is an L3 pipe between networks in different clouds with source addresses preserved. Neither shares an address between devices; CloudVpn is the only mode that translates.
Who is CloudVpn for?
Teams that need one address to allow-list -- for SaaS admin consoles, partner firewalls, databases or bastions -- from wherever people work, without exposing their machines to inbound traffic, and without per-seat pricing.
Deployment
Which clouds can run a CloudVpn relay?
In 1.0.0, Oracle Cloud Infrastructure (OCI). Relays on AWS are not available to customers in this release: the client launches an AWS relay only from a relay image already in your own AWS account, and no relay image is provided to customer accounts. Azure, Google Cloud and DigitalOcean are not supported for CloudVpn.
How do I deploy it?
Run cloudspectra_relay_client create --provider oci --mode cloud_vpn with your OCI credentials in ~/.oci/config and your licence key saved in ~/.cloudspectra/credentials. You can also switch an existing relay to CloudVpn on its dashboard. The Quick Start walks through both the relay and the devices.
Can I deploy CloudVpn with Terraform or CloudFormation?
Not in 1.0.0. There is no Terraform module, Terraform example or CloudFormation template for a CloudVpn relay; use the client.
Where do I get the client, and does it cost anything?
The client is free to download from https://downloads.cloudspectra.ai/gateway/1.0.0/clients/ for Linux, macOS and Windows; no licence or sign-in is needed to download it, and there is no charge per device. A relay's dashboard also offers the client for download on its Generate Token page. See Install the client.
Do the people who connect need cloud credentials?
No. A device needs only the client, an enrolment token from the dashboard and the relay's public address (connect --relay). Cloud credentials are needed only on the machine that creates, pauses or destroys the relay.
Which devices can connect?
Linux (Debian and Ubuntu packages, or the standalone binary elsewhere), macOS 13 or later, and Windows, on x86-64 and Arm64, through the Cloud Spectra client; iPhones and Android phones through the official WireGuard app, enrolled with a QR code.
Networking
What address do websites and services see?
For a device connected with a full tunnel, the relay's public IPv4. Every such device on the relay appears as that one address.
Will the shared address stay the same?
Yes, unless you choose otherwise. On OCI the relay is given a reserved public IPv4 by default. It is kept when the relay is paused and resumed, and when the relay is destroyed it is kept for the relay's slot (its project, region and --instance-index), so a relay created again in that slot comes back on the same address. It is released only by destroy --delete-address or --delete-all. A relay created with --ephemeral-ip uses an address that does not survive.
Does all of my traffic go through the relay?
Only if the device enrolled with a full tunnel (connect --full-tunnel, or Full tunnel for a phone). By default a device uses a split tunnel, which carries only the private ranges the relay hands it, and its internet traffic keeps using its own connection.
Does CloudVpn support IPv6?
No. CloudVpn carries IPv4 only. With a full tunnel the device's IPv6 traffic is left on its own connection, so a service the device reaches over IPv6 sees the device's own IPv6 address rather than the relay. Reach allow-listed services over IPv4.
Which protocols work?
TCP and UDP. ICMP, so ping, and other IP protocols are not translated. Fragmented IPv4 datagrams are not translated either; TCP is unaffected, but UDP messages larger than the tunnel can carry in one packet are lost.
Can people on the internet reach my devices?
No. Only replies to connections a device opened come back through the relay. A CloudVpn relay has no port forwarding and refuses inbound port ranges.
Can two devices on the same relay reach each other?
No. CloudVpn is not a network between devices: the relay forwards device traffic outward and returns the replies, and does not forward traffic from one device to another.
Can the relay connect my other VPCs?
Not in 1.0.0. The relay's VPC peering, on the dashboard page labelled Cloud VPN, works only on relays running on AWS, and AWS relays are not available to customers in this release. See VPC peering.
Why does my SSH session freeze after a few idle minutes?
A TCP flow that carries no packets for 120 seconds loses its translation on the relay (60 seconds for UDP), and replies to it then stop arriving. Turn on keepalives shorter than that, for example ServerAliveInterval 60 in your SSH configuration.
How many devices can one relay carry?
The device pool holds 65,533 addresses, and there is no licence limit on devices. In practice, throughput is set by the relay's instance size: give a busy relay more vCPUs with --cpu or --instance-type.
Security
Does Cloud Spectra see my traffic?
No. The relay runs in your cloud account, and device traffic flows only between your devices, your relay and the destinations they use. The relay contacts Cloud Spectra's services to validate its licence, download its datapath and report vCPU-hours for billing.
Where are the device keys?
On the devices. The client generates each device's WireGuard key pair locally and sends only the public key. A phone enrolled by QR code is the exception: the relay generates its key, shows it once in the QR code, and keeps only the public half.
Can a device impersonate another device?
No. Each device's WireGuard peer on the relay accepts exactly that device's own /32 address.
Can I restrict where devices go?
Yes. The dashboard's Policy page holds up to 256 allow and deny rules by destination network, protocol and port, plus a default action. The most specific rule wins. The policy applies to every device on the relay and takes effect when the relay restarts. See Restricting destinations.
Is there single sign-on or per-user access control?
Not in 1.0.0. Devices enrol with dashboard tokens, and the destination policy applies to all devices alike. The dashboard itself supports several operators with viewer, admin or owner roles.
What does the relay expose to the internet?
By default its cloud firewall admits TCP 22, TCP 28300 (dashboard and enrolment), TCP 28301 (recovery SSH) and UDP 28302-28349 (WireGuard). You can drop TCP 22 and restrict source ranges when you create the relay. See the security model.
Billing
How is CloudVpn billed?
Per vCPU of the relay instance, metered hourly: $10 per vCPU per month on the Developer lane and $30 per vCPU per month on the Enterprise lane. The second vCPU of every instance is free, and only the first 64 vCPUs count, so an instance bills at most 63 vCPUs. The Developer lane allows up to 16 vCPUs running per account; the Enterprise lane has a 4-vCPU minimum per instance. A month that comes to less than $1 is not invoiced. See Pricing.
Is there a charge per device or per user?
No. The client is free and devices are not counted for billing.
What else will I pay for?
Your cloud provider bills the relay's instance, its public IPv4 address and its data transfer to your cloud account, at its own rates. OCI does not charge for a reserved public IP, including one kept after the relay is destroyed.
Does a paused relay cost anything?
The Cloud Spectra charge stops while a relay is paused. Your cloud provider may still charge for its disk and reserved address; pause tells you what when it runs.
Operations
What happens if the relay restarts?
Enrolled devices, settings and the mode are kept. Connections in progress are interrupted; devices carry on once the relay is back. Changing the mode, the destination policy or flow visibility takes effect only at a restart, and the relay never restarts on its own.
Is there failover between relays?
Not in 1.0.0. Each CloudVpn relay is a single instance; if it is down, its devices are offline. Devices can be enrolled with more than one relay, each under its own project and name, and connect to whichever you choose.
How do I upgrade a relay?
Install the newer client, destroy the relay and create it again with the same project, name, region and instance index. It returns on the same public address, but it has a new key and an empty device list, so every device enrols again. See Upgrades.
How do I remove a device?
Retire it on the dashboard's Access page, which detaches it immediately and returns its address to the pool, or run disconnect --vacate on the device itself.
How do I switch a device between split and full tunnel?
With the client, enrol it again: mint a new token and run connect with or without --full-tunnel. A phone's tunnel can be edited in the WireGuard app.
Why can I generate only one token at a time?
The dashboard keeps one unused enrolment token; generating another cancels it. Mint each device's token just before you use it, or tick Reusable until it expires for automation that enrols several devices, keeping its lifetime short.
Known limitations
These are the limits of CloudVpn in release 1.0.0.
| Area | Limitation |
|---|---|
| Clouds | CloudVpn relays can be created on OCI only. AWS relays are not available to customers in 1.0.0: the client launches an AWS relay only from a relay image already in the customer's own AWS account, and no relay image is provided to customer accounts. Azure, Google Cloud and DigitalOcean are not supported for CloudVpn. |
| Deployment | The client (create --mode cloud_vpn) and the dashboard's mode switch are the only ways to deploy CloudVpn. There is no Terraform module or example and no CloudFormation template for it. |
| Mode flag | The default mode of create is cloud_address. A CloudVpn relay must be created with --mode cloud_vpn; confirm with describe or on the dashboard's Access page. |
| Availability | Each CloudVpn relay is a single instance. There is no multi-relay CloudVpn group, load balancing or automatic failover. |
| Address family | IPv4 only. A device's IPv6 traffic does not use the relay, even with a full tunnel. A relay created with --addr ipv6 wears no public IPv4 and cannot carry full-tunnel devices. |
| Protocols | TCP and UDP only. ICMP and other IP protocols are dropped, and fragmented IPv4 datagrams are not translated. |
| Idle flows | A TCP flow idle for 120 seconds, or a UDP flow idle for 60 seconds, loses its translation; long-lived idle sessions need keepalives. |
| Inbound | No inbound connections to devices and no port forwarding. Port ranges under Inbound to your phone must be empty on a CloudVpn relay. |
| Between devices | Devices on a relay cannot reach one another through it. |
| Source identity | Every device appears as the relay. Destinations cannot tell devices apart by address; use CloudAddress or CloudVpc where they must. |
| Identity and access | No single sign-on, identity-provider enrolment or per-user groups. The destination policy applies to all devices on a relay. |
| Device pool | Devices are numbered from 10.99.0.0/16 and create has no option to change it. Avoid CloudVpn on devices whose local networks use that range. |
| Applying changes | Mode, destination policy and flow visibility changes apply when the relay restarts. After a mode change every device must enrol again. |
| Route choice | With the client, a device's split or full tunnel is fixed at enrolment; changing it needs a new token. |
| Enrolment tokens | One unused token exists at a time; minting another cancels it. |
| Phones | Phones use the stock WireGuard app. Their QR code contains the private key and is shown once. |
| VPC peering | Not available in 1.0.0. The relay's VPC peering (the dashboard page labelled Cloud VPN) works only on AWS relays, which are not available to customers. |
| Instance metadata | The relay does not block devices from the cloud's instance metadata address. Do not give the relay's instance cloud permissions you would not give every enrolled device. |
| Upgrades | Moving a relay to a newer release means re-creating it; every device then enrols again. |
| Backups | The dashboard's configuration backup does not include enrolled devices or the destination policy. |
Support
Email support@cloudspectra.ai. Include the relay's provider, region, project and name, the output of cloudspectra_relay_client version on the affected device, and the relay dashboard's Build info.