CloudVpn -- Overview v1.0.0

This tab documents CloudVpn, one of the four relay modes of Cloud Spectra Gateway. If you are new to the relay, read this page first, then follow the Quick Start. The User Guide is the full reference and the FAQ lists the known limitations of release 1.0.0.

What CloudVpn is

CloudVpn puts several devices behind one public IPv4 address that you own. You run one relay -- a small virtual machine -- in your own Oracle Cloud Infrastructure (OCI) tenancy. Each laptop, desktop or phone connects to it over its own encrypted WireGuard tunnel and is given its own address from the relay's device pool. When a device sends traffic through the relay, the relay translates it to the relay's own address, so the whole team reaches the internet from one address. Unsolicited traffic from the internet stops at the relay and is never forwarded to a device.

The relay dashboard describes the mode in one line: "Several devices share one public address. The only mode that NATs." The other three relay modes either hand a device an address of its own or forward traffic with the source left alone; CloudVpn is the only one that shares an address between devices.

The problem it solves

• One address to allow-list. SaaS admin consoles, partner and customer firewalls, database and bastion allow-lists often admit traffic only from known IP addresses. With CloudVpn the whole team appears as one address -- the relay's public IPv4 -- wherever each person is working from.
• An address that belongs to you. The relay runs in your own cloud account. On OCI it is given a reserved public IPv4 by default, and that address belongs to the relay's slot rather than to the machine: destroying the relay keeps the address, and the next relay created in the same slot comes back on it, so allow-lists keep working. You release it only when you ask to.
• Nothing exposed inbound. Devices cannot be reached from the internet through the relay. There is no port forwarding in this mode -- the relay refuses inbound port ranges while it runs CloudVpn.
• No per-seat pricing. The relay is billed per vCPU, not per device or per user. One relay carries up to 65,533 device addresses.

Choosing a relay mode

The relay has four modes. They are different products, not settings of one product, and each relay runs exactly one of them. The descriptions in the second column are the ones the relay dashboard shows when you choose a mode.

Pick CloudVpn when "which address does the far side see" should have one answer for everybody. If a destination must be able to tell individual devices apart by their source address, or must connect inbound to a device, CloudVpn is the wrong mode: every device arrives as the relay.

How it works

flowchart LR
    subgraph DEV["Your devices, anywhere"]
        direction TB
        L1["laptop
10.99.0.2"]
        L2["desktop
10.99.0.3"]
        P1["phone
10.99.0.4"]
    end
    subgraph ACCT["Your OCI tenancy"]
        R["CloudVpn relay
translates every flow
to its own address"]
    end
    L1 -->|"WireGuard tunnel"| R
    L2 -->|"WireGuard tunnel"| R
    P1 -->|"WireGuard tunnel"| R
    R -->|"every device leaves as
the relay's public IPv4"| NET["Internet"]
    NET -. "unsolicited inbound
stops at the relay" .-> R
    style ACCT fill:#eef2ff,stroke:#6366f1,color:#312e81
    style R fill:#d1fae5,stroke:#10b981,color:#065f46
    style NET fill:#fef3c7,stroke:#f59e0b,color:#92400e

Device addresses are illustrative. The pool is 10.99.0.0/16 and the first device is given 10.99.0.2.

1. You create the relay in your cloud account with the Cloud Spectra client: cloudspectra_relay_client create --mode cloud_vpn. The relay holds a public IPv4 address and listens on TCP 28300 (its HTTPS dashboard and enrolment API), TCP 28301 (recovery SSH) and UDP 28302 (WireGuard).
2. Each device enrols with a token. An operator mints a short-lived enrolment token on the relay dashboard. The device runs cloudspectra_relay_client connect with that token. The client generates the device's WireGuard key pair on the device and sends only the public key. The relay gives the device the next free address in 10.99.0.0/16 and adds it as a WireGuard peer that may send from exactly that one address. Phones enrol by scanning a QR code with the official WireGuard app.
3. The relay translates each flow. When a device sends a TCP or UDP packet through its tunnel, the relay's datapath allocates a source port on the relay's own address for that flow (from the range 20000-59999), rewrites the packet and sends it on. Replies are mapped back to the device that opened the flow.
4. Inbound stays closed. A packet that arrives at the relay without a matching flow is handled by the relay itself and is never forwarded to a device. Devices cannot reach one another through the relay either.

Split and full tunnel

Each device chooses how much of its traffic uses the tunnel when it enrols:

Full tunnel needs a relay that wears a public IPv4 address. A relay created to be reached over IPv6 only (--addr ipv6) has none and refuses full-tunnel enrolments, so do not use that option for CloudVpn.

Security

• Keys stay on the device. The client generates each device's WireGuard key pair locally and sends only the public half. The exception is a phone enrolled by QR code: the relay generates its key, shows it once in the QR code and keeps only the public half.
• Enrolment tokens are short-lived. A token is single-use by default and valid for 2 minutes unless you choose otherwise. Only one unused token exists at a time.
• No spoofing between devices. Each device's WireGuard peer accepts exactly its own /32 address, so one device cannot send as another.
• Closed to inbound. Nothing on the internet can open a connection to a device through the relay, and devices cannot reach each other through it.
• Destination policy. You can restrict where devices may go with allow and deny rules on the dashboard's Policy page. See Restricting destinations.
• Your account, your traffic. The relay runs in your cloud account and device traffic flows only between your devices, your relay and the destinations they use. The relay contacts Cloud Spectra's services to validate its licence, download its datapath and report vCPU-hours for billing.
• Operator access. The dashboard is served over HTTPS on TCP 28300 and protected by a password the relay stores only as a hash. You can add operators with viewer, admin or owner roles, and every sign-in and configuration change is logged.

The full model, including what the relay exposes by default, is in the User Guide.

Supported clouds and devices

Where the relay runs

Devices

Download links and install commands are in the Quick Start.

Requirements

• A Cloud Spectra licence key (it begins CSTW1-). Manage your subscription and keys on the account page; see Pricing to buy one. Without a licence the relay starts but forwards nothing.
• An OCI tenancy, and credentials for it (~/.oci/config) on the machine where you run create.
• The Cloud Spectra client on that machine and on every computer that will connect.
• Administrator rights on each computer: connecting creates a network interface (sudo on Linux and macOS, an elevated prompt on Windows).
• Network reachability: devices must reach the relay on UDP 28302, and on TCP 28300 when they enrol. The relay needs outbound internet access.

Pricing

CloudVpn is billed like the rest of Cloud Spectra Gateway: per vCPU of the relay instance, metered hourly, at your lane's rate. Every relay feature is included in that rate.

• The second vCPU of every instance is free: a 2-vCPU relay bills as one vCPU, and a 1-vCPU relay also bills as one.
• Only the first 64 vCPUs of an instance count, so an instance bills at most 63 vCPUs.
• There is no per-device or per-seat charge.
• A month whose usage comes to less than $1 is not invoiced.
• Your cloud provider bills the relay's instance, its public IPv4 address and its data transfer directly to your cloud account. A relay that is paused stops the Cloud Spectra charge; your provider may still charge for its disk and reserved address.

See Pricing for lanes and purchasing.

Limits

• CloudVpn relays can be created on OCI only. AWS relays are not available to customers in 1.0.0, and neither is VPC peering, which works only on AWS relays.
• IPv4 only; TCP and UDP only.
• Each CloudVpn relay is a single instance. There is no multi-relay CloudVpn group, load balancing or automatic failover in 1.0.0.
• Deployment is with the Cloud Spectra client or the relay dashboard; there is no Terraform module or CloudFormation template for CloudVpn.
• No single sign-on or per-user groups; destination policy applies to all devices on a relay.
• Idle flows expire: a TCP flow with no packets for 120 seconds, or a UDP flow idle for 60 seconds, loses its translation.

The complete list is in the FAQ.

Next steps