Skip to main content
Vexaro Mesh
VexaroMesh

One mesh network across all your sites

Vexaro Mesh is a managed SD-WAN and mesh network for business, now in development. Gateways at offices, data centers and clouds are designed to build a full mesh themselves, with shared policies managed from one console.

Planned deployment:Cloud, self-hosted or hybrid

One network for all sites

Vexaro Mesh is being built for everything from linking branch offices to hybrid cloud, with one topology and one set of policies managed from a single console.

Site-to-site linking

Designed to join offices and data centers into one full-mesh network. Each site talks to any other directly instead of going through a single concentrator.

Hybrid and multi-cloud

Designed to link on-prem with AWS, GCP and private clouds into a single address space, defined as code rather than manual routes.

Access to servers and OT

Designed to keep admin panels, databases and industrial nodes off the open internet, reachable only over the mesh and by role.

Planned: management at the whole-network level

Full-mesh routing

Planned direct tunnels between all sites, so traffic takes the shortest path with no extra hops.

Modern encryption

Modern cryptography is planned on every tunnel between sites.

Zero trust

Every node and session is to be authenticated and checked against policy.

Roles and policies

Access by department and site, planned from a single console.

Logs and audit

Planned connection logs showing who connected and when, with SIEM export.

Self-hosted

Planned for Enterprise: the controller and keys in your own perimeter.

How the network is shaped

Instead of routing every site through one box, Vexaro Mesh is designed to build a direct, encrypted overlay between them and to extend the same fabric across clouds and through NAT.

Hub-and-spoke (before)SiteSiteSiteSiteConcentrator
A classic overlay hairpins all traffic through a single concentrator, which becomes both the bottleneck and the single point of failure.
Full mesh (Vexaro design)SiteSiteSiteSiteVexaro
Vexaro Mesh is designed to bring up a direct secure tunnel between every pair of sites. Traffic takes the shortest path; the controller manages policy and stays out of the data path.
Multi-site, multi-cloudVexaroOffice AOffice BData centerAWS cloudGCP cloud
Offices, a data center and two clouds are designed to join one overlay: each site peers into the shared fabric, and clouds reach each other directly across it.
NAT traversal, peer-to-peerdirect tunnelCoordinatorBranch peerNATRemote peerNAT
Two peers behind NAT are designed to connect directly wherever the network allows, with no port forwarding or public addresses, and through a relay when it doesn't.
Overlay trafficControl fabric
Mesh console (design preview)
example-org (concept)
preview
6
SITES
30
TUNNELS UP
12ms
AVG LATENCY
Berlin HQ
hub, 5 tunnels
8 ms
Amsterdam
branch, 5 tunnels
11 ms
Private data center
dc, 5 tunnels
6 ms
AWS eu-central
cloud, 5 tunnels
pending

Planned: your whole network in one console

The console is being designed to show topology, tunnel health, policies and logs, and to let you add sites and set access rules without touching routers on site.

  • A site from an image

    A gateway is planned to deploy from an image, find its peers and bring up tunnels by itself.

  • Observability

    Planned: tunnel health, latency and loss, with alerts and SIEM export.

What Vexaro Mesh is being built for

Full mesh
DIRECT PATHS BETWEEN SITES
3
PLANNED DEPLOYMENT MODES
Per site
PLANNED PRICING UNIT
Early access
CURRENT STATUS

Planned pricing: pay for sites, not hardware

Vexaro Mesh is in development. Pricing is planned per connected site, with no per-user or hardware licenses.

Start

$49/ site / month

For small networks of a few sites.

  • Up to 5 sites
  • Full-mesh networking
  • Cloud console
  • 30-day logs
Recommended

Business

$39/ site / month

For distributed networks.

  • Unlimited sites
  • SSO, all regions
  • Logs and SLA (planned)

Enterprise

Custom

Self-hosted, SLA and closed perimeters.

  • Deployment in your own perimeter (on-prem)
  • SSO / SAML
  • Target availability SLA, SIEM export
  • Dedicated support

Mesh FAQ

How will Vexaro Mesh differ from a traditional hub-and-spoke network?
A traditional network routes every site through a single concentrator. Vexaro Mesh, now in development, is designed to bring up a full mesh: every site will connect to every other directly, with unified policies from the console.
How will Mesh connect offices, data centers and clouds?
A lightweight gateway will be deployed at each site. Gateways are designed to find each other automatically and bring up encrypted tunnels over any link without port forwarding or public addresses, falling back to a relay when a direct path can't form.
Will I need separate hardware?
No. The gateway is planned to run as a VM or container on existing hardware or in the cloud; for self-hosted deployments, the controller will run in your perimeter.
Will it be deployable entirely in my own perimeter?
That is the plan: a self-hosted mode, planned for Enterprise, will keep the controller, routing, keys and access logs under your control.

Be first to connect your sites.

Vexaro Mesh is in development. Join early access and tell us about your sites and whether you would run it in the cloud or self-hosted.