What is a mesh VPN?
A mesh VPN is a virtual private network in which the participating nodes (devices, servers or whole sites) connect to one another directly. They form a web of encrypted tunnels instead of funneling all traffic through a single central server. A coordination service helps the nodes find each other and distributes policy, but the traffic itself flows peer-to-peer along the shortest path between any two endpoints.
A mesh VPN connects many devices or sites so each can reach every other directly over encrypted tunnels, instead of routing all traffic through one central server.
What defines a mesh VPN
- 01
Connectivity is many-to-many: each node can reach every other node directly, instead of a star where everything passes through one hub.
- 02
A control plane (a coordinator or controller) handles discovery, identity and policy, but does not sit in the data path carrying every packet.
- 03
Traffic between two nodes takes a direct, encrypted path, which keeps latency low and removes the central concentrator as a bottleneck and single point of failure.
- 04
With no central choke point, a mesh scales better and recovers from failures more easily than a hub-and-spoke design as you add nodes.
How a mesh VPN works
When a node joins, it authenticates to the control plane and learns about its peers. It then establishes encrypted tunnels directly to the peers it needs to talk to, often piercing NAT so the tunnel forms even when both ends sit behind routers. The control plane keeps distributing identity, keys and access policy as nodes come and go, but the data itself travels node-to-node. This is the key distinction from a classic remote-access VPN, where every client connects to one gateway and all traffic is backhauled through it.
Mesh VPN vs traditional VPN
A traditional VPN is hub-and-spoke: clients dial into a concentrator, which carries all traffic and is its single point of failure. Any two clients that want to talk pay for an extra hop and extra latency. A mesh VPN takes that hub out of the data path and gives nodes direct paths to each other. Products in this space differ in their unit (some mesh individual devices, others whole sites) and in whether the control plane can be self-hosted, but they share the idea of direct, encrypted peer-to-peer connectivity coordinated centrally.
How this relates to Vexaro Mesh (in development)
Vexaro Mesh, now in development, is designed as a mesh for whole sites rather than individual devices: gateways at offices, data centers and clouds building a full mesh themselves, so every site reaches every other directly. The controller is to manage policy but stay out of the data path, and peers behind NAT are designed to connect directly wherever the network allows, and through a relay when it doesn't. Pricing is planned per connected site, with the controller in the cloud or inside your own perimeter.
See the planned features