A full mesh without the do-it-yourself toil
A WireGuard mesh connects every node to every other with point-to-point tunnels. It works well, but on your own you manage peers, keys, addresses and NAT traversal by hand, and the work grows with every node. Vexaro Mesh, now in development, is designed to give you the same full mesh as a managed product that handles peering, keys and NAT traversal for you.
What a WireGuard mesh is
WireGuard is a fast, modern VPN protocol that connects two peers with a simple, audited tunnel. A "WireGuard mesh" uses it to connect many nodes so that each can reach every other directly. That is a full mesh, as opposed to routing everything through one server.
Point-to-point tunnels, everywhere
In a full mesh each node holds a direct tunnel to every other, so traffic between any two nodes takes the shortest path with no central relay. That is what makes a mesh fast.
The catch: it's all manual
WireGuard itself doesn't manage peers, distribute keys, allocate addresses or punch through NAT. In a hand-rolled mesh, every new node means updating the peer list and keys on the others, and the work grows with the square of the node count.
NAT traversal isn't built in
WireGuard expects to know how to reach each peer. Behind NAT, you need a discovery and hole-punching mechanism on top, plus a plan for when a direct connection can't form. The base protocol provides none of this.
How Vexaro plans to handle it for you
What Vexaro Mesh is designed to handle, so you don't operate the moving parts yourself.
Automatic peering
Gateways are designed to find each other and bring up the full mesh themselves, so there are no peer lists to edit on every node when one is added or removed.
Managed keys
Key material is planned to be provisioned and handled for you, removing the error-prone job of generating, distributing and rotating keys across a growing mesh by hand.
NAT traversal, built in by design
Peers behind NAT are designed to connect directly wherever the network allows, and through a relay when it doesn't. No port forwarding or public addresses are needed.
Central policy
Access rules are planned to be set centrally from one console. A base WireGuard setup leaves this layer to you.
DIY WireGuard mesh vs managed
An operational comparison of a hand-built WireGuard mesh and a managed full mesh. It is about who does the work, not about the quality of the protocol.
| Vexaro (managed mesh, planned) | DIY WireGuard mesh | |
|---|---|---|
| Peering | Automatic discovery | Manual peer lists per node |
| Key management | Provisioned & handled | Generate / distribute by hand |
| NAT traversal | Built in: direct, relay fallback | Add your own STUN / relay |
| Policy | Central | Per-node config / scripts |
A note on protocols
WireGuard is a good, modern protocol, and this page doesn't criticize it: it is about the day-to-day work of running a full mesh. Tools like Tailscale and NetBird build managed meshes on WireGuard. Vexaro Mesh is in development, and this site doesn't name the tunnel protocol it will use; its traffic is planned to be protected with modern cryptography. The comparison here is do-it-yourself versus managed operations, not protocol versus protocol.
Where a managed mesh fits
You want the speed and directness of a full mesh but don't want to hand-manage peers, keys and addresses as the node count grows.
Your nodes sit behind NAT and you'd rather not build and run STUN, hole-punching and a relay-fallback plan yourself.
You need operational features such as central policy and audit, which a base WireGuard configuration leaves you to assemble.
You'd rather connect whole sites as gateways than maintain per-device tunnel config across the fleet.