Managed lighthouses
Every Managed Nebula network includes a managed lighthouse at no extra cost. A lighthouse is the component that lets hosts discover each other and establish connections. With a managed lighthouse, Defined Networking runs this infrastructure for you, so there's nothing to install, configure, or keep online.
What you get automatically
When you create a network, a managed lighthouse is provisioned automatically. You can begin enrolling hosts right away. Your network is ready to operate without standing up any servers of your own.
The managed lighthouse:
- Is highly available and maintained by Defined Networking
- Requires no public IP, open ports, or always-on server on your side
- Handles peer discovery for every host on your network
What the managed lighthouse can and cannot see
The managed lighthouse learns the internet address where each of your hosts can currently be reached, which is what lets it answer discovery queries. It takes no part in the encrypted handshake between two hosts and holds none of their key material, so it cannot read or modify traffic between them. Its certificate is signed by your network's CA but carries no role or tag, so your firewall rules never grant it access to your hosts. Additionally, it is assigned an IP address outside of your network CIDR so that Nebula will refuse to exchange any Layer 3 traffic with the managed lighthouse.
Because peer discovery runs through it, the managed lighthouse is infrastructure your network depends on. Hosts that have already established tunnels keep communicating if it becomes unreachable, but a host cannot find a peer it isn't already talking to until discovery recovers. For added resiliency, you can host your own lighthouses in addition, or in lieu of, Defined's managed lighthouse.
The managed lighthouse as a relay
By default, a network's lighthouses also act as relays, forwarding traffic between two hosts that cannot establish a direct connection. This applies to the managed lighthouse just as it does to a lighthouse you run yourself, and can be disabled in the network's settings.
While it is enabled, some of your host-to-host traffic may travel through Defined Networking's infrastructure. That traffic stays encrypted end-to-end between the two hosts: a relay knows which hosts are talking and how much, but cannot read or alter what they send.
When to run your own lighthouse
The managed lighthouse is the right choice for most networks. You may want to run your own lighthouse instead (or in addition) if you need:
- Full control over the infrastructure that handles peer discovery
- A lighthouse inside a specific network, region, or data center
- To keep all coordination infrastructure on hardware you operate
You can self-host one or more lighthouses alongside the managed lighthouse. See Enrolling a lighthouse for the step-by-step self-hosted setup.
A network can use the managed lighthouse, self-hosted lighthouses, or both at the same time. Adding your own lighthouse does not remove the managed one.