Current flow
DVeMesh discovers local endpoints and may use a nonce-validated UDP observation from a configured relay. When direct UDP attempts fail, Control can coordinate a short-lived peer rendezvous; signed probes are sent from the DVeMesh listener socket before the authenticated peer handshake.
Boundaries
- Control coordinates endpoints and rendezvous metadata; it does not carry overlay packet payloads.
- Public IP discovery does not prove inbound UDP reachability.
- Reflected UDP mappings can be destination-specific; an observed endpoint may not work toward a different peer.
- NAT punching is best effort; symmetric NAT and CGNAT are not guaranteed.
- IPv6 and TCP/WebSocket fallback are not supported by the documented Linux agent path.
Fallback
The connection path may try direct UDP, then hole punching, then a configured authorized ciphertext relay. If no path is available, the peer enters failure/backoff. The documented production configuration has no preconfigured public relay service.
Control outages
Existing sessions can continue with a cached configuration. New rendezvous may fail while Control is unavailable; relay use depends on cached authorized relay configuration and an available relay endpoint.
Validation
Local tests cover protocol mechanics. Cross-NAT, cross-ISP, CGNAT, and public inbound UDP behavior have not been established by this portal.