Nodes and networks
A DVeMesh network is a Control-scoped set of enrolled devices. Each device maps a DVeProto public NodeID to a Control device record and an assigned overlay DVeIP. A peer record is not by itself proof of an active session or permission to send a packet.
Two planes
The Control Plane manages enrollment, membership, topology, ACL, endpoint hints, and rendezvous coordination. The Data Plane carries encrypted peer traffic over UDP, optionally through a ciphertext relay. Control does not forward overlay IP packets.
Authorization boundaries
Control topology policy decides which peer sessions may exist. Packet ACL decides whether source and destination overlay traffic may pass. An ACL ALLOW never creates permission to establish a session that SELECTIVE topology forbids. No matching ACL rule means DENY.
Connectivity paths
- Direct: UDP peer session when endpoint and firewall conditions allow.
- Hole punch: best-effort UDP coordination after direct attempts fail.
- Relay: a separate DVeMesh relay transport, only when configuration and authorization permit.
Symmetric NAT, CGNAT, blocked UDP, IPv6 transport, and cross-ISP reliability are not guaranteed by the current implementation. See NAT Traversal and Relay.
Availability
There is no public status service or measured network availability. Independent-host multi-hop recovery remains an integration validation task.