The tunnel

1. Fleet, Tunnel. Turn the tunnel on and choose an address range. 10.77.0.0/24 is fine unless something on your network already uses it.
2. Install tunnel support on every load balancer when the page offers to.
3. Add a workload, give it a name, and copy the command it shows.
4. Run that command on the machine you want to reach.
5. Note the tunnel address it gets, add it to a pool with the port the service listens on, and apply.

• Installs WireGuard if the machine does not have it.
• Makes a key pair on the machine and sends only the public half back.
• Writes one network interface called nfm0.
• Adds a route to the load balancers and to nothing else.
• Leaves a small helper command for checking and undoing it.

What it does not do: change the default route, send that machine's own traffic anywhere, or open any inbound port. You can read the script first by leaving the last part off the command.

Check the Tunnel page first. A workload that has joined shows as on the tunnel. One still waiting has not run the command, or the command failed part way.

If it shows as on the tunnel and the backend is still down, the tunnel is up and the service behind it is not. Check the service is listening, on the port you put in the pool.

A workload connects to every load balancer and each connection is separate. One working and one not usually means the workload cannot reach one of them: a firewall on the way, or an address family problem such as a load balancer published on IPv6 only while the workload has IPv4 only.

Use Change the setup to publish a name or address the workload can reach. A name with both an A and an AAAA record is the most flexible.

Commands expire after two hours. Click Show the command next to the workload for a new one. Asking for a new one retires the old one immediately, so a link that went astray stops working.

1. Take the address out of any pool that uses it, and apply. Otherwise the pool points at something that has gone.
2. Tunnel page, Remove next to the workload.
3. Copy the command shown and run it on the machine.
4. Press Remove it here.

It deliberately leaves the WireGuard package installed, because that machine may be using it for something else.

sudo nfm-tunnel status

If it reports the tunnel is not up, the interface was never created. The usual reasons are a container whose kernel has no WireGuard, or a firewall that allows outbound traffic generally and drops the tunnel port, which is UDP.

Not once workloads are enrolled on it. Changing it would strand them, so the page refuses. Remove the workloads first if you really need a different range.