MESH SD-WAN · 3 MINUTE INSTALL

One mesh.
Every site connected.

A WireGuard full-mesh SD-WAN that connects every site, server, and cloud — identity-based access rules, self-healing multi-WAN, and a full branch appliance. Purpose-built for SMBs and the MSPs who run them.

WireGuard · multi-WAN failover · multi-tenant
Deploy in 3 Minutes See how it works
site-01 · bringing up mesh
wireguard · live
# one command per site
$ sdwan setup <auth-key>
✓ Agent registered with controller
✓ WireGuard tunnel established
✓ Peers discovered: NYC ↔ Mumbai ↔ London
✓ Access rules applied
✓ Site fully operational — 2m 47s
Full mesh, encrypted, connected — no hardware to ship.
100%
WireGuard Encrypted
3min
To Full Deployment
10
WAN Links / Site
5000+
Nodes Supported
95%
Cost Reduction
Zero Friction Deployment

3 minutes.
That's it.

No hardware to ship. No consultants to hire. No weeks of configuration. One Docker command per site and your encrypted mesh network is live.

1

Sign up & create a network

Free account, instant dashboard access. Name your network, pick a subnet.

2

Deploy the agent

One Docker command on each site. Auto-registers with the controller.

3

Mesh comes online

Access rules, health monitoring, and telemetry come online automatically.

terminal — deploy.sh
# Step 1: Pull and run the agent (30 seconds) $ docker run -d --name sdwan-agent \ --cap-add NET_ADMIN --network host \ -e CONTROLLER=https://api.quicksdwan.com \ -e AUTH_KEY=your-key-here \ quicksdwan/agent:latest ✓ Pulling quicksdwan/agent:latest... ✓ Agent registered with controller # Step 2: Agent auto-connects to mesh (60 seconds) ✓ WireGuard tunnel established ✓ Peer discovery complete: 3 peers found ✓ Full mesh active — NYC ↔ Mumbai ↔ London # Step 3: Mesh comes online (90 seconds) ✓ Peer routes + access rules synced ✓ Telemetry reporting online ✓ Anomaly detection online ✓ Site fully operational Total: 2m 47s
Identity Microsegmentation

Decide who can reach what — across every site.

Tag your nodes by role, site, or environment and write access rules against those tags. Rules compile to the kernel data plane and are enforced identically on every node in the mesh — not just at a central choke point.

  • Tag-based rules: allow/deny by role, site, protocol, port
  • Enforced on the kernel data plane (iptables) at every node
  • Default-deny isolation mode, per network
  • Policy propagates to all edges in under a second
// access rule applied across the mesh

Rule: allow tcp 443
       from tag:role=dev
       to   tag:app=internal

→ Compiled to iptables on 12 nodes
→ Default policy: DROP (isolation on)
→ Propagated in 0.8s

Effect:
  dev laptops     → internal apps: ALLOW
  guest wifi      → internal apps: DROP
  everything else → DROP
Predictive Anomaly Detection

Your network, watched 24/7 — statistically.

Continuous monitoring every 60 seconds across all nodes. Detects traffic spikes, latency anomalies, packet loss, and node flapping before users notice. Z-score analysis against rolling baselines — deterministic, no LLM.

  • 4 anomaly types: traffic spike, latency, packet loss, flapping
  • Severity scoring: low / medium / high / critical
  • Proactive alerts via webhook, Slack, and email
  • 10-minute cooldown prevents alert fatigue
Network Health
All Systems Normal
94
Health Score (0-100)
12ms
Avg Latency
0.1%
Packet Loss
48
Nodes Online
2
Active Anomalies
Auto-Remediation Engine

Define the policy. The engine handles the rest.

Create "if-then" remediation policies. When the engine detects an anomaly matching your rules, it automatically reroutes traffic, creates a recommendation, or escalates — deterministically, with no LLM in the loop.

  • Traffic spike → auto-reroute to backup path
  • Latency spike → failover to nearest node
  • Packet loss → alert + recommend investigation
  • Node flapping → stabilize + notify admin
// Auto-remediation policy in action

Policy: "If traffic_spike on any node,
         severity >= high, auto-reroute"

12:04:32 Anomaly detected: traffic_spike
         Node: mumbai-gw-01 (z-score: 3.2)
         Severity: HIGH

12:04:33 Policy matched: auto-reroute
         Rerouting traffic via mumbai-gw-02...

12:04:34 ✓ Traffic rerouted in 1.8 seconds
         Recommendation created: "Investigate
         traffic spike on mumbai-gw-01"

12:04:35 Alert sent via webhook + Slack
         (Next alert cooldown: 10 min)
NAT Traversal & Relays

Direct connections — even behind NAT.

Peers find each other through firewalls and carrier-grade NAT automatically. UDP hole-punching establishes direct paths; when a network won't allow it, traffic falls back to encrypted relays and promotes itself to direct the moment a path opens — no manual port forwarding, ever.

  • UDP hole-punching with live endpoint discovery
  • Automatic relay fallback when direct paths are blocked
  • Seamless promotion from relay to direct — no drops
  • Works behind CGNAT, hotel Wi-Fi, and strict firewalls
// path discovery, per peer

peer nyc-01
  12:01:04 no direct path — using relay
  12:01:07 hole-punch attempt via disco
  12:01:08 ✓ direct path established (34ms)
  12:01:08 ✓ promoted: relay → direct

peer mumbai-gw
  12:01:05 CGNAT detected on both sides
  12:01:05 ✓ encrypted relay active (89ms)
  retrying direct every 30s…

Status: 11 direct · 1 relayed · 0 down
Connectivity, built in

Mesh is the foundation.
Connectivity is complete.

Everything a private network actually needs — encrypted mesh, identity-based access, and self-healing paths — enforced on the kernel data plane at every site. No add-ons, no extra licenses.

WireGuard Mesh SD-WAN

Full-mesh encryption, split tunneling, managed routes, automatic key management. The fastest VPN protocol in production.

MeshSplit TunnelAuto Keys

NAT Traversal & Relays

UDP hole-punching for direct paths, encrypted relay fallback when networks block them, and automatic promotion back to direct.

Hole-PunchRelaysCGNAT

Identity Access Rules

Tag-based microsegmentation. Define who can reach what across the mesh; rules are enforced on the kernel data plane at every node.

MicrosegTagsACL

Deterministic Automation

Statistical anomaly detection and if-then auto-remediation — reroute, failover, alert — with no LLM in the loop. Explainable by design.

AnomalyAuto-FixNo LLM

Admin Access & Audit

RBAC with custom roles, SSO/SAML/OIDC, API keys, session management, and MFA. Immutable audit trails for every admin action.

RBACSSOAudit

Post-Quantum Ready

Hybrid ML-KEM (FIPS 203) key exchange derives the WireGuard pre-shared keys — harvest-now, decrypt-later protection, built in.

ML-KEMFIPS 203PQC
Operations & Visibility

See everything.
Control everything.

Real-time visibility into every tunnel, every link, every metric. Operational tools that eliminate truck rolls and manual SSH.

Zero-Touch Provisioning

Generate auth tokens, agents auto-enroll. No manual SSH, no truck rolls. Sites come online in seconds.

ZTPAuto-EnrollTokens

Network Topology Map

Interactive visualization of your entire mesh. See every node, tunnel, and connection in real-time.

TopologyReal-timeVisual

WAN Failover

Multi-WAN health probes, automatic failover, load balancing. Keep traffic flowing when links go down.

Multi-WANFailoverHealth

SLA Monitoring

Set SLA targets per link. Real-time compliance tracking with automatic traffic steering on violation.

SLATargetsSteering

Latency Matrix

Site-to-site latency heatmap. Instantly spot degradation across your entire mesh network.

LatencyHeatmapMatrix

Bandwidth Analytics

Per-site bandwidth monitoring with historical trends. Identify bottlenecks before users complain.

BandwidthTrendsPer-Site

Config Rollback

Version-controlled edge configurations. One-click rollback to any previous known-good state.

VersioningRollbackSafe

Alert Rules

Configurable alert thresholds for latency, packet loss, bandwidth. Push notifications to webhooks.

AlertsThresholdsWebhooks

Real-Time Events

Node online/offline and alert events streamed live to the dashboard over SSE. No refresh, no polling.

SSELiveStreaming
Edge Appliance

Turn any Linux box into a full SD-WAN appliance.

QoS with HTB/DSCP shaping, OSPF dynamic routing via FRR, zone-based firewall, PPPoE WAN, multi-WAN with health probes. All configured from the dashboard or 35+ command CLI.

  • QoS: traffic shaping with 20 DSCP classes
  • OSPF: dynamic routing via FRR integration
  • Zone firewall: independent from WireGuard ACL
  • Multi-WAN: failover + load-balance across 10 interfaces
// sdwan appliance status

Appliance Mode: ACTIVE

WAN Interfaces:
  eth0  ● UP   ISP-Primary   47ms  0.1% loss
  eth1  ● UP   ISP-Backup    52ms  0.0% loss
  ppp0  ● UP   PPPoE-VDSL    23ms  0.2% loss

QoS Policy: Active
  Voice (EF)    →  10 Mbps guaranteed
  Video (AF41)  →  20 Mbps guaranteed
  Best Effort   →  remaining bandwidth

Routing: OSPF enabled (Area 0)
  3 neighbors, 12 routes learned

Firewall Zones:
  LAN → WAN    ALLOW (NAT + MSS clamp)
  LAN → wg0    ALLOW (mesh traffic)
  WAN → LAN    DROP  (default deny)

Your first site is 3 minutes away.

Free tier. No credit card. No hardware to ship. Spin up an encrypted mesh in minutes.

Get Started Free View Pricing