The terrain on this page is real: Island in the Sky, seen from Green River Overlook — the spot marked on the map.
Photo: au_ears · CC BY-SA 2.0
One operator.
One autonomous system.
Real BGP over WireGuard across three continents — run end to end by its own control plane.
The lay of the land
Open in console →This is the console's own fleet map, live against production data — every node, WireGuard tunnel and health state, exactly as we see it. Drag to pan, Ctrl-scroll to zoom, click a cluster to open it up.
Why build a console for one AS?
Because the fleet outgrew every tool before it. Three eras, one lesson.
Hand-written configs, keys in a notes app. Fine for two nodes — the third one broke the system.
BIRD templates, deploy scripts. Better — until the question became “which node runs which version?”
Desired state in one place, an agent on every node, the console over it all. Drift died here.
The whole network, one pane
A purpose-built control plane with an agent on every node. Everything below runs through the console — no SSH in the loop.
Nodes & sessions
Fleet state at a glance — every node, tunnel and BGP session, live.
Onboarding
Approve a registration, mint a token, provision the node — online in minutes.
DNS groups
Resolver sets pushed to the fleet by group — change once, land everywhere.
Agent releases
Roll the fleet forward — or back — by release channel, from one screen.
Flap analytics
Prefix and peer flap boards surface unstable routes before they become incidents.
Audit log
Every change on record, with who made it and when — even a one-person network deserves a paper trail.
Peer with NATLAN
Running an AS on DN42? Peering is self-service — prove the ASN is yours, pick a node, and the tunnel and BGP session come back live in the same response.
Prove the ASN is yours
A registered ASN is the only prerequisite. auth.natlan.io checks it against the registry — email, PGP or SSH, whichever your mntner carries.
- node_id
- hkg1
- public_key
- kZ2n…OYptc=
- endpoint
- 203.0.113.9:21234
Every node lists its free slots, bandwidth and monthly quota — pick one, then hand over your key and where to reach you. That is the whole payload.
- node_public_key
- 9Fq1…Wc0H0A=
- endpoint
- hkg1.natlan.io:24028
Ours come back in the same response — no approval queue, no ticket. The session is up before you finish reading them.
That is the default shape. The same session can run over your ULA instead, or as two single-family sessions over your unicast addresses — extended next hop welcome.
201 provisioned paste it as-is
# wireguard — the session is already up [Peer] PublicKey = 9Fq1…Wc0H0A= Endpoint = hkg1.natlan.io:24028 AllowedIPs = ::/0, 0.0.0.0/0 # bird protocol bgp natlan { local as 4242421234; neighbor fe80::28%'wg-natlan' as 4242420028; }
One peering per AS per node. Keep the session stable — flapping ones may be torn down.
After it is up — the portal keeps working
Your session, as we see it
BGP state, last handshake, imported and exported route counts, traffic — from our side of the link.
Probes on demand
Path MTU and latency run against your endpoint whenever you want a number, not just at provisioning time.
The whole network
The same routing, traffic and flap boards the console runs on — including whether your own ASN is the one flapping.
Tear it down yourself
Remove a peering whenever you like and the slot frees up immediately. One peering per AS per node.
A small network, run properly.
Explore the console, read the docs, or bring your ASN over — there is always room for one more peer.