Clients
After server installation and server configuration, you can use the Web UI or run Nebula on devices:
- ncclient – Preferred method: device client for installation and usage (Docker, CLI, Linux desktop app, Windows app, NixOS). Enroll once, then ncclient polls for config and certs and can run Nebula.
- nebula – Manual alternative: create networks and nodes in the UI, then deploy config and certs yourself and run Nebula manually (e.g. when ncclient is not available, such as on mobile).
All of these assume the backend is running and reachable at the URL you configure.
Subnet Routers and Exit Nodes
Turn a node into a subnet router or an exit node, and pick which routes each other node actually uses — built on Nebula’s unsafe_routes.
Public Endpoints and Reachable Addresses
Tell the mesh where to find a node on the underlay: one public endpoint every peer knows about, plus extra addresses the node reports to its lighthouses.