DOCS
How a Conntrack fabric works
A fabric is yours from the moment you sign in. Nothing here calls a live coordination server. Configuration stays in this browser, and only if you allow functional storage.
The fabric
A fabric is the private network. Every enrolled device is a peer. There is no concentrator in the data path. The coordination server hands out keys and the policy, then gets out of the way.
Addresses
Each device receives an IPv4 address in 100.104.12.0/24 and an IPv6 address in fd12:a1:c0::/64. The Windows adapter uses a /32 and a /128, with no default gateway. 100.104.12.2 is fd12:a1:c0::2. The relay is 100.104.12.1 and fd12:a1:c0::1. Those addresses do not change when a laptop moves networks. They are not routed on the public internet.
Fabric DNS
A Windows adapter gets a connection-specific DNS suffix such as ct1a2b3c4d.conntrack.net. Only that suffix is sent to the relay at 100.104.12.1. The relay answers the computer name and relay on that suffix, with both A and AAAA records. Other names keep using your normal resolver.
Grants
A grant has a source, a destination, and a list of ports. Sources and destinations can be an email, a group, a tag, a device name, or an autogroup such as autogroup:member, autogroup:self, or autogroup:shared. Tests fail closed: if you cannot explain a line, it does not pass.
Exit nodes
A device may advertise itself as an exit. The menu in the console picks at most one active exit for this operator. Traffic to the internet then leaves from that device. Traffic to other fabric addresses stays on the mesh.
Subnet routers
A device that can already reach a private LAN can advertise those CIDRs. They stay pending until an admin approves them. Unapproved routes are visible and unused.
Auth keys
An auth key is a secret stored with a device record on this fabric. There is no published client that consumes it. Reusable, ephemeral, and preauthorized flags still apply to the record.
Mesh SSH
When Mesh SSH is on, SSH rules in the policy file decide who may open a shell and as which user. The device still has to have SSH enabled. The connection is between fabric addresses, not a public port.
Drop
Drop moves a file from the device you are on to another device on the fabric. The recipient accepts it. Turn Drop off and new sends stop. Files already offered stay in the list until you remove them.
HTTPS certificates
With certificates on, the console can issue a name on the fabric domain. A published service and a device name are both valid hosts. Revoking a certificate does not delete the name.
Device posture
Enterprise fabrics can require disk encryption, a firewall, and the current client. A device that misses a check stays on the fabric and is marked on the machines list. The check is a report from the device, not a remote wipe.
Directory
SCIM reads InfraLock Directory. Run sync to add people who are active there, accept invites that match, and suspend anyone the directory has deactivated. Groups named by the directory are filled in, up to the plan’s group limit.
Log streaming
Enterprise fabrics can post configuration events and network flows to Venator or any HTTPS webhook. A test delivery counts immediately. The live stream keeps posting while it is on.
Roles
The owner can view the console as another user. An auditor can read every page and cannot change the fabric. Billing can change the plan and nothing else. Personal, Standard, and Enterprise each gate a different set of controls.
Add a device
From Machines, choose Add device, then Windows. Conntrack.ps1 downloads. Run it as Administrator. The script opens a browser so you can sign in and connect that PC. That installs the official Wintun driver and a Conntrack adapter. ipconfig shows an IPv6 address in fd12:a1:c0::/64 and a DNS suffix ending in .conntrack.net. Ping 100.104.12.1 and ping -6 fd12:a1:c0::1 to reach the relay. Running the script again keeps the same address. Linux and macOS do not have a client yet. Conntrack is not a winget package, and this site does not accept a raw WireGuard UDP handshake.