Skip to main content

​
The matchmaker model

vpncli works like a matchmaker. A coordination server verifies who you are, tells you which machines are yours, and helps your two machines find each other. Once they’re connected, the server steps out — your terminal data travels directly between the machines and is encrypted end to end.

​
The connection, step by step

​
Peer-to-peer, not a pipe

The server only helps with the introduction. It does not relay your terminal data. Your two machines punch through NAT and talk directly.
This is the same idea as Tailscale’s coordination server: a lightweight matchmaker that introduces peers, while the actual conversation stays private between them.
For the interactive shell, if two machines genuinely cannot punch through to each other, vpncli can fall back to relaying the session through the server — and even then the data stays encrypted, so the server still only forwards scrambled bytes it cannot read. See Security.

​
Next

Is it encrypted?

Yes — every byte. Here’s exactly what that means.