Homelab & up The WireGuard remote-access bridge is included from the Homelab tier (£12/mo) and above. See pricing.

What Is It?

WolfNet isn’t just a cluster networking layer — it’s a full VPN built directly into your infrastructure. Any device running WolfNet can securely join your private network from anywhere in the world, giving you instant access to every server, container, and VM as if you were sat in the office.

There’s no extra software to install, no separate VPN server to manage, and no complex configuration. If you’re already running WolfStack, you already have a VPN.

Why WolfNet VPN?

Feature WolfNet VPN Traditional VPN
Setup One command (wolfnetctl join) Server install, certificates, client config
Encryption X25519 + ChaCha20-Poly1305 Varies (often OpenSSL/IPSec)
Architecture Peer-to-peer mesh Client → Server hub
NAT traversal Built-in relay forwarding Requires port forwarding
Extra software None — included with WolfStack Separate VPN server + clients
Performance WireGuard-class speed Overhead from TLS tunnelling

How It Works

WolfNet creates a TUN-based Layer 3 encrypted mesh network. When a remote device joins, it is assigned a 10.10.10.x address on the same private subnet as your cluster. All traffic between peers is encrypted end-to-end.

  1. Cluster nodes run WolfNet as part of WolfStack and are interconnected automatically
  2. Remote devices (laptops, workstations, phones) join the same network using an invite token
  3. Relay forwarding ensures connectivity even behind NAT or restrictive firewalls
  4. Routes are managed automatically — you connect and you’re done

Getting Started

1. Generate an invite token on any WolfStack node

bash
wolfnetctl invite

This outputs a secure token that encodes the network key and the endpoint address of the inviting node.

2. Join from your remote machine

Install WolfNet on your laptop or workstation, then join:

bash
# Install WolfNet standalone
curl -sSL https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfNet/main/setup.sh | sudo bash

# Join the network
wolfnetctl join <token>

3. You’re connected

Your device receives a WolfNet IP address (e.g. 10.10.10.5) and can immediately reach all cluster resources:

bash
# Ping a cluster node
ping 10.10.10.1

# SSH into a server
ssh admin@10.10.10.2

# Access a web service running on a container
curl http://10.10.10.3:8080

# Open the WolfStack dashboard
firefox https://10.10.10.1:8553

Use Cases

  • Remote work — Access your office infrastructure from home or while travelling without a corporate VPN appliance
  • Development — Connect your dev machine directly to staging/production servers, databases, and containers
  • Multi-site access — Join WolfNet networks spanning multiple clusters and data centres from a single laptop
  • Emergency admin — Quickly join the network from any machine to diagnose and fix issues
  • Team access — Generate invite tokens for team members so they can securely access shared infrastructure

Security

  • X25519 key exchange — Modern elliptic-curve Diffie-Hellman for forward secrecy
  • ChaCha20-Poly1305 encryption — AEAD cipher used by WireGuard, TLS 1.3, and Google
  • No central server — Peer-to-peer architecture means no single point of compromise
  • Token-based authentication — Only devices with a valid invite token can join the network
  • No third-party relay — All traffic stays on your own infrastructure or goes direct between peers

Managing Remote Peers

View all connected peers and their status from the WolfStack dashboard under Global WolfNet, or from the command line:

bash
# List all connected peers
wolfnetctl peers

# Remove a peer
wolfnetctl remove <peer-ip>
Esc