Guides

Step-by-step guides for configuring and troubleshooting Nebula overlay networks, including quick start, certificate management, DNS, and routing.

• Quick startHow to create your first overlay network using a certificate authority, lighthouse, and hosts
• How hosts find each otherThe two mechanisms Nebula hosts use to discover each other's routable addresses — the static host map and lighthouse discovery — and when to use each.
• NAT traversal and firewallsWhat Nebula needs from the firewalls and NATs between hosts — how UDP hole punching works, which NAT behaviors break it, and the fallbacks available when a direct tunnel cannot be established.
• Running as non-rootHow to run Nebula on Linux as an unprivileged user by granting the CAP_NET_ADMIN capability via systemd or setcap.
• Signing without a keyHow to sign Nebula certificates without copying private keys across devices.
• Rotating a CAHow to rotate an expiring Nebula certificate authority without downtime.
• Lighthouse DNSConfigure Nebula's experimental built-in DNS server on lighthouse hosts to resolve overlay network hostnames.
• Unsafe routesConfigure Nebula unsafe_routes to route traffic through overlay hosts and reach devices that cannot run Nebula directly.
• SSH debug commandsLearn how to use Nebula's built-in SSH server commands to debug network connectivity issues on overlay hosts.
• Upgrading to IPv6Step-by-step guide to upgrading an existing Nebula network to the v2 certificate format and enabling IPv6 overlay addresses.
• Viewing Nebula logsHow to view Nebula logs on Linux, macOS, Windows, iOS, and Android for troubleshooting and monitoring.