How it works

Authorize the device. Build the private path.

Tejnet ties connectivity to identity, account membership and device enrollment, issues each device its own WireGuard key pair, then prefers a direct peer path and falls back to managed relay when needed.

Connection journey

Six steps from sign-in to private reachability.

01AuthenticateUser signs in through the Tejnet identity flow.

02Resolve accountMembership, account state and entitlements are checked.

03Enroll deviceThe endpoint is explicitly added to the intended account.

04Join fabricThe client receives a WireGuard key pair and authorized peer configuration for the fabric.

05Select pathDirect encrypted peer connectivity is preferred when conditions allow.

06Stay reachableManaged relay preserves the encrypted WireGuard session when direct reachability fails.

Path selection

Direct when possible. Relay when necessary.

Preferred

Direct P2P

Endpoints exchange encrypted WireGuard packets directly over the private peer path when the network permits it.

Fallback

Managed relay

Tejnet-managed infrastructure forwards the same encrypted WireGuard session when a direct path cannot be established — it relays ciphertext, not readable traffic.

Remote access

The private network becomes the path to private services.

Remote Access & Web Console is the next layer: authenticated browser sessions for private applications and administration, without requiring the target service to be publicly published.

Browser SSH, RDP and custom TCP remain Product Preview / Coming Soon and are not represented as generally available today.