Skip to main content

Key Concepts

Understanding these core concepts will help you effectively deploy and manage your Camouflage network.

Networks​

A Network in Camouflage is an isolated virtual network environment where nodes can communicate securely.

Key Features:

  • Complete network isolation between different networks
  • Custom IP address ranges
  • Encrypted traffic
  • Per-network access control

Relay Servers​

Relay Servers form the backbone of Camouflage's infrastructure, facilitating connections between nodes.

Responsibilities:

  • Route traffic between nodes using QUIC protocol
  • Maintain connection state
  • Handle NAT traversal
  • Distribute load across the network

Architecture:

  • Stateless design for horizontal scaling
  • Low-latency QUIC-based protocol
  • Support for global distribution

Gateway Nodes​

Gateway Nodes serve as entry points to private networks, allowing external clients to access resources.

Capabilities:

  • Bridge between Camouflage network and local resources
  • Run as isolated daemon containers
  • Dynamic creation and lifecycle management
  • Automatic cleanup when network is removed

Use Cases:

  • Access to on-premises resources
  • Hybrid cloud connectivity
  • Remote development environments

Nodes​

Nodes are the endpoints in your Camouflage network - devices, servers, or containers that communicate through the network.

Types:

  • Client Nodes - End-user devices (laptops, phones)
  • Server Nodes - Services and applications
  • Gateway Nodes - Entry points to private networks

Access Control Lists (ACLs)​

ACLs define granular rules controlling network access and traffic flow.

Rule Types:

  • Source/destination IP filtering
  • Port-based restrictions
  • Protocol controls
  • User/group-based policies

Capabilities:

  • Allow/deny specific traffic
  • Time-based rules
  • Geo-based restrictions
  • Priority-based ordering

Management Backend​

The Management Backend is the central control plane for your Camouflage deployment.

Components:

  • Django-based REST API
  • WebSocket server for real-time updates
  • PostgreSQL database
  • Activity logging and audit trails

Web Console​

The Web Console provides a user-friendly interface for managing your Camouflage infrastructure.

Features:

  • Network management
  • User administration
  • ACL configuration
  • Real-time monitoring
  • Activity logs

Organizations​

Organizations provide multi-tenancy support in Camouflage Enterprise Edition.

Capabilities:

  • Complete isolation between organizations
  • Organization-level user management
  • Separate resource quotas
  • Independent billing and licensing

Roles and Permissions​

Roles define what actions users can perform within Camouflage.

Built-in Roles:

  • Super Admin - Full system access
  • Organization Admin - Manage organization resources
  • Network Admin - Manage specific networks
  • User - Connect to assigned networks

Client Authentication​

Every node connecting to a Camouflage network must present an auth key — a unique, per-node credential that identifies and authorizes the connection.

How auth keys work:

  • Generated when a node is created (via Web Console or daemon CLI)
  • Format: tskey-{random_hex} (cryptographically generated)
  • Required on every connection attempt — unauthenticated connections are rejected
  • Can be revoked instantly to cut off access

Enterprise Edition: Auth keys are managed centrally through the Web Console and validated by the backend API on each connection.

Standalone Mode: Auth keys are stored in a local clients.toml file managed by the daemon CLI (camouflage-daemon add-client).

Fixed IP Assignment​

Nodes receive persistent IP addresses that remain the same across reconnections and daemon restarts.

Benefits:

  • Stable addressing for firewall rules and ACLs
  • Consistent DNS resolution within the network
  • Reliable service discovery between nodes
  • Predictable network configuration

Enterprise Edition: IPs are assigned by the backend and stored in the database. The daemon queries the API on each connection to resolve the node's IP.

Standalone Mode: IPs are stored in clients.toml alongside auth keys. Each client is assigned the next available IP from the subnet, or a specific IP can be chosen during registration.

Connection Profiles​

A Connection Profile (.camouflage file) is a portable JSON document containing everything a client needs to connect to a network.

Profile contents:

  • Server address and port
  • Auth key for authentication
  • Key exchange method (hybrid, pqxdh, noise)
  • Network configuration (routing, relay settings)

How to use profiles:

  • Enterprise: Download from the Web Console after creating a node
  • Standalone: Generate with camouflage-daemon export-profile
  • Client: Import with camouflage-client connect --profile <file> or drag-and-drop into the desktop app

Profiles follow the same format across all deployment modes, making it easy to migrate between standalone and enterprise setups.

Next Steps​

Now that you understand the key concepts: