Serverless SD-WAN & Zero-Trust WireGuard Mesh

Why Serverless Zero-Trust Mesh?

Traditional corporate VPNs and hardware SD-WAN concentrators present severe structural liabilities: hairpinned bandwidth costs, single points of failure, and excessive blast radius upon credential compromise. BlackShield Serverless SD-WAN replaces central choke points with direct, encrypted peer-to-peer WireGuard tunnels governed by centralized, continuous zero-trust policy.

Pure Go Userspace

Zero kernel modules or root requirements. Built on wireguard-go and cross-compiled for any Linux, Darwin, or Windows host.

92%+ Direct P2P Traversal

Interactive STUN binding discovery and UDP hole punching establish direct low-latency wire paths across symmetric and cone NAT firewalls.

Ephemeral JIT Relays

When both endpoints reside behind hard symmetric NATs, ephemeral Fargate relays spin up on demand and terminate automatically upon session idle.

Quickstart: 1-Line Node Onboarding

Enrolling a host into your private organization mesh takes seconds via interactive web browser pairing or automated CI/CD auth tokens.

# Option A: Interactive CLI Login (Browser Pairing)

$ blackshield-mesh login

# Returns: Open https://blackshield.chaplau.com/sdwan?token=xyz to authenticate

# Option B: Automated Headless Node Enrollment (Linux / Docker)

$ curl -fsSL https://blackshield.chaplau.com/source-bundles/mesh-install.sh | sh -s -- up --authkey bs_key_ephemeral_token

Continuous Posture & Automated Quarantine

Unlike static VPNs that grant perpetual perimeter access upon authentication, BlackShield continuously evaluates device security posture against the tenant findings repository.

KEV Exploit Detection: If a host is detected running software with an actively exploited vulnerability (CISA KEV), its peer routes are immediately revoked.
Micro-Segmentation ACLs: Default-deny inter-node rules restrict lateral movement. Web servers can never initiate SSH sessions to internal databases without explicit JIT grants.
Cryptographic Sub-5ms Severance: When an endpoint is quarantined, all active WireGuard sessions receive an immutable termination packet, dropping lateral egress instantly.