SD-WAN on WireGuard
Every link, one fabric.
Weft joins your branch offices, cloud networks and remote laptops into one encrypted network. Bring a site up from a browser, change it without fear, and know the moment anything stops matching what you asked for.
No card. Three sites, ten roaming clients, every feature.
Use cases
One network for every place work happens
The same fabric carries branch traffic, remote staff, cloud workloads and internet breakout, under one policy.
Connect branch offices
Join sites over any internet link, with two uplinks each and failover detected in under a second.
Branch networking →Replace the remote-access VPN
Mac, Windows and Linux laptops join the same network as your sites, with keys that never leave the device.
Remote access →Segment with deny by default
Put devices in groups and permit what each group may reach. Everything else is refused.
Segmentation →Send Microsoft 365 direct
Teams and SharePoint leave from the branch, using the addresses Microsoft publishes, kept current hourly.
Microsoft 365 breakout →Break out through your firewall
Route all internet traffic through the perimeter firewall you already trust, without stranding a site.
Firewall breakout →Stretch a network between sites
Extend one layer-2 segment across locations, with EVPN instead of flooding the WAN.
Layer-2 extension →Why it is safe to change
Networks break when they change. Weft is built around that.
The control plane is never in the packet path
Every site holds its complete configuration. If Weft's control plane is unreachable, your network keeps forwarding; you just cannot change it until it is back.
Every change goes to one site first
A change reaches a single canary site and is held there until that site proves it is healthy. Only then does the rest of the fleet follow.
Drift is reported, not assumed away
Each site compares what the kernel actually holds — routes, tunnels, peers, firewall policy — against what it was told to install, and reports any difference by name.
Bring-up
A new site in three steps, from a browser
No appliance to ship and no configuration to hand-write. Any machine running Ubuntu 24.04 becomes a Weft site.
- Install Ubuntu 24.04On a small PC, a server or a cloud instance. x86-64 or ARM64.
- Paste one command from the consoleIt checks the machine, installs the agent and enrols it with a one-time invitation.
- The site joins the fabricIts keys are generated on the machine, and the console shows it healthy once its tunnels are up.
Built on open standards
Nothing proprietary on the wire
Weft is the orchestration. The data path is standard Linux networking that your team already knows how to inspect.
- WireGuard
- VXLAN
- BGP EVPN
- OSPF
- eBGP
- BFD
- FRRouting
- nftables
- Ubuntu 24.04 LTS
- x86-64 & ARM64
- macOS · Windows · Linux clients
Try it on a real network
Thirty days, three sites, ten roaming clients and every feature. No card.