Mesh admin
Manage Mesh Tenants (create CA + group), list enrolled nodes, revoke certificates, and define a Tenant LAN gateway with per-client access. Sign in with an Access admin account and authenticator code (same as Access admin).
Overview
—
Tenants
| Name | Slug | Group | Active | Gateway |
|---|
Create Tenant
Creates Mesh CA under tenants/<slug>, rebuilds trust bundle, reloads lighthouse. Does not delete on disable.
Nodes — —
| Cert | Overlay IP | Fingerprint | Created |
|---|
LAN gateway
Prefer a Linux host as gateway. Windows Server (RRAS) is documented but more ops. Clients must re-download their Mesh package after any gateway or client-access change.
Must not overlap Mesh overlay 10.50.0.0/16. Full-tunnel 0.0.0.0/0 is out of scope.
No gateway saved yet.
Client access (N5c)
Default when no ACL row: inherit all gateway LAN CIDRs. Use none to deny gateway routes, or custom for a subset. Soft control via client routes; gateway config adds local_cidr rules (group or per-host).
| Client | Overlay | Mode | Custom CIDRs | Effective |
|---|
Revoke certificate
Adds fingerprint to lighthouse blocklist. User can re-download to get a NEW cert; old fingerprint stays blocked.
Revoked
| Fingerprint | Cert | Tenant | By | When |
|---|