Nebula

What Nebula actually is

Nebula is an open-source overlay networking tool created by Slack and released to the public in November 2019 after more than two years of internal use. It builds a mutually authenticated, peer-to-peer, software-defined network across machines that may sit in different clouds, datacenters, or home connections — a flat private network where membership is decided by certificates, not by IP ranges or a central VPN concentrator. Slack built it to answer one question: what is the easiest way to securely connect tens of thousands of computers hosted at multiple providers in dozens of locations. The answer became a project that, by the company's own documentation, still powers Slack's global overlay of over 50,000 production hosts.

The design is the interesting part. Nebula is built on the Noise Protocol Framework — the same handshake family used by WireGuard and Signal — with elliptic-curve Diffie-Hellman key exchange (Curve25519 by default, NIST P256 available for compliance cases) and AES-256-GCM for data in the default configuration. Every node carries a certificate issued by a certificate authority you control; that certificate asserts the node's overlay IP address, its name, and its membership in user-defined groups. The groups are what make Nebula's firewall useful: rules are written in the style of cloud security groups ("web nodes may reach db nodes on port 3306, nothing else"), enforced on the nodes themselves and evaluated against certificate identity rather than source IPs.

Traffic engineering is deliberately minimal. A small number of discovery nodes — lighthouses, in Nebula's vocabulary — hold routable addresses and tell peers where to find each other; peers then connect directly, with UDP hole punching to get through most firewalls and NATs. Lighthouses are not on the data path: traffic flows node to node, which is the difference between a mesh and a hub-and-spoke VPN at five hundred nodes. Nebula runs on Linux, macOS, Windows, iOS, and Android, and nodes can live in any combination of cloud providers and on-premises racks without a shared addressing scheme.

Pricing: what you really pay

The software is free: download the binaries (or distribution packages), run nebula-cert to create your certificate authority, sign host certificates, and you have a network. The only mandatory cost is the machine you choose as a lighthouse — a small VPS with a static public IP — and the operational cost of running your own PKI. For teams that would rather not, Defined Networking sells Managed Nebula, which adds automated certificate management, SSO integration, and a web UI on top of the open-source core. We price the review on the open-source product; the managed offering is a separate commercial decision.

The real cost of Nebula is administrative, and it concentrates in certificate management. You are the certificate authority: the CA private key is the most sensitive file in your infrastructure, CAs default to a one-year lifetime and must be rotated deliberately, and adding a node means signing a certificate for it (with its IP and groups embedded). Revocation works through revocation lists distributed by lighthouses. This is more ceremony than a WireGuard config and much more ceremony than a SaaS mesh product, and it is the trade-off for a network with no vendor in the data path.

For a two-node lab the ceremony outweighs the benefit — a plain WireGuard pair is simpler. For a hundred-plus node fleet spanning clouds, the per-node marginal cost of Nebula is close to zero and the absence of a per-seat SaaS bill starts to matter. A managed mesh product priced per user can cost a mid-size engineering org thousands of dollars a year; Nebula on the same fleet costs one small VPS per lighthouse region and the hours your team spends on certificate operations. That is the pricing story: free software whose economics improve with scale and whose costs are paid in operator time.

Performance & infrastructure

There are no benchmark numbers to quote from us — we have not tested Nebula's throughput or latency and will not invent any. What is documented: direct peer-to-peer tunnels between nodes, a TUN adapter carrying TCP, UDP, and ICMP with split-tunneling support, NAT traversal via lighthouse-assisted lookup, and a groups-based host firewall applied to overlay traffic. Encryption is end-to-end between peers; lighthouses see discovery traffic, not payloads. The cryptographic design is the standard modern stack (Noise, Curve25519 or P256, AES-256-GCM or ChaCha20-Poly1305) rather than something invented for the project — Slack's engineering post is explicit that they did not roll their own crypto.

Scale is the headline capability and the reason the project exists. The README targets "tens of thousands of computers" — note that some secondary sources inflate this to hundreds of thousands, which we could not substantiate — and Slack's own deployment is documented at over 50,000 production hosts. The certificate-identity model scales operationally too: deterministic IP assignment at certificate signing (no DHCP in the overlay), group-based policy instead of per-host rule lists, and lighthouses that only broker introductions.

Maintenance status matters for infrastructure software, and Nebula is alive: version 1.10.3 shipped in February 2026, fixing a blocklist-bypass bug affecting P256-curve certificates. That is a security fix in a mature project on a plausible cadence, which is what we want to see. Documentation lives at nebula.defined.net and covers CA rotation, lighthouse setup, and the groups firewall; the GitHub repository has the binaries and release notes.

Where it falls short

Operational burden is the honest answer. There is no GUI in the open-source product, no hosted control plane, no automatic certificate lifecycle beyond what you script yourself, and no vendor to call when a tunnel will not form. The one-year default CA lifetime is a footgun: a fleet whose CA expires is a fleet that stops trusting its own nodes, and rotating a CA is an involved procedure. Teams without infrastructure experience will find the learning curve steeper than WireGuard's and far steeper than a managed mesh product.

Second, Nebula solves mesh networking and nothing else. There is no built-in DNS for overlay names in the core workflow (you manage name resolution yourself or through your configuration management), no web UI for policy, and no per-user SSO in the open-source edition — those arrive only with the managed commercial product. High availability of the control side is also your problem: a single lighthouse is a single point of failure for discovery (existing tunnels keep running, but new connections cannot be brokered), so production deployments run multiple lighthouses across regions and keep them in configuration management like any other stateful service.

Third, the ecosystem is smaller than the comparison everyone will make. Tailscale and its peers sell convenience: key expiry, web dashboards, device approval, ACL editors. Nebula matches them on network semantics and loses on ergonomics. If your team wants to click "add device" on a phone, Nebula is the wrong tool.

Fourth, overlay-specific gaps: IPv6 support in the overlay has been a long-standing limitation of the certificate-IP model, and mobile support (iOS and Android clients exist) is functional but less polished than the desktop story. We state these as review observations rather than measured findings.

Who should pick this

Our pick for infrastructure engineers running a large self-hosted mesh across clouds and colos who want identity-based networking without a SaaS dependency: platform teams with configuration management, homelabbers building something serious, and any organization whose security review requires that no third party can see or broker internal traffic. The groups-based firewall and certificate identity model make it a natural fit for environments that already think in security groups.

We would look elsewhere for small networks (WireGuard is simpler), for teams that need device management UX and SSO out of the box (buy a managed mesh), and for organizations without the operational muscle to run a certificate authority safely. If the managed route appeals, Managed Nebula covers the same network semantics with the ceremony removed — see our private networking category for the commercial alternatives.

Key takeaways

• Open-source overlay networking from Slack (open-sourced November 2019), still powering Slack's documented 50,000+ production hosts.
• Noise Protocol Framework with Curve25519 (P256 optional), AES-256-GCM by default, mutual authentication via your own certificate authority.
• Certificate identity carries the overlay IP and security groups; firewall rules are expressed cloud-security-group style and enforced peer to peer.
• Lighthouses broker discovery only — data flows directly between nodes, which is what makes the mesh scale.
• Free software; the costs are your lighthouse VPS and PKI operations (CA rotation, certificate signing, revocation). Managed Nebula exists as a paid third-party option.
• Right tool for large self-hosted fleets, wrong tool if you want a GUI, SSO, or zero operational ceremony; actively maintained (v1.10.3, February 2026).

Sources

• https://github.com/slackhq/nebula
• https://slack.engineering/introducing-nebula-the-open-source-global-overlay-network-from-slack
• https://nebula.defined.net/docs
• https://jacar.es/en/nebula-slacks-overlay-vpn-explained