Tasmanian Cloud documentation

VPN

Encrypted VPN access with transparent layer 4 routing

All access to Tasmanian Cloud resources is exclusively via encrypted VPN. This architecture provides enhanced security while efficiently managing our limited IPv4 address space.

VPN-only access and transparent routingTasmanian Cloud vpn-only access and transparent routing.YOUR DEVICESlaptopphoneserverENCRYPTED MESHVPN gatewaylayer 4 routerPRIVATE WORKLOADSVPSKubernetestemplate appsstorageBOUNDARYno public SSHprivate addressauthenticatedencrypted transitOne gateway. Private addressing. No accidental public exposure.

Architecture

Transparent Layer 4 Routing

Our VPN infrastructure uses a sophisticated routing layer that operates transparently at Layer 4 (transport layer), allowing seamless connectivity without consuming public IP addresses for each resource.

flowchart TB
    subgraph "Your Devices"
        DEVICE1[Laptop]
        DEVICE2[Phone]
        DEVICE3[Server]
    end

    subgraph "Encrypted Mesh"
        VPN[VPN Gateway]
        ROUTER[Layer 4 Router]
    end

    subgraph "Your Infrastructure"
        VPS1[VPS Instance]
        VPS2[VPS Instance]
        K8S[Kubernetes Cluster]
        TEMPLATE[Template App]
    end

    DEVICE1 --> VPN
    DEVICE2 --> VPN
    DEVICE3 --> VPN
    VPN --> ROUTER
    ROUTER --> VPS1
    ROUTER --> VPS2
    ROUTER --> K8S
    ROUTER --> TEMPLATE

How It Works

  1. Client Connection - Your devices connect to the VPN gateway using encrypted tunnels
  2. Transparent Routing - The routing layer intercepts traffic and forwards it to the appropriate destination based on destination address and port
  3. No Public IPs - All resources use private addressing; no public IPv4 exposure required
  4. Automatic Failover - Multiple gateway endpoints ensure high availability

Why VPN-Only?

Security by Default

  • Zero public exposure - Resources cannot be accidentally exposed to the internet
  • Authenticated access - Every connection requires valid VPN credentials
  • Encrypted transit - All traffic encrypted in transit
  • Audit logging - Connection attempts are logged for security review

Address Space Efficiency

With limited IPv4 addresses available:

  • Traditional cloud: Each VM needs a public IP ($$$)
  • Tasmanian Cloud: Shared VPN gateway, private addressing internally
  • Result: More resources per IP address, lower costs

Sovereign Boundaries

  • All VPN infrastructure runs within Tasmania
  • No traffic traverses international boundaries
  • Data sovereignty maintained end-to-end

Getting Connected

1. Request Access

Contact us at hello@tasmanian.cloud to get VPN credentials for your account.

2. Install VPN Client

Download the appropriate VPN client for your operating system:

  • macOS - DMG installer
  • Windows - MSI installer
  • Linux - AppImage or package
  • iOS/Android - App Store / Play Store

3. Configure Connection

You'll receive a setup key that configures your client automatically:

  1. Open the VPN client
  2. Click "Add Connection"
  3. Enter your setup key
  4. Connect

4. Verify Connectivity

Once connected, test access to your resources:

# Ping your VPS
ping your-vm.private.cloud

# SSH to your server
ssh user@your-vm.private.cloud

# Access web services
curl http://your-service.private.cloud:8080

Layer 4 Routing Explained

Traditional vs. Transparent Routing

Traditional Approach:

  • Each service needs a unique IP:port combination
  • Public IP exhaustion with scale
  • Complex port management

Our Transparent Layer 4 Approach:

  • Single VPN gateway IP
  • Traffic routed based on destination hostname/port
  • Unlimited services behind one endpoint
  • Automatic DNS resolution for private hostnames

Example Routing Flow

1. User connects to VPN
2. User accesses: http://api.myapp.private.cloud:3000
3. VPN forwards traffic to Layer 4 router
4. Router resolves hostname �� destination VPS
5. Traffic delivered to port 3000 on target VPS
6. Response returns through same path

Benefits

  • No port conflicts - Each service uses standard ports
  • Simple DNS - Human-readable hostnames for all resources
  • Scalable - Add unlimited services without IP limitations
  • Secure - No service directly exposed to internet

DNS Resolution

Private DNS is provided for all resources within your VPN network:

  • Format: resource-name.private.cloud
  • Automatic - Created when resources are provisioned
  • Private only - Resolvable only via VPN

Example Hostnames

my-server.private.cloud
postgres-db.private.cloud
web-api.private.cloud
gitlab.private.cloud

Multi-Device Access

Connect multiple devices to your VPN network:

  • Personal devices - Laptop, phone, tablet
  • Team access - Shared credentials for team members
  • CI/CD runners - Automated systems can connect
  • Office networks - Entire office subnets can be whitelisted

Each device receives a unique internal IP within your private network.

Troubleshooting

Cannot Connect to VPN

  1. Verify your setup key is correct and not expired
  2. Check firewall isn't blocking VPN protocol (UDP/51820)
  3. Try alternate VPN endpoint
  4. Contact support with error logs

Connected but Cannot Access Resources

  1. Verify resource hostname is correct
  2. Check resource is running in dashboard
  3. Ensure firewall rules allow your VPN IP
  4. Try accessing by IP address instead of hostname

Slow Connection

  1. Choose geographically closer VPN endpoint
  2. Check local internet connection
  3. Reduce MTU if experiencing packet loss
  4. Try TCP mode instead of UDP

Best Practices

  • Keep VPN connected - Resources are only accessible via VPN
  • Use hostnames - IP addresses may change; hostnames are stable
  • Configure firewall - Restrict services to VPN network only
  • Rotate keys - Request new setup keys periodically
  • Monitor connections - Review access logs regularly

Related Documentation