Architecture
Network Plane
Core networking
Section titled “Core networking”Each Computle site uses a spine-leaf network. Every workstation has its own dedicated 1 Gbps interface into the leaf layer; the aggregation layer runs on 40 Gbps and 100 Gbps links with several uplinks to carriers, so one failed link or carrier does not take a site offline.
Address ranges
Section titled “Address ranges”Every workstation is provisioned inside a tenant-specific network namespace, isolated from every other customer. Each workstation gets a private address from the Carrier-Grade NAT range 100.64.0.0/10, so Computle addresses do not clash with the private ranges used in offices.
The exact ranges your workstations use are shown on the VPN page of the Computle Portal when you set up a site-to-site VPN. See Configure your firewall.
Namespace routing
Section titled “Namespace routing”Routing decisions are made per tenant namespace. Traffic between your workstations and your other Computle-hosted resources stays inside the namespace. Traffic to and from your offices goes through your site-to-site VPN; traffic from a user’s device to their workstation goes through the Computle client’s outbound connection.
Security
Section titled “Security”All inbound access to a workstation is blocked by default. Workstations are never exposed to the internet. Access comes by one of four routes:
- The Computle client. The user’s device and the workstation both connect outbound to the Computle connection service and relays. No inbound port is opened anywhere.
- Site-to-site VPN. Your office network is joined to your tenant namespace over an encrypted tunnel that terminates on your own firewall. See Site-to-site VPN.
- A private Layer 1 cross-connect straight into Computle’s network, with your addressing and routing preserved, BGP or static.
Public addresses
Section titled “Public addresses”Tenants are not given fixed public IP addresses, and direct public access to tenant resources is not offered. Everything is reached through the Computle client or a site-to-site VPN.
Carriers
Section titled “Carriers”Each site connects to more than one carrier, with automatic failover between them, so a single carrier fault does not cut off a site.
Multi-site organisations
Section titled “Multi-site organisations”Organisations with workstations at more than one Computle site, or using distributed storage such as Panzura, can have their sites connected over Computle’s network at no charge. Each tenant router at each site carries only that tenant’s traffic, and redundant public endpoints at each site give failover between locations. Customer premises equipment at your offices connects into the same mesh through site-to-site VPN.
Site-to-site VPN
Section titled “Site-to-site VPN”Computle supports IPsec site-to-site VPNs between your office firewall and your tenant namespace, configured from the VPN page of the Computle Portal. The tunnel terminates on your own firewall.
Remote endpoint requirements
Section titled “Remote endpoint requirements”Your endpoint must support:
- IKE: IKEv1 or IKEv2
- Encryption: AES-128 or AES-256, CBC or GCM
- Integrity: SHA1, SHA256, SHA384 or SHA512
- DH groups: 2, 5, 14 to 21
Pricing
Section titled “Pricing”Site-to-site VPNs are included in the subscription.
Performance
Section titled “Performance”VPN gateways have 1 Gbps dedicated interfaces and run inside the tenant namespace.
Set-up steps are in the Networking section.