MAE Routing docs

Everything you need to set up a network, add machines and control who can reach what.

How it works

Each organisation gets its own network with its own coordination server at your-network.routing.maesuaisystem.com. The coordination server hands out keys, addresses and settings. It never carries your traffic.

Machines connect to each other directly over WireGuard, even behind NAT and firewalls. When a direct path is not possible, traffic goes through our relay in Bangkok. It stays end-to-end encrypted, so the relay cannot read it.

Every machine gets a fixed address in 10.77.0.0/16 and a name such as nas.your-network.mae.internal.

Create a network

1. Go to Create a free network.
2. Enter your name, email, a password and your organisation's name.
3. Choose a network name (a-z, 0-9 and -). It becomes network-name.routing.maesuaisystem.com and cannot be changed later.

You become the owner and land in the admin console. One account can belong to several organisations; switch between them from the menu at the top of the console.

Add a device

Install the app on the device and sign in with your network name. The installation guide walks through every step for Windows, Linux and Docker. In the console, Machines → Add device shows the install command with your real network name.

Invite your team

1. Open Users → Invite user, enter the person's email and pick a role.
2. Copy the invite link and send it to them. It works once and expires after 7 days.
3. They open it, set a password (or use their existing account) and can add their own devices.

Removing a user also removes their machines from the network.

Subnet routers

A subnet router lets the whole network reach devices that cannot run the app, such as printers, cameras or a NAS, through one Linux machine on the same LAN.

1. On the Linux machine, turn on IP forwarding:

   echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-mae-routing.conf
   echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-mae-routing.conf
   sudo sysctl -p /etc/sysctl.d/99-mae-routing.conf

2. Advertise the LAN:

   sudo mae-routing set --advertise-routes=192.168.1.0/24

3. In the console, open the machine's ⋯ → Edit routes…, tick the subnet and save.
4. Windows machines use approved routes automatically (tray icon → Settings). On other Linux machines, run sudo mae-routing set --accept-routes.

To approve routes without a click, add an autoApprovers section to your access controls.

Exit nodes

An exit node sends all of a machine's internet traffic out through another machine in your network, for example through the office connection when you are on public Wi-Fi.

1. On the Linux machine that will be the exit node, turn on IP forwarding (see subnet routers) and run

   sudo mae-routing set --advertise-exit-node

2. In the console, open its ⋯ → Edit routes…, tick Use as exit node and save.
3. On Windows, right-click the tray icon → Exit node and pick the machine. On Linux:

   sudo mae-routing set --exit-node=office-gw --exit-node-allow-lan-access

   Use --exit-node= with no value to stop.

DNS and MagicDNS

With MagicDNS on (the default), every machine can reach the others by name: machine-name or machine-name.your-network.mae.internal. The resolver runs on every machine at 10.77.77.77.

On the DNS page of the console you can also set:

• Nameservers for every machine, and whether they replace the machine's own DNS.
• Split DNS: send queries for an internal domain such as corp.local to your own DNS server.
• Search domains and extra records that name any IP address, even one without the app.

Changes reach every machine within seconds. If a Linux machine runs another VPN that also manages DNS, run sudo mae-routing set --accept-dns=false on one of them.

Access controls

A new network lets every machine reach every other machine. To narrow that down, edit the policy on the Access controls page. The policy is HuJSON (JSON that allows comments and trailing commas). Once it has rules, anything they do not allow is blocked.

{
  // who belongs to which group
  "groups": { "group:dev": ["alice@example.com", "bob@example.com"] },
  // who may put which tag on a machine
  "tagOwners": { "tag:server": ["group:dev"] },
  "acls": [
    // developers reach servers on SSH and HTTPS only
    { "action": "accept", "src": ["group:dev"], "dst": ["tag:server:22,443"] },
    // everyone reaches their own machines
    { "action": "accept", "src": ["autogroup:member"], "dst": ["autogroup:self:*"] }
  ]
}

Press Check to validate, then Save. The page has more examples, including auto-approving routes and SSH rules.

Tags

A tagged machine belongs to its tags instead of to a person, which suits servers. Tags can be used in access rules, and keys of tagged machines do not expire.

1. Declare the tag and who may use it in tagOwners.
2. Tag a machine from ⋯ → Edit tags…, or create an auth key with the tag so new machines get it when they join.

Auth keys

Auth keys let machines join without a browser: servers, containers and CI jobs. Create them in Settings → Auth keys.

sudo mae-routing up --org your-network --auth-key=hskey-auth-…

The key is shown once. You can revoke it at any time.

SSH

MAE Routing can run the SSH server for a Linux machine, using your network identity instead of SSH keys.

1. On the Linux machine: sudo mae-routing set --ssh
2. From another machine in the network: ssh user@machine-name

By default, members can SSH into their own machines after confirming in the browser: the session prints a link, you sign in and approve. Change who may SSH where in the ssh section of the access controls.

Key expiry

Machine keys expire after 180 days by default, after which the machine must sign in again. Change the period (1 to 365 days) in Settings; it applies to machines that sign in afterwards.

For servers, turn expiry off with ⋯ → Disable key expiry on the machine. To sign a machine out right away, use ⋯ → Expire key now.

Command line

On Windows, run these in Command Prompt as Administrator. On Linux, use sudo for commands that change settings.

Addresses and ports

MAE Routing uses its own address range, port, routing table (77) and firewall chains (mr-*), so it can run on the same machine as other mesh VPNs that use 100.64.0.0/10.

Plans and limits

A network on the Free plan holds 3 machines, with unlimited users and every feature. When it is full, a new machine is refused with the message “this network has reached its limit of 3 machines”; machines already in the network are not affected. Paid plans have no machine limit: see the pricing page. The owner upgrades in Settings → Plan.