Skip to content
MZPanel MZPanel
Private network Link your servers and devices over an encrypted WireGuard mesh, with per-peer keys generated at the edge.
CtrlK

Private network

The Private network page (app.mzpanel.com/network) turns your scattered VPS fleet — different providers, different public IPs — into one flat, encrypted internal network (mesh IPs like 10.66.0.x). Use it for database replication, internal APIs, monitoring, and cross-server backups without exposing a single port to the Internet; laptops, phones, and CI runners can VPN in to reach the same internal services. It’s gated to the Pro plan or higher.

Add a peer, step by step

Section titled “Add a peer, step by step”
  1. Click Add peer to open the drawer.
  2. Choose the Peer type: a Server from your fleet, or a Device (laptop, phone, or CI runner).
  3. For a server: pick one of your connected VPS from the list. Only managed (agent-installed) servers that aren’t already in the mesh appear here.
  4. For a device: give it a Device name, pick the Device kind, and optionally flip Route all traffic on for a full-tunnel VPN (send the device’s whole internet egress through the mesh instead of just the private subnet).
  5. MZPanel assigns the next free mesh IP automatically — you’ll see auto with the subnet it’ll draw from.
  6. Click Add peer. A server peer flips from Pending to Online once its real WireGuard handshake lands. A device peer opens its config drawer right away with a QR code and a wg0.conf block to import.

What else you can do

Section titled “What else you can do”
  • Overview card — the mesh name, its /24 subnet, the WireGuard listen port, and tiles for total peers, online count, and the port. A status pill reads All connected, Converging, or Empty.
  • Peers list — one row per peer showing kind (server/device), mesh IP, endpoint, last handshake, live transfer counters (↓ received / ↑ sent), and a status pill (Online, Pending, Offline).
  • Show config (QR icon) — reopen a peer’s config drawer. For a server it shows an informational interface block (the real private key stays on the box); for a device it shows the tunnel config only if you still have this session’s once-shown key.
  • Remove peer (trash icon) — revoke a peer across the whole mesh. A server peer is told to tear its wg0 down but keeps the WireGuard engine installed so it can rejoin later; other peers stay connected.

How it works

Section titled “How it works”

The mesh is a hubless WireGuard full-mesh: every peer opens a tunnel directly to every other peer. The MZPanel control plane is only the coordinator — it distributes config but never sits on the data path, so it can’t see or relay your traffic.

  • Control plane (/v1/network, org-scoped) owns the mesh definition and peer set in Postgres. Every membership change bumps a generation and reconciles: it pushes the desired peer-set to each online server peer as a wireguard.apply job.
  • Server peers receive that job and run natively: the agent renders /etc/wireguard/wg0.conf from the spec and applies it non-disruptively with wg syncconf on the live interface, so existing tunnels keep their handshakes and only the added/removed peers change. It opens UDP 51820 (best-effort ufw allow) and enables wg-quick@wg0. The box’s private key is generated on the box (wg genkey, stored 0600) and never leaves it — the agent reports back only its public key and live link-state via the mesh inventory.
  • Device peers are keyed in your browser. Only the public key is sent up; the config + QR are rendered client-side from the server peers’ public keys and endpoints.

The result: the control-plane database holds no mesh secret of any kind — only public keys (~32 bytes each) and metadata. Even a full database compromise can’t decrypt your traffic or impersonate a peer.

Each account gets one /24 subnet (10.66.0.0/24, ~253 usable peers) — far more than any tier’s VPS quota needs.

API & automation

Section titled “API & automation”

The mesh is a control-plane resource, so it’s driven by the account API rather than a single box’s mz CLI. On the Max plan you can script it against /v1/network (get the mesh + free servers, POST /v1/network/peers to add, DELETE /v1/network/peers/:id to remove, POST /v1/network/reconcile to re-push).

On an individual server you can still inspect its side of the tunnel with the on-box read mz wireguard show --json (the same data the agent reports up). The mutating mz wireguard apply / down commands take an opaque control-plane spec and aren’t meant to be run by hand. See the HTTP API and The mz CLI.

Gotchas & troubleshooting

Section titled “Gotchas & troubleshooting”
  • This page is live. Server and device peers, key generation, reconcile, and removal are all real end-to-end.
  • Only managed servers can join. SSH-only (“Lite”) servers and any box already in the mesh are excluded from the add-peer list — the mesh needs the agent to render and sync wg0.conf.
  • A new peer sits at “Pending” briefly. It flips to Online only after the first real WireGuard handshake; give it a moment, and make sure the server peer’s UDP 51820 is reachable.
  • Device config is one-shot. The private key is generated in your browser and never stored — if you close the drawer without saving it, remove and re-add the device. Reopening Show config on an old device can only show the informational block, not a usable key.
  • Removing a server keeps the engine. Removal revokes the mesh membership and tears the interface down, but leaves WireGuard installed so the box can rejoin.
  • Pro+ only. On Free/Plus the page shows an upgrade prompt instead of the mesh.
Section titled “Related”