Fly.ioAnnouncement
Fly.io presents WireGuard Peering as a way to connect applications running on its platform privately to AWS, GCP, or other networks, while preserving automatic communication among apps in an organization. Each organization receives a private IPv6 network called a 6PN, with addresses encoding organization, host, and instance identifiers; BPF enforces isolation, and internal DNS resolves app, regional, and peer names. Because WireGuard’s cryptokey routing does not allow overlapping Allowed IPs, Fly swaps the address’s network and host chunks before and after routing, giving the mesh non-overlapping prefixes without changing IPv6 checksums. Users create regional peer configurations with flyctl wireguard create, receiving /120 delegations and organization-specific DNS. The post says this works for database gateways such as an AWS RDS setup, direct app-instance access, and arbitrary services, with connectivity remaining direct between nodes.
Fly.io wanted to make it straightforward to run and connect more than conventional web applications on its platform. The design also addresses WireGuard’s restriction that peer Allowed IPs cannot overlap, which conflicts with a 6PN prefix spanning multiple hosts.
Fly.io assigns each organization a private IPv6 6PN and embeds organization, host, and instance information in addresses. BPF enforces 6PN isolation and swaps network and host address chunks around WireGuard routing. Internal DNS provides service discovery, while flyctl wireguard create generates peer configurations for external networks and devices.
Each Fly.io organization has a private 6PN, with every app instance receiving a /112 delegation; the organization has an effective /48 prefix.
BPF swaps the host and network portions of IPv6 addresses before and after WireGuard routing, avoiding overlapping Allowed IPs while leaving IPv6 checksums unchanged.
WireGuard peers receive /120 delegations, organization-specific DNS, and names under _peer.internal; an AWS gateway can connect outward without exposing management services on the AWS side.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
BPF is not one hook but a set of attachment points, and each one sees different traffic. This diagram maps XDP, TC, socket-level BPF LSM, and sched_ext so you can pick the layer that can actually enforce your rule.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
