---
title: "SSH and User-mode IP WireGuard"
description: "Fly.io’s SSH feature addresses the need to access applications running in Firecracker micro-VMs without requiring users to build containers with an SSH service or install WireGuard. The first part uses 6PN, a private IPv6-based network routed across Fly’s WireGuard mesh, and Hallpass, a small Go SSH server bound to each instance’s 6PN address. Authentication relies on an organization’s root SSH certificate published in private DNS, while the API signs short-lived user certificates. To support users without WireGuard installed, flyctl combines wireguard-go’s userland protocol with gVisor’s user-mode TCP/IP stack, allowing ordinary Go networking code and DNS resolution to operate over the private network. The resulting certificate-based SSH path is built into flyctl and reaches internal DNS names such as dogmatic-potato-342.internal, although the user-mode implementation is substantially slower than kernel TCP/IP."
---

# SSH and User-mode IP WireGuard

[Fly.io](https://yomu.fyi/company/fly-io) · Mar 1, 2021

**Type:** Explainer

## Summary

Fly.io’s SSH feature addresses the need to access applications running in Firecracker micro-VMs without requiring users to build containers with an SSH service or install WireGuard. The first part uses 6PN, a private IPv6-based network routed across Fly’s WireGuard mesh, and Hallpass, a small Go SSH server bound to each instance’s 6PN address. Authentication relies on an organization’s root SSH certificate published in private DNS, while the API signs short-lived user certificates. To support users without WireGuard installed, flyctl combines wireguard-go’s userland protocol with gVisor’s user-mode TCP/IP stack, allowing ordinary Go networking code and DNS resolution to operate over the private network. The resulting certificate-based SSH path is built into flyctl and reaches internal DNS names such as dogmatic-potato-342.internal, although the user-mode implementation is substantially slower than kernel TCP/IP.

## Context

Fly did not initially provide an SSH feature because its platform focused on edge applications, but users increasingly ran complete applications and service clusters on it. Requiring customers to add an SSH service to their containers was not considered an appropriate solution, and some users also lacked WireGuard installed on their machines.

## Approach / What changed

Fly starts Hallpass on each Firecracker micro-VM and binds it to the instance’s 6PN address. Organization root SSH certificates are published in private DNS, while the API signs user certificates. For clients without WireGuard, flyctl uses wireguard-go with gVisor’s user-mode TCP/IP implementation, exposing a net.Dialer and DNS resolver that operate over the private network.

## Takeaways

- Hallpass authenticates through short-lived SSH certificates signed by Fly’s API, with an organization-level root certificate provisioned in private DNS rather than distributing login keys to instances.
- wireguard-go’s userland protocol alone does not provide TCP connectivity; combining it with gVisor’s buffer-based TCP/IP stack lets standard Go networking code communicate over the WireGuard network.
- User-mode IP WireGuard is substantially slower than kernel TCP/IP, but the implementation can be used for SSH and similar tasks where installing a native WireGuard interface is impractical.

**Tags:** [Go](https://yomu.fyi/topic/go), [SSH](https://yomu.fyi/topic/ssh), [WireGuard](https://yomu.fyi/topic/wireguard)

- Source: [Fly.io](https://fly.io/blog/ssh-and-user-mode-ip-wireguard)
- Source URL: https://fly.io/blog/ssh-and-user-mode-ip-wireguard
- Ingested by Yomu: 2026-09-02T11:58:00.907Z

[Read original post](https://fly.io/blog/ssh-and-user-mode-ip-wireguard)