WireGuard VPN Networking
Secure your ephemeral previews behind a private mesh network.
Isolated Networking Layout
By default, Mag runtimes are completely hidden from the public internet. Preview environments communicate securely inside a private virtual mesh network powered by WireGuard.
Tunnel Architecture
When a deployment VM is provisioned, a secure WireGuard tunnel interface is created. The proxy router routes subdomain requests to the VM over the encrypted VPN interface.
Security Isolation
Because the VM only responds to traffic within the WireGuard interface, malicious users cannot scan ports or compromise exposed service endpoints on the public internet.