PLY
Talk to us
EN

Capabilities

The network itself runs over several paths, not one application

Five things that separate transport at the IP layer from a proxy and from ordinary link bonding.

Transparent VPN

VPN / 01

Any permitted IP traffic, with no client inside the application

A full tunnel or selected routes run through utun. IPv4 and IPv6, TCP, UDP, DNS, ICMP, and the other permitted protocols all live inside. The transport's own endpoint is excluded from the tunnel, and excluded strictly: if that rule fails, the connection drops instead of leaking around it.

  • A system interface instead of a SOCKS or HTTP proxy
  • An explicit MTU and the transport's own fragmentation
  • Raw IP is graded from its own header, and under a tight deadline the bulk class is what yields

Multipath and failover

PATH / 02

A path is live only once its actual exit is verified

Binding a socket to an address is not enough. PLY separates PROBING, ACTIVE, MUTED, and DEAD, confirms that links are independent by probing them, and never passes two rows in a table off as two physical paths.

  • Probes reach the server from different public addresses
  • Failover survives Wi-Fi changes and cellular handover
  • The counters show up in the client and in Prometheus on the server

Bandwidth or losses

MODE / 03

Three steps, and you can see what each one costs

Several links buy two different things: more bandwidth, or fewer losses. balanced leaves the mechanism and the number of copies to the allocator, worked out per message. copies-N puts a copy on the N best usable paths, N from 2 to 255. all-paths puts every message on every usable path, and costs bandwidth in proportion to how many there are.

  • balanced is the default, and derives redundancy per message rather than per class
  • Each direction is set on its own: [app] redundancy on the client, [egress] redundancy on the server
  • The wire carries no such field, so the return direction follows the server's setting and not a request from the client

Egress through the server

EGRESS / 04

Arbitrary TCP and UDP leave from the server's address

The server holds a persistent TUN and decides what to do with each packet: send it through an uplink with the address rewritten, or route it onward untouched.

  • One data path serves both modes
  • Policy is written as a list of networks, not a set of ports
  • Changing rights revokes the old session instead of waiting it out

Access and observability

POLICY / 05

L3 rights are granted separately and checked on every packet

A device receives a fixed address, one permitted mode, and a list of networks. A packet whose source does not match the issued address does not get through.

  • Enrollment, key fingerprint, and rehandshake
  • Prometheus, an event log, traces, and an offline bundle
  • Crash data never leaves the customer's perimeter

Server modes

One data path, two ways to release traffic

forward

Permitted packets leave through a chosen uplink with MASQUERADE. From outside it looks like ordinary server traffic.

tun

The same data path routes packets onward with the addresses left alone. Use it when networks need joining rather than hiding.