Telaron is an eBPF-native, managed NaaS fabric in the making — data-plane and transport-layer control across every cloud, above whatever underlay you run. A SaaS control plane sends configuration to an edge tier of gateways in your own central VPCs and receives their heartbeats — never your packet content. Orchestrating that tier for you, and attaching workload spokes through native CSP constructs, are coming. Your workload spokes stay untouched.
eBPF-native packet processing in the kernel.
The open-source gateway data plane carries traffic over kernel WireGuard and enforces policy in eBPF programs at XDP and TC, with the kernel networking stack intact — no DPDK NIC takeover, no fragile userspace packet path. Throughput figures will be published once they are measured.
Explore data planeOrchestration that never sees your packets.
The SaaS control plane (app.dev.telaron.io) handles configuration metadata and telemetry only — it physically cannot see customer packet content. It distributes intent to the edge tier, with per-tenant isolation enforced at the database. GitOps reconciliation is coming.
Explore control planeThe edge that carries the fabric — in your VPCs, not your apps.
Gateways form the edge tier, in your own central VPCs. The design is a Local Gateway (LGW) per spoke group and a Transit Gateway (TXGW) for cross-cloud transit, orchestrated by the SaaS; today a cluster’s role is recorded and its gateways mesh with each other. Workload spokes never run an agent, VM, or sidecar.
Explore gatewayHere is the architecture behind each outcome above, and which parts of it run today.
Gateways carry traffic over kernel WireGuard with ChaCha20-Poly1305 — no IPsec, and none of its ESP MTU headaches. Multi-tunnel WireGuard with CPU affinity is coming. Throughput figures will be published once they are measured.
Your workload spoke VPCs stay untouched — not an agent, not a VM, not a sidecar. The fabric runs in a separate edge tier of gateways in your own central VPCs. Orchestrating that tier for you, and attaching workload spokes through native CSP constructs, are coming.
An XDP program sheds abusive traffic at the NIC and a TC program enforces policy after decryption, both in the kernel with the networking stack intact. No DPDK NIC takeover, no fragile userspace packet paths.
Infrastructure-grade, not pod-grade. Gateways run as a service on a VM and work at the VPC and subnet level, so your workloads run however they run. Bare-metal gateways are coming.
Telaron is the control plane above the wire — not the wire itself. Gateways reach each other over WireGuard between routable addresses, so any path that carries IP will do. Coming: an orchestrator that provisions the underlay for you, including a managed cloud exchange (Equinix Fabric, Megaport) or AWS Interconnect’s free multi-cloud tier; spoke attachment through CSP-native constructs, GCP first; and replacing the cross-charging transit layers (AWS TGW, Azure Virtual WAN, GCP NCC) with no per-GB transit tax.
Everything Command Center does goes through a public REST API, and a Terraform provider covers clusters and spokes. Wider Terraform coverage, a Pulumi SDK and GitOps reconciliation are coming. No ClickOps traps, no console-only configuration.
The SaaS control plane handles configuration metadata and telemetry only — never customer packet content. An architectural property, not a policy promise. Documentable for compliance.
Community is free. Pro and Enterprise are priced per gateway for the mid-market. No per-spoke gateway VM compute today; removing CSP transit data-processing fees (AWS TGW, Azure Virtual WAN, GCP NCC) comes with cross-cloud transit.
One secure fabric across every cloud — identity-aware policy, encrypted end to end, and no agents in your workloads. Start on the free Community tier; no sales call to get going.
