Description
- This article provides an overview of Mesh Network features for administrators.
Notes
- The content of this article is based on product specifications as of August 2026 and is subject to change without notice.
- Before use, please confirm that your environment meets the Mesh Network requirements by referring to the following article.
HENNGE One System Requirements
Table of Contents
Mesh Network Overview
HENNGE Mesh Network is a next-generation network solution that establishes direct mesh communication between devices to build a zero trust environment, without the need for dedicated VPN appliances.
It enables you to define a new virtual network without affecting your existing network configuration, allowing secure communication between devices and servers participating in the network.
Since no changes to the network environment are required, it is easy to implement and allows for a small-scale rollout starting from specific departments or locations.
How Mesh Network Works
Mesh Network uses Carrier-grade NAT (CGNAT), and when you join the network, a dedicated CGNAT range IP address is assigned.
This allows participating devices to communicate smoothly as if they were on the same local network, regardless of their physical location.
While maintaining the convenience of being on the same network, you can configure granular access control based on source, destination, and port, ensuring robust access security.
Access control rules can be centrally managed from the cloud management console, and settings are pushed to each device in real time, enabling administrators to apply policies quickly with minimal operational burden.
Mesh Network Components
ACL (Access Control List)
You can configure access permission rules for users, resources, and groups using Mesh Network, on a per-port basis.
All communication not defined in the ACL is blocked.
By granting only the minimum necessary access permissions to users, you can minimize the impact even if unauthorized access occurs.
ACL Components
Items that can be specified as source/destination
- Users
Users who have logged in to the client and are using Mesh Network.
By specifying users, you can assign the same access rules to any device they log in to. - Resources / Devices
Devices or servers using Mesh Network with the agent installed. - Fleet / Group
A collection of servers or users using Mesh Network.
A collection of servers is called a fleet, and a collection of users is called a group.
Administrators can configure ACLs for each fleet or group.
By using the fleet/group feature, you can collectively manage multiple devices, such as users in the same department or company-wide ACLs.
Items that can be specified as connection ports
- All
Specifies all TCP/UDP/ICMP protocols.
Ports can be specified as "All," "Specific port," "Multiple ports," or "Port range." - TCP
Specifies TCP and ICMP.
Ports can be specified as "All," "Specific port," "Multiple ports," or "Port range." - UDP
Specifies UDP and ICMP.
Ports can be specified as "All," "Specific port," "Multiple ports," or "Port range." - ICMP
Specifies only ICMP.
Subnet Linker
For servers where the Runetale agent cannot be installed for various reasons, you can access servers under the subnet linker via Mesh Network.
For more details, please refer to the following article.
[Mesh Network] Subnet Linker Details
Split DNS
Split DNS is a feature that allows you to query only specified domains to a specific DNS server, such as an internal domain controller.
For example, if you configure Split DNS as shown below, name resolution for hennge.local will be performed on the Mesh Network, while all other communication will use the existing internet route.
For more details, please refer to the following article.
[Mesh Network] DNS Details