Overlay addresses
Every device gets a stable address on the overlay network, assigned by the management service and unrelated to whatever network the machine is physically on.
When a machine enrols, the management service assigns it an address from the organization's overlay range, the block of addresses its devices share, and records it against the device. The address is stable: it survives reboots, network changes and moving between countries. It is the address other devices use to reach the machine, and the one its DNS name resolves to. The apps show it on Shield as Tunnel address (IP address on iPhone), and list under Devices the address of each device in this device's network map.
The overlay lives inside 100.64.0.0/10, the shared address space reserved by RFC 6598 for carrier-grade NAT. Each organization is given one /16 out of it, chosen at random - 100.72.0.0/16, for example - and each device gets a random free address inside that /16. That space is used because it is unlikely to collide with a LAN, a VPC or a Docker bridge you already run.
What an overlay address is and is not
| Property | Behaviour |
|---|---|
| Scope | The organization. Each organization holds its own /16, picked at random inside 100.64.0.0/10. |
| Allocation | A random free address inside the organization's /16, not the next one in sequence. |
| Stability | Assigned once at enrolment and kept for the life of the device record. Deleting and re-enrolling a device may produce a different address. |
| Routability | Not routable on the public internet. It only means anything inside the overlay. |
| Relationship to the LAN | None. A laptop keeps its overlay address whether it is on office Wi-Fi, a hotel network or a phone hotspot. |
| Interface | Bound to the tunnel interface the client creates. The CLI agent uses sx0 on Linux and utun217 on macOS. The macOS app gets a utun interface the system assigns, and the Windows app an adapter named SXAccess. On iOS and Android the system provides the VPN interface. |
Use names, not addresses
Every device also gets a DNS name inside the organization's internal domain, derived from its hostname. Reaching build-server by name is more durable than remembering an address, and it is what the routing and DNS features assume.
An organization can set its own internal domain: open Organization settings from the organization menu, fill in Internal domain and choose Save organization details. Use a domain you control, such as corp.example.com, and devices resolve as build-server.corp.example.com. See Organization settings.
Look up an address with the CLI
On a device with the CLI, sxaccess info shows its overlay address on the Address row, and sxaccess info --ipv4 prints only the address, for scripts. sxaccess info -d lists the devices in this one's network map, each with its address.
sxaccess infosxaccess info --ipv4sxaccess info -d