Tunnel addresses
Every device gets a stable address on the tunnel network, assigned by the control plane and unrelated to whatever network the machine is physically on.
When a machine enrols, the control plane assigns it an address from the organization's tunnel range, the block of addresses its devices share, and records it against the device. The address is stable: it survives reboots, network changes and moving between countries. It is the address other devices use to reach the machine, and the one its DNS name resolves to. The apps show it on Shield as Tunnel address (IP address on iPhone), and list under Devices the address of each device in this device's network map.
Tunnel addresses come from the shared address space that RFC 6598 reserves for carrier-grade NAT. Each organization is given one /16 out of it, chosen at random - 100.72.0.0/16, for example - and each device gets a random free address inside that /16. That space is used because it is unlikely to collide with a LAN, a VPC or a Docker bridge you already run.
What a tunnel address is and is not
| Property | Behaviour |
|---|---|
| Scope | The organization. Each organization holds its own /16, picked at random from the RFC 6598 shared address space. |
| Allocation | A random free address inside the organization's /16, not the next one in sequence. |
| Stability | Assigned once at enrolment and kept for the life of the device record. Deleting and re-enrolling a device may produce a different address. |
| Routability | Not routable on the public internet. It only means anything inside the tunnel network. |
| Relationship to the LAN | None. A laptop keeps its tunnel address whether it is on office Wi-Fi, a hotel network or a phone hotspot. |
| Interface | Bound to the tunnel interface the client creates. The CLI agent uses sx0 on Linux and utun217 on macOS. The macOS app gets a utun interface the system assigns, and the Windows app an adapter named SXAccess. On iOS and Android the system provides the VPN interface. |
Use names, not addresses
Every device also gets a DNS name inside the organization's internal domain, derived from its hostname. Reaching build-server by name is more durable than remembering an address, and it is what the routing and DNS features assume.
An organization can set its own internal domain: open Organization settings from the organization menu, fill in Internal domain and choose Save organization details. Use a domain you control, such as corp.example.com, and devices resolve as build-server.corp.example.com. See Organization settings.
Look up an address with the CLI
On a device with the CLI, sxaccess info shows its tunnel address on the Address row, and sxaccess info --ipv4 prints only the address, for scripts. sxaccess info -d lists the devices in this one's network map, each with its address.
sxaccess infosxaccess info --ipv4sxaccess info -d