What does the full network look like?

A Waveshift deployment is three concentric layers: customer devices on one side, the AWS-hosted control plane and per-region egress VPCs in the middle, and the public internet (plus an optional Cloudflare WARP hop) on the other. Every user-traffic path is a WireGuard tunnel; the control plane talks to peers over the same WG fabric.

Reading the diagram

• Customer side (left) — a Site with a Control Hub, tethered Nodes, and an ops-room tablet; plus detached Nodes and remote users (laptops, phones) that don't share a Hub.
• AWS (middle) — a single home region holds the Orchestrator and supporting services (Route 53 private zone, SSM, Kasm). Each enabled region gets its own VPC peered to home, hosting one or more Egress Servers.
• Destinations (right) — the Egress Server's Elastic IP is what every destination sees. Cloudflare WARP is an optional final hop, toggled per Egress Server.

See also

• Concepts → How Waveshift works — same model in prose.
• How is traffic attribution managed? — what observers see at each point on the path.
• Console → Egress Servers — how users provision and manage their Egress Servers.