VPN Overview

Complement reaches systems on a local network, such as a file server, ERP database, or CNC machines, through a VPN between that network and the organization’s Complement environment. This guide is for the network administrator.

How It Works

Each Complement organization runs in an isolated AWS environment. The VPN connects that environment to specific hosts on the local network. Only traffic between Complement and those hosts uses the tunnel, so office internet traffic is unaffected.

Complement can reach only the subnets or hosts provided to it. They are the only routes on the Complement side of the tunnel and the only destinations Complement services are allowed to connect to. The local firewall enforces which ports are reachable.

Disabling the VPN peer on the firewall disconnects Complement at any time. With Tailscale, removing the Complement device from the tailnet does the same.

WireGuard, IPsec, or Tailscale

• WireGuard is preferred on hardware that supports it, such as UniFi, pfSense, OPNsense, and MikroTik devices. The local side connects out to Complement, so it needs no static public IP and no inbound firewall rules.
• IPsec works with almost any business firewall, including Fortinet, SonicWall, Palo Alto, Cisco, and Meraki. It requires a static public IP and inbound UDP 500, UDP 4500, and ESP from the two Complement tunnel endpoints.
• Tailscale suits networks that already use it. The Complement gateway joins the tailnet as a tagged device, and the tailnet access rules control what it can reach. No firewall changes are required.

Step 1: Answer Basic Questions

Copy these questions into an email to support@complement.ai with the answers. Complement will recommend a connection type and follow up with the details it requires.

1. Router or firewall make, model, and firmware version:
2. Hosts Complement should reach (name, IP, port), e.g. file server, 192.168.1.20, 445:
3. Subnet those hosts are on, e.g. 192.168.1.0/24:
4. Is Tailscale already in use?

Give each host a static IP or DHCP reservation so its address doesn’t change.

Step 2: Configure the Connection

For WireGuard and IPsec, Complement provisions its side and sends a config sheet. For Tailscale, a tailnet admin creates an OAuth client and sends Complement its secret. Keys and secrets are always exchanged through a one-time secure link, never plain email. Then follow the guide for the chosen connection type:

WireGuard VPNHow to configure a site-to-site WireGuard VPN between a local network and Complement.

IPsec VPNHow to configure a site-to-site IPsec VPN between a local firewall and Complement.

Tailscale VPNHow to connect Complement to systems on a local network through Tailscale.

Limiting Access

Add firewall rules so traffic from the tunnel can reach only the hosts and ports provided to Complement. Nothing needs to connect from the local network to Complement, so allow only replies in that direction. If a host runs its own firewall, such as Windows Defender Firewall, allow Complement traffic on that port there too. WireGuard traffic comes from the Complement tunnel address, and IPsec traffic comes from the Complement network range. With Tailscale, use grants in the tailnet policy instead.

The tunnel controls which hosts Complement can reach. What Complement can do on each host depends on the accounts created for it. Use dedicated read-only accounts.