Connect outward
Each node opens an authenticated outbound session to selected Atlas relays. CGNAT normally permits it; no inbound rule is required.
Managed CGNAT traversal for Nexus Atlas
Direct when possible. Connected throughout.
Let drones, vehicles, ground stations, and remote sites find and reach one another across 4G, 5G, and CGNAT—through a direct path when the network allows it, through authenticated relays when it does not, or through both for added resilience. No servers to rent, no port forwarding, and no networking degree required.
No public IP requiredNo inbound portsBuilt into Nexus Atlas
Relay firstBring up a usable path with outbound-only connectivity.
Direct upgradeRemove the relay hop whenever both networks permit it.
Direct + N relaysKeep additional measured paths available for resilience.
One Atlas tunnelCombine cellular paths with every other bearer.
The reachability gap
A modem can reach the internet without being reachable from another vehicle.
Why cellular endpoints are hard to reach
01
Carrier-grade NAT blocks inbound paths
Cellular providers share public addresses across many subscribers. Your node can send traffic out, but another endpoint cannot simply dial back in.
02
Mappings change while platforms move
Cell changes, reconnects and carrier policy can replace an endpoint without warning. Static address assumptions do not survive mobile operations.
03
Traditional failover chooses one path
A classic tunnel normally commits to direct or relay. Nexus Atlas keeps every usable path measurable and available to the same scheduler.
How it works
Reachable first. Direct when possible. Resilient throughout.
Traversal happens inside the Nexus Atlas data plane, so a change from relay to direct—or back again—does not rebuild the encrypted tunnel.
See the complete connection sequenceMeet immediately
The relay provides a working rendezvous path at once and lets the two endpoints exchange candidates safely.
Go direct when possible
The peers test the real network path together. If traversal succeeds, direct connectivity becomes another measured Atlas path.
Keep every useful path
Direct and multiple relay routes can stay available beside cellular, satellite, radio, Wi-Fi, mesh, or wired bearers.
One 4G or 5G bearer
The physical connection supplied by a cellular modem.
directprimary relaysecondary relay
Everything else the platform carries
Second carrier, satellite, tactical radio, Wi-Fi, mesh or wired.
One encrypted multipath tunnel
Applications see a normal Layer-3 connection while Atlas chooses how packets travel.
Two dimensions of resilience
More paths over cellular. More links beyond cellular.
A direct connection and several relay paths can coexist over a single modem. That cellular path set then sits beside every other physical bearer in the secure Atlas tunnel.
Important: “All available” does not mean “all carrying every packet.” Operators choose best-path, aggregation, duplication or strict-priority behaviour.
Policy, not hard-coded behaviour
Choose what resilience means for each deployment.
The same path inventory can optimize for latency, throughput, predictable failover or delivery confidence.
Best path
Send on the path with the lowest predicted delivery time and keep alternatives ready.
Aggregate
Distribute traffic across usable paths according to capacity and operator weights.
Duplicate
Replicate selected traffic across several paths when delivery confidence matters most.
Prioritize
Follow a strict operator-defined order for deterministic primary and fallback paths.
console.nexusatlas.net
See the console before you sign in.
Seven screens tell the whole story — the live fleet, enrollment, alerts, teams, the audit trail and the way in. Every screen is the real product, in your choice of light or dark.
Open the console
Self-service — enroll your first node in minutes.
Where reachability matters
Built for endpoints that do not stay put.
The traversal layer is useful wherever Atlas nodes must communicate through access networks they do not own or control.
LIVE PATH SET3 bearers · bonded
Autonomous systems
Drones, UGVs and ground stations using cellular beside dedicated radio, mesh or satellite links.
Explore scenarioNETWORK CHANGEhandover · tunnel intact
Mobile fleets
Vehicle-to-vehicle and vehicle-to-command connectivity as towers, networks and addresses change.
Explore scenarioCGNAT TRAVERSALoutbound only
Remote sites
Office-to-office and field infrastructure where fixed public IPs or inbound firewall changes are unavailable.
Explore scenarioNetwork
The relay network.
Atlas measures public relay candidates from both endpoints and selects the shared set that performs best—not simply the one with the nearest city label.
View live networkPublic footprintTwo regions serving today
As of August 2026EU-CENTRAL
Germany
Two observation addresses
Signed relay identity
NA-EAST
Canada
Two observation addresses
Signed relay identity
Next region
Where should the network expand?
Tell us what you need, where you need it, and why the location matters. Demand and operational constraints help us prioritize new relay capacity.
Private and on-premises
A relay estate reserved for your organization.
We can deploy dedicated nodes in an organization’s cloud, data centre, edge sites, or sovereign environment. Their addresses and identities can be pinned in customer configuration and kept entirely outside the public nexusatlas.net relay map.
Explore private deploymentSecurity & privacy
Built so the relay never has to see your payload.
Hosted relays forward encrypted Atlas frames. Trust comes from cryptographic identities and a signed relay inventory—not from an IP address or an operator promise.
Read the security modelEnd-to-end tunnel encryption
Inner IP packets, application payloads, video, telemetry, and command traffic remain encrypted between Atlas endpoints.
Pinned relay identities
Every relay must prove the static identity published in the signed map. Redirecting its address is not enough to impersonate it.
Offline map authority
The relay inventory is Ed25519-signed with an offline key, so a compromised serving control plane cannot forge trusted membership.
No customer payloads on disk
Relay sessions are disposable forwarding state. The hosted relay does not terminate or persist the encrypted Atlas tunnel payload.
A precise metadata boundary
Relays can observe outer addresses, authenticated identities, timing, liveness, and byte counts. We state that boundary plainly.
One product, six destinations
The Nexus Atlas website family.
Each property answers a different question without asking one page to serve engineers, buyers and operators at once.
nexusatlas.euBusiness
Deployment, procurement and partnership case.
nexusatlas.ioEngineeringArchitecture, product depth and technical evidence.
nexusatlas.devDevelopersQuickstart, configuration and API reference, evaluation access.
nexusatlas.netTraversalManaged CGNAT traversal and relay network.
console.nexusatlas.netOperationsEnroll nodes and inspect connectivity.
nexusatlas.appDownloadDownload Nexus Atlas for your platform.