Use case · Internet breakout
Send internet traffic through the firewall you trust
Choose where your fabric meets the internet — your existing perimeter firewall, or a site you nominate as the exit — and every branch follows.
The problem
Security teams want one place where internet traffic is inspected. But a default route pushed into a branch router is the most dangerous route there is: get it wrong and the encrypted tunnels follow it too, and the branch cuts itself off along with the means to fix it.
How Weft does it
- The default route lives only inside your network's own routing table, never in the table that carries the tunnels. It cannot capture the links that deliver it.
- A perimeter site hands off to your firewall over a routed port, exchanging routes by OSPF or eBGP if you want.
- Or a site is the exit. Any site can be made the internet exit for the fabric, including one in a cloud region.
- Remote staff can follow it too. A roaming client set to full tunnel sends its internet traffic the same way.
- Exceptions are named. Microsoft 365 can still leave locally while everything else goes through the firewall.