Quick Start

This walkthrough takes an installed, activated node and gets a workload onto a managed network with DHCP, DNS, and a firewall policy — end to end.

If you have not installed the agent yet, start with Installation.

1. Define a network

A network is a managed private network: an IP CIDR whose usable host addresses are each materialized into an endpoint profile (an IP paired with a generated MAC). Create one with the CLI:

sudo cenvero-str-ctl network create \
  --name app-net \
  --cidr 10.20.0.0/24 \
  --gateway 10.20.0.1

Stratum allocates the segment on the workload bridge, starts a DHCP server for the pool, and serves authoritative DNS for the network's zone.

List what you have:

cenvero-str-ctl network list

{
  "data": {
    "networks": [
      {
        "id": "net-069088314b4e4712",
        "name": "app-net",
        "cidr": "10.20.0.0/24",
        "gateway": "10.20.0.1",
        "vlan": 0,
        "tenant_id": "",
        "created_at": "2026-07-24T20:53:31Z"
      }
    ]
  },
  "status": "ok"
}

Note the generated id — the other network commands refer to a network by that id, not by its name.

2. Attach a workload to an endpoint

Claim a free endpoint for your workload. Stratum returns the endpoint's IP and a generated MAC, wires it into the bridge, and programs the data plane (including the IP↔MAC anti-spoof binding) for it:

sudo cenvero-str-ctl network attach net-069088314b4e4712 --ip 10.20.0.50

Configure your workload's interface with the returned MAC and it picks up the endpoint's IP from DHCP, a working default gateway, and DNS — no guest agent required.

cenvero-str-ctl network endpoints net-069088314b4e4712

{
  "data": {
    "endpoints": [
      {
        "id": "ep-3f2a91c7",
        "network_id": "net-069088314b4e4712",
        "ip": "10.20.0.50",
        "mac": "52:54:00:ab:cd:01",
        "state": "bound"
      }
    ]
  },
  "status": "ok"
}

3. Add a firewall policy

Each firewall rule is a single JSON object. Allow inbound HTTP and HTTPS to the endpoint, and let it reach out. Ports are matched one at a time, so HTTP and HTTPS are two rules:

sudo cenvero-str-ctl firewall allow '{"chain":"forward","dest_ip":"10.20.0.50","protocol":"tcp","dest_port":443,"stateful":true}'

sudo cenvero-str-ctl firewall allow '{"chain":"forward","dest_ip":"10.20.0.50","protocol":"tcp","dest_port":80,"stateful":true}'

sudo cenvero-str-ctl firewall allow '{"chain":"forward","source_ip":"10.20.0.50","stateful":true}'

"stateful": true puts the flow in the connection-tracking table so return traffic is admitted automatically. See Firewall for the full policy model and every rule field.

4. Define a load-balanced VIP

Declare an L4 virtual IP, then attach a backend to it so you can scale horizontally later:

sudo cenvero-str-ctl lb create '{"id":"web-lb","frontend_ip":"10.20.0.10","frontend_port":80,"protocol":"tcp","algorithm":"least-conn"}'

sudo cenvero-str-ctl lb add-backend '{"vip_id":"web-lb","id":"web-1","ip":"10.20.0.50","port":80,"weight":1}'

Add and remove backends live with lb add-backend / lb remove-backend. See Load Balancer.

5. Confirm

cenvero-str-ctl status

You now have a workload on a managed network with DHCP, DNS, a firewall policy, and a load-balancer VIP defined — all from one agent.

Where to go next

• Configuration — the node configuration model in depth.
• Clustering Overview — stretch the network across hosts.
• CLI Reference — every command in one place.