Frequently asked questions
Questions
Is SkiMasque a VPN?
SkiMasque grants access to specific destinations for a bounded session.
SkiMasque provides temporary, identity-aware network access rather than making a user or workload a permanent member of a private network.
Does traffic go through a SkiMasque gateway?
Yes.
The gateway is the network edge through which the authorized session reaches the destination.
Can the gateway run in my VPC?
Yes.
The customer-operated gateway model places the gateway inside the customer's infrastructure.
Do I need to change my firewall?
Customers still control their own network boundaries.
A customer-operated gateway can be allowed through existing firewall controls using its network identity/source address.
Does SkiMasque replace IAM?
No.
SkiMasque complements identity systems by using authenticated workload identity as an input to network authorization.
Does SkiMasque replace a VPN?
It can address some use cases commonly handled with VPNs, particularly temporary workload and developer access.
Whether it fits depends on the destinations, protocols and identities your workflow needs.
What happens if no policy matches?
The request is denied.
- NO MATCHdenied
- DENY
Does access expire?
Yes.
Credentials expire and exec closes its local tunnels when the command exits. Agent sessions also close active tunnels at expiry or once revocation reaches the gateway. Policy max_duration is currently metadata; it does not enforce a tunnel timeout for CI or developer credentials.
Can developers use it?
Yes.
The CLI supports local policy work, skimasque connect for a single tunnel, and skimasque exec --policy production -- terraform plan to run a command with access.
Can CI use it?
Yes.
The GitHub Action exchanges OIDC for a renewable credential. Dedicated Ubuntu runners can use transparent private TCP/UDP routing and split DNS; select mode: proxy for tools that honour HTTP, HTTPS or SOCKS proxies.