> For the complete documentation index, see [llms.txt](https://docs.sendman.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sendman.com/admin-portal/settings/network-connections.md).
# Network Connections
Connect your local networks to Sendman and use fixed egress IP addresses
## Overview
On the **Network Connections** page, you connect your local networks to Sendman through encrypted **WireGuard** or **IPsec** tunnels. Clients behind such a tunnel reach Sendman with their local IP address preserved, so you can allow-list and authorize them by their internal addresses. Over a tunnel, Sendman additionally accepts mail on port **25**.
The page also lets you deliver outgoing mail through dedicated egress gateways with fixed IP addresses.
The page consists of three sections:
* [Sendman egress](#sendman-egress): fixed IP addresses for outgoing mail
* [Sendman ingress](#sendman-ingress): which tunnels clients may use to reach Sendman
* [Connections](#connections): the WireGuard and IPsec tunnels themselves
## Sendman egress
{% hint style="info" %}
This section is only shown if dedicated egress gateways are available for your Sendman instance.
{% endhint %}
When you switch on **Deliver through the dedicated egress gateways**, Sendman delivers all mail to your [SMTP backend](/admin-portal/settings/smtp-backend.md) from the **Gateway addresses** listed in this section. You can then restrict your mail server to accept relayed mail only from these addresses, e.g. with an [Exchange Online connector](/configuration/get-started/scenario-based-guides/exchange-online.md#identify-sendman-by-ip-address).
1. Note the listed **Gateway addresses** and allow all of them at your mail server.
2. Switch on **Deliver through the dedicated egress gateways**.
3. Click **Save egress settings**. The change is applied after a short time.
The badge shows the current state: **Dedicated gateways** or **Default route**.
## Sendman ingress
Sendman always accepts mail from the internet on ports 465 and 587 at the public address shown in this section.
Additionally, you can select connections whose local clients may reach Sendman through the tunnel. Selected connections accept mail on ports 25, 465 and 587.
1. Tick the connections that shall be used for mail delivery.
2. Click **Save selection**. The change is applied after a short time.
The badge shows whether Sendman is reachable through the public endpoint only (**Public access only**) or additionally through local networks (**Public + n local networks**). Selected connections are marked **Enabled** in the connection list.
{% hint style="warning" %}
A connection that is part of the selection cannot be deleted. Remove it from the selection first.
{% endhint %}
## Connections
The connection list shows the **Type**, **Connection** name, **Endpoint** and routed **Customer subnets** of each tunnel. Click a row to see its details, e.g. the **Tunnel address** and how the connection is set up.
### Address plan
Every connection needs its own small transfer network, the **tunnel address**. We recommend a /30 from `169.254.0.0/16`:
| Purpose | Example |
| ----------------------------- | ------------------ |
| Transfer network | `169.254.100.4/30` |
| Sendman tunnel address | `169.254.100.5/30` |
| Your gateway's tunnel address | `169.254.100.6/30` |
| Your local network | `10.20.0.0/24` |
* The tunnel address is entered in the portal as Sendman's side, e.g. `169.254.100.5/30`. Allowed ranges are `169.254.0.0/16`, `192.168.0.0/16` and `172.16.0.0/12`, and every connection needs a different one.
* Your gateway uses the other address of the /30, e.g. `169.254.100.6`, and routes Sendman's tunnel address (`169.254.100.5/32`) through the tunnel.
* Your clients send mail to **Sendman's tunnel address**, e.g. `169.254.100.5`, on port 25, 465 or 587.
* Do not use NAT for traffic from your local network to Sendman. Sendman must see the clients' real addresses.
{% hint style="info" %}
Sendman's server certificate is issued for `YOURNAME.sendman.com`. Clients that verify the certificate name when connecting to the tunnel address fail the check. In this case, let `YOURNAME.sendman.com` resolve to the tunnel address in your internal DNS, and configure the clients with the hostname.
{% endhint %}
### Add a connection
Click **Add connection** and choose **WireGuard** or **IPsec**. A wizard guides you through three steps: **General**, **Tunnel** and **Routing**. Follow the guide for your tunnel type:
{% content-ref url="/pages/GHGxrIZzErYVyS14l2oN" %}
[WireGuard](/admin-portal/settings/network-connections/wireguard.md)
{% endcontent-ref %}
{% content-ref url="/pages/XyUPSdZ4UBTGfd50bIPi" %}
[IPsec](/admin-portal/settings/network-connections/ipsec.md)
{% endcontent-ref %}
After saving, the tunnel is set up after a short time. Then select the connection under [Sendman ingress](#sendman-ingress) and add your local network to the [IP Allow List](/admin-portal/sendman/ip-allow-list.md).
### Delete a connection
Click the delete icon of a connection and confirm. The tunnel to this site is torn down and clients behind it can no longer reach Sendman.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.sendman.com/admin-portal/settings/network-connections.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
