1. Enroll and bootstrap both routers. In Devices → Settings → Edit, accept the SSH fingerprint and test SSH. Open Devices →
2. In Sites, choose Connect two sites. The left router (Site A) always initiates toward the right router (Site B). Choose Site B’s reachable IP/DNS and UDP port. Private routed addresses also work when reachable.
3. Site A can be behind NAT or CGNAT because it initiates outward. Site B needs a reachable address; if it is behind NAT, forward its UDP port.
4. Create the connection. coromesh allocates interface names, keys and tunnel addresses. Both data interfaces start in the default routing table; a VRF is optional. Open Sites →
5. Open Settings and choose Push both routers. coromesh applies and verifies Site B first, then Site A. Click Test Link to ping across the tunnel from Site A, then Site B; the results are saved in Link test history.

OSPF and BGP stay configured on the routers. Optional static LAN prefixes are available under the connection's advanced settings.

1. Open the link Settings → Assign VRF.
2. Select an unused VRF definition or create one with a name and VyOS table ID. RouterOS uses the name; VyOS also uses the numeric table ID. Open VRF →
3. Choose whether the VRF applies to both routers, the left router only, or the right router only. List existing LAN/VLAN interfaces only for the selected router(s); coromesh assigns the link's WireGuard interface automatically.
4. To detach it later, choose Remove VRF in Settings and select one or both routers. Save, review, then push both routers to move the selected interfaces back to the default routing table.
5. Preview and push router configurations after changes. Moving interfaces changes their routing table and can interrupt data traffic.

This Alpha release supports one VRF per site link and one site link per VRF. A WireGuard interface belongs to one routing table. To connect the same routers through another VRF, create another site link; coromesh creates a separate WireGuard tunnel. Removing an assignment deletes the coromesh-created router VRF on selected routers, but keeps the VRF definition in coromesh. OSPF and BGP stay configured on routers. LAN/VLAN interfaces must already exist; firewall and forwarding rules remain your responsibility.

Build additional pairwise links for additional routers. Existing Full mesh and Hub and spoke networks retain their original peer relationships. For NAT branch A ↔ public router ↔ NAT branch B, create a separate link from each branch to the reachable router and configure inter-branch routing there.

SSH management reaches enrolled routers through their control VPN. Live data-tunnel health is not collected. Layer 2 bridging, IPv6, automatic NAT hole punching and automatic failover are outside this Alpha release.

• Not pushed: the desired configuration exists only in coromesh.
• Applying: coromesh sends the script, then opens a fresh SSH connection to read the router state.
• Acknowledged: the independent check found the expected interface, address, peer keys and active routes. Cleanup similarly checks that managed resources are absent. Acknowledgment does not prove a WireGuard handshake or end-to-end traffic.
• Update needed: the desired revision changed after the last verified push. Preview and push that router again.
• Not confirmed: the command or its independent check failed. The router may have partially changed. Read the reported remaining resources and retry only after reviewing the router.

Exporting a configuration does not mark it as applied. Check both routers' status before testing the link.