LSI Addresses in the 1.0.0.0/8 subnet

Airwall products use the 1.0.0.0/8 subnet by default to route packets between protected devices. It then translates those addresses to the addresses and subnets you configure in Conductor.

These addresses are called Local Scope Identifiers (LSI), and they are cryptographically derived from the Host Identity Tag (HIT).

You can change it if you are sure of your settings. If you cannot, here are some caveats:

• These APs cannot use Cloudflare DNS, and they badly interfere with Airwall Agents.
• You cannot connect to anything on the 1.0.0.0/8 subnet. This includes Cloudflare's 1.1.1.1 DNS service. On Airwall Agents, it stops routing traffic to that subnet, despite being a split-tunnel. On Airwall Gateways, it routes to the LSI gateway, rather than out of your Internet gateway (provided you have one configured).
• There is also a tiny chance that that two Airwall Edge Services might end up colliding. If this happens (extremely rare!), factory reset your Airwall Gateway or delete your profile on your Airwall Agent to generate a new HIT.