Service Endpoints

NetDefense’s documentation mentions three netdefense.io hostnames. Which one you see depends on which component you are configuring: the device-side agent and the command-line client do not point at the same address, and neither is a stale name for the other. This page lists all three in one place.

The endpoints

Endpoint	Component that connects to it	What the connection is for	Where it is configured
https://hub.netdefense.io	NDAgent (the OPNsense plugin)	Device registration, configuration sync, and management	OPNsense → Services > NetDefense > Settings > Advanced > Server Address
https://control.netdefense.io	ndcli and netdefense-mcp	Control Plane REST API — every command you run	controlplane.host in config.yaml, or NDCLI_CONTROLPLANE_HOST
https://pathfinder.netdefense.io	NDAgent and ndcli	The relay that carries remote access sessions opened with ndcli device connect — both ends of the tunnel connect to it	Device side: OPNsense → Services > NetDefense > Settings > Advanced > Pathfinder Address Client side: pathfinder.host in config.yaml, or NDCLI_PATHFINDER_HOST

Notes

• hub and control are both current. Seeing one in the NDAgent docs and the other in the NDCLI docs is expected. They are separate settings on separate components, each with its own default and its own override — not two names for one setting.
• Each address is independently overridable, which is what a self-hosted deployment does: the agent’s Server Address and Pathfinder Address are set per device in the OPNsense settings page, and ndcli’s host is set per client in config.yaml.
• The relay is the one endpoint both ends reach, and both ends configure it separately. ndcli device connect opens a tunnel through PathFinder to the device’s NDAgent, so the client and the device each connect to it — and each has its own overridable setting for the address. Point both at the same relay or the tunnel has no meeting point. The client-side value uses the WebSocket scheme (wss://pathfinder.netdefense.io), the device-side one is written https://.
• Each endpoint has its own SSL-verification toggle on the agent side (SSL Verification, TOFU Key Fetch SSL Verification, and Pathfinder SSL Verification), and controlplane.ssl_verify on the client side.

Note

Connectivity problems on the device side are almost always about hub.netdefense.io — that is the address the agent needs before anything else works. The NDAgent troubleshooting guide has the reachability checks.