A Rust daemon that links your machines into one private network, encrypted end to end, with no server in the middle.
Any node can seed any other. There is no registry to sign up to and no server to run.
On the machine inside your home network — the one that will be your exit — and on every device that should reach it.
On one network there is nothing to configure: nodes broadcast a signed beacon every 30 seconds on 2270/UDP and connect to whatever they hear.
Across the internet, give each node a rendezvous point — a DNS name you control that resolves to the machines you trust…
… or the public address of any node already in the mesh:
Every node runs a console. Point one at another and the handshake runs:
Peers that complete a handshake are written to peers.cache and retried next start, so the mesh rebuilds itself after a reboot.
A client node opens a SOCKS5 proxy locally. Point a browser or a terminal at it and the traffic takes the mesh:
An exit node makes the real outbound connection, and serves nobody until you say who may ask:
Use any instead of a fingerprint to open it to every node that completes a handshake. Bind 2271, not 2270: that port belongs to the discovery beacon.
Identities are self-signed, so anyone can make one. Set the same 32-byte secret on every node you own and a handshake can only complete between them:
Addresses are never trusted. A node is its Ed25519 fingerprint, and a peer that reconnects from a new address is re-anchored to the same identity rather than treated as someone new.
Whether you send one byte or four hundred. Select a field for its bounds.
Truncated session identifier, also mixed into the AEAD nonce so nonces never collide across sessions.