v0.10.0 · MIT License · 6 release targets

meshguard

Decentralized WireGuard-compatible mesh VPN.
Trust-gated gossip, NAT traversal, dual-stack IPs.
One Zig codebase from servers to mobile embedding.

getting started architecture →github ↗

$curl -fsSL https://raw.githubusercontent.com/igorls/meshguard/main/install.sh | bash⧉

quick start — bash

# 1. generate an Ed25519 identity$ meshguard keygenIdentity keypair generated. ~/.config/meshguard/identity.key ~/.config/meshguard/identity.pub
# 2. export your public key$ meshguard export > my-node.pub
# 3. trust a peer$ meshguard trust /path/to/peer.pub --name validator-3Peer trusted: validator-3
# 4. join the mesh$ sudo meshguard up --seed 1.2.3.4:51821meshguard is running (userspace WG mode). mesh IPs: 10.99.189.145, fd99:6d67::bd91 public endpoint: 203.0.113.42:8591 (behind NAT, cone) TUN device: mg0 (fd=6, mtu=1420) data-plane workers: 8 peer joined: 10.99.42.17 validator-3 [handshake complete]

// how it works

// trust

Serverless Trust

No coordinator or control plane. Local authorized keys, org certificates, and vouches decide who can join.

// discovery

SWIM Gossip

O(log N) convergence with failure detection, signed org control messages, and restart-aware tunnel healing.

// crypto

WireGuard Data Plane

Noise_IKpsk2 handshake, ChaCha20-Poly1305 transport, kernel mode on Linux or portable userspace mode.

// nat

NAT Traversal

STUN discovery, UDP hole punching, relay fallback. Works behind cone and symmetric NATs.

// identity

Dual-stack Identity

IPv4 and IPv6 mesh addresses are derived from each node identity. No DHCP, no allocation service.

// platforms

Cross-platform Core

Linux, macOS, FreeBSD, Windows, Android, and iOS targets share the same Zig implementation.

3.9+

Gbps userspace

20k+

Lines of Zig

Release targets

Central services