Meshway

An open source peer network for encrypted SOCKS5 connections, private TCP service tunnels, volunteer relays, and experimental IPv4/IPv6 internet VPN with tunneled DNS. Go powers the shared core; Kotlin, Swift, C#, and TypeScript power the platform interfaces.

Meshway is an experimental open-source alpha. Source, downloads, and the public website are available. The macOS administrator VPN is included; Apple Network Extension signing and app-store listings require the owner's credentials. See the roadmap and verified status for implementation and runtime evidence.

Install the alpha

Download Android APK, Windows installers, macOS DMG, Linux binaries/Debian/RPM packages and browser extensions from the release page. Portable builds and source are available alongside installers. The iPhone/iPad release is deferred until the owner's Apple Developer account is ready. Release files have an Ed25519-signed manifest; native development signing is described alongside each artifact. The public container supports amd64 and arm64:

docker pull ghcr.io/user-github-me/meshway:0.1.0-alpha.2

The registry currently provides alpha.1. For the new alpha.2 use the GitHub launcher below; registry publication is pending renewed owner login. Install the registry launcher with:

npm install -g @nazifbd/meshway@alpha
meshway install-core
meshway init
meshway daemon

The launcher is also distributed as an installable GitHub release package:

npm install -g https://github.com/user-github-me/meshway/releases/download/v0.1.0-alpha.2/meshway-cli-0.1.0.tgz
meshway install-core
meshway init
meshway daemon

Use server deployment instructions and the Linux device VPN guide. The GitHub package installation works without a registry login.

Run from source

Requirements: Go 1.27+, Node 22+ for the web app. The build script also detects a project-local Go installation under .tools/go.

./scripts/build.sh
./dist/meshway init --config .meshway/config.json
./dist/meshway daemon --config .meshway/config.json

In another terminal:

npm ci
npm run dev

Open http://localhost:5173/#/dashboard. Pair with the API token from your local config file; the dashboard keeps the token only in memory. The default proxy listens at 127.0.0.1:1080. A new network has no servers until you add a peer invitation or bootstrap server. Meshway does not invent public endpoints or claim that a disconnected proxy is an active VPN.

Connect two machines

Read the setup guide. Each machine has its own identity and configuration. A gateway operator chooses whether to offer internet access and which peer IDs may use it. A private service gateway publishes only explicitly named services. Relays forward encrypted peer traffic and do not automatically act as internet exits.

Private-key accounts

No email or hosted login database. A random account recovery key authorizes distinct device identities. History remains local unless both devices enable authenticated, encrypted sync. A recovery backup is the account: protect it and store a copy outside the device.

./dist/meshway account create --config .meshway/config.json
./dist/meshway account export --config .meshway/config.json --output /private/path/recovery.txt
./dist/meshway account devices --config .meshway/config.json

Create/export/import use private files and must run while the daemon is stopped. The native apps offer file-picker backup/import without terminal commands. Account design explains device membership, sync, and revocation limits. Root keys are never exposed by the dashboard API.

Platforms and installation

• macOS: native SwiftUI client, bundled Go daemon; ./apps/macos/build.sh after building the core.
• iPhone/iPad: SwiftUI app and Network Extension; ./apps/ios/build.sh creates an unsigned device build. iOS instructions cover the developer IPA and required Apple signing.
• Windows: C#/WPF client; source/build scripts under apps/windows.
• Linux: native Go daemon, authenticated web dashboard, reversible meshway vpn start|stop|status route/DNS/firewall setup.
• Android: Kotlin client with a Go mobile binding and VpnService; apps/android/build.sh.
• Browser: TypeScript proxy extension for Chromium and Firefox; requires a running local SOCKS listener.
• Server: container and systemd instructions.
• npm: installable GitHub release package under packages/cli; downloads verified core releases with meshway install-core.

Platform details distinguish compilation, signing, and actual device testing. Apple Network Extension, Windows Wintun, Android VpnService, and Linux TUN integrations are implemented. IPv4/IPv6 TCP, UDP, routed DNS, and Linux failure blocking have working integration tests. The macOS administrator helper passed hosted kernel, public DNS/HTTPS and cleanup tests. Apple Network Extension signing and physical-device checks remain separate. See VPN behavior and desktop integration.

Development

./scripts/check.sh
./scripts/release.sh

Checks cover encrypted connections, relay transport, permission denials, recovery accounts, encrypted sync, packet framing, app interfaces, and builds. Release scripts only create local artifacts. Contributing, security policy, and threat model describe project expectations.

Licensed under Apache-2.0.