A VPN where only your master decides who gets in.
One server owns identity, activation and authorization. Any number of WireGuard nodes carry the traffic — and none of them can let a single client in on their own. Deploy it on your own hardware, in your own names, under your own rules.
A node never decides whether you may connect.
WireGuard has no concept of logging in. A peer either exists in the interface or it does not — so this platform puts the whole authorization decision before the peer is created, where it can actually be enforced.
Sign in, and prove the machine
A password, and a signature from an Ed25519 key that was generated on this device and never leaves it. Copying a password to a friend does not copy the device.
Ask for a connect ticket
The master checks the account is active, under quota and inside its concurrent-session limit, leases a tunnel address from the chosen node's pool, and mints a ticket — all in one serializable transaction, so two simultaneous requests cannot both win.
Hand the ticket to the node
Over HTTPS, to the node's control API — a certificate issued by your master's own private CA, which the client pins. Nothing has touched the data plane yet.
The node redeems it, over mutual TLS
Unused, unexpired, bound to this node, bound to the exact WireGuard key presented, and the account still active. Any one of those failing is one refusal with one code — never an explanation an attacker could use as an oracle.
Only now does the peer exist
The node installs one peer with a single /32 of
AllowedIPs, and the tunnel comes up. If the master is unreachable,
no new connection is made — it fails closed, every time.
What that buys you
There is no authentication code in the packet path, no session to hijack, and no credential to replay. Revoking access is removing a peer, which is instant and unconditional — an admin's force disconnect reaches the node within one ten-second reconciliation.
A complete VPN service, not a tunnel script
Accounts, activation, device binding, node enrollment, quotas, usage accounting, an audit trail and an administration console — all of it built in, and all of it yours.
Security model
Argon2id passwords, per-device Ed25519 keys, ES256 tokens with rotation, refresh-token reuse detection, and tickets that are single-use, node-bound and key-bound.
Read the modelYour own network
Nodes enroll with a one-time key, get a certificate from your private CA, and serve traffic on Linux or Windows Server. Approve, drain and disable each one from the console.
Explore nodesNative apps
Windows with a privileged tunnel service, DNS and IPv6 leak protection and a kill switch. Android and iOS through the platform's own VPN extension.
See the clientsAdministration
Activate accounts, set device and session limits, apply quotas, read per-user usage, force a disconnect, and see every administrative action in an append-only audit log.
Tour the consoleUsage & quotas
Byte counters collected per session, made idempotent by sequence number, folded into hourly buckets. Quotas enforce themselves on the ingest path, within a lease interval.
How accounting worksPrivacy by construction
Nodes report byte counts and handshake times. Not destinations, not DNS queries, not payloads. There is no logging switch to leave on, because there is nothing to switch.
What is and isn't keptAll traffic, or it is not a VPN
A tunnel that carries most of your traffic is worse than none, because it looks like it is working. The Windows client handles the three ways that quietly fails: DNS resolved outside the tunnel, IPv6 escaping a v4-only node, and a crashed tunnel leaking in the clear.
- DNS forced through the tunnel with NRPT rules, not merely set on the adapter
- IPv6 routed in and blackholed when the node has none
- Kill switch — a firewall filter so a dropped tunnel fails closed
- Never elevated — the UI runs as you, a service owns the adapter
Windows 10 / 11
WPF app plus a LocalSystem service, talking over a named pipe with an ACL that admits only you and SYSTEM.
Android & iOS
Flutter, with models generated from the published OpenAPI contracts so the app and the server cannot drift.
Linux nodes
Kernel WireGuard driven through wg and ip, with NAT and forwarding set up by the agent.
Windows Server nodes
WireGuardNT through the driver API, so one client can be authorized without disturbing the others.
Recorded
- Bytes in and out, per session, hourly
- Which node a session was on, and when
- Last WireGuard handshake time
- The client's public IP, for abuse handling
- Every administrative action, append-only
Never recorded
- Sites, hosts or addresses you reach
- DNS queries — the node runs no resolver
- Payloads, headers or flow records
- Anything a node could sell, because it holds none of it
The parts that could betray you are simply not built
A node reports counters. It has no database access, holds no user credentials, cannot mint a session, and cannot redeem a ticket meant for a different node. Compromising one exposes the traffic passing through it — inherent to every VPN — and nothing else.
Its certificate is revoked centrally, and the revocation takes effect at the TLS layer on the next call it makes.
Run it yourself. Nothing phones home.
Register an account on this master, and an administrator activates it. Deploying your own? The whole platform is one master service, an agent per node, and the clients.