MeshGuard

MeshGuard is an open-source mesh VPN daemon written in Zig, built by Rio Blocks (formerly EOS Rio), a software engineering studio with roots in blockchain infrastructure. It creates encrypted WireGuard-compatible tunnels between peers without requiring a hosted control plane, central address allocator, or coordination server. The project is MIT-licensed and available on GitHub under the igorls/meshguard repository, with the latest release being v0.9.0 published in April 2026.

What It Is

MeshGuard occupies the middle ground between fully manual WireGuard configuration and hosted mesh VPN solutions. Traditional approaches force a tradeoff: hosted control planes are convenient but create a single point of dependency, manual WireGuard configs are decentralized but scale poorly, and open discovery overlays are easy to join but lack permissioned membership. MeshGuard solves all three by enabling automatic peer discovery, WireGuard tunnel negotiation, NAT traversal, and explicit membership enforcement — all without a required server.

How the Trust Model Works

MeshGuard supports two complementary trust modes that can be used independently or together:

• Individual peer trust: Each node maintains an authorized_keys/ directory of trusted public keys. How keys arrive there is intentionally out of scope — manual exchange, config management, Git sync, or an external registry all work.
• Organization trust: An org key can sign node identities so peers only need to trust the org once. Org admins can revoke signed nodes or vouch for external standalone peers.

This design keeps trust local to each node or organization, with no dependency on a third-party authority.

Discovery and NAT Traversal

Peer discovery uses a layered approach: SWIM gossip protocol, static seed peers, DNS TXT seeds, and LAN mDNS discovery. For NAT traversal, MeshGuard uses STUN, coordinated UDP hole punching, UPnP-IGD, and a ciphertext-only relay fallback for difficult networks. Addressing is deterministic from node public keys, assigning IPv4 addresses under 10.99.0.0/16 and IPv6 ULA under fd99:6d67::/64.

Platform Support and Performance

MeshGuard runs across a wide range of platforms:

• Linux: Userspace mode by default; optional kernel WireGuard mode with --kernel; optional libsodium acceleration
• macOS: Userspace mode via utun
• FreeBSD: Userspace mode via tun(4)
• Windows: Userspace mode via Wintun (requires Administrator)
• Android / iOS: C-ABI shared/static library for app-level embedding

The README documents userspace Linux benchmarks of approximately 3.93 Gbps download and 3.94 Gbps upload in an LXC localhost test setup with 8 encrypt workers.

Update: v0.9.0

The latest release is v0.9.0, published on April 28, 2026. The repository was last pushed to in July 2026 and last updated in August 2026, indicating active development. MeshGuard requires Zig 0.16.0 or newer to build from source and supports cross-compilation to Linux (x86_64, aarch64), macOS, FreeBSD, Windows, Android, and iOS targets. Crypto primitives default to Zig's standard library, with libsodium available as an optional Linux acceleration backend.