# MeshGuard

> Decentralized, serverless, WireGuard-compatible mesh VPN daemon written in Zig that builds encrypted tunnels between trusted peers without a hosted coordination service or central authority.

MeshGuard is an open-source mesh VPN daemon written in Zig, built by Rio Blocks (formerly EOS Rio), a software engineering studio with roots in blockchain infrastructure. It creates encrypted WireGuard-compatible tunnels between peers without requiring a hosted control plane, central address allocator, or coordination server. The project is MIT-licensed and available on GitHub under the `igorls/meshguard` repository, with the latest release being v0.9.0 published in April 2026.

## What It Is

MeshGuard occupies the middle ground between fully manual WireGuard configuration and hosted mesh VPN solutions. Traditional approaches force a tradeoff: hosted control planes are convenient but create a single point of dependency, manual WireGuard configs are decentralized but scale poorly, and open discovery overlays are easy to join but lack permissioned membership. MeshGuard solves all three by enabling automatic peer discovery, WireGuard tunnel negotiation, NAT traversal, and explicit membership enforcement — all without a required server.

## How the Trust Model Works

MeshGuard supports two complementary trust modes that can be used independently or together:

- **Individual peer trust**: Each node maintains an `authorized_keys/` directory of trusted public keys. How keys arrive there is intentionally out of scope — manual exchange, config management, Git sync, or an external registry all work.
- **Organization trust**: An org key can sign node identities so peers only need to trust the org once. Org admins can revoke signed nodes or vouch for external standalone peers.

This design keeps trust local to each node or organization, with no dependency on a third-party authority.

## Discovery and NAT Traversal

Peer discovery uses a layered approach: SWIM gossip protocol, static seed peers, DNS TXT seeds, and LAN mDNS discovery. For NAT traversal, MeshGuard uses STUN, coordinated UDP hole punching, UPnP-IGD, and a ciphertext-only relay fallback for difficult networks. Addressing is deterministic from node public keys, assigning IPv4 addresses under `10.99.0.0/16` and IPv6 ULA under `fd99:6d67::/64`.

## Platform Support and Performance

MeshGuard runs across a wide range of platforms:

- **Linux**: Userspace mode by default; optional kernel WireGuard mode with `--kernel`; optional libsodium acceleration
- **macOS**: Userspace mode via `utun`
- **FreeBSD**: Userspace mode via `tun(4)`
- **Windows**: Userspace mode via Wintun (requires Administrator)
- **Android / iOS**: C-ABI shared/static library for app-level embedding

The README documents userspace Linux benchmarks of approximately **3.93 Gbps download and 3.94 Gbps upload** in an LXC localhost test setup with 8 encrypt workers.

## Update: v0.9.0

The latest release is v0.9.0, published on April 28, 2026. The repository was last pushed to in July 2026 and last updated in August 2026, indicating active development. MeshGuard requires Zig 0.16.0 or newer to build from source and supports cross-compilation to Linux (x86_64, aarch64), macOS, FreeBSD, Windows, Android, and iOS targets. Crypto primitives default to Zig's standard library, with libsodium available as an optional Linux acceleration backend.

## Features
- Serverless peer discovery via SWIM gossip, static seeds, DNS TXT, and LAN mDNS
- WireGuard-compatible encrypted data plane (kernel or userspace)
- Deterministic IPv4/IPv6 addressing from node public keys
- NAT traversal with STUN, UDP hole punching, UPnP-IGD, and relay fallback
- Per-node authorized keys and org-signed node certificates
- Org-level revocation and vouching for external peers
- Service access control with global, per-peer, and per-org port policies
- Mobile and embedded FFI for Android and iOS
- Single static binary with no required central authority
- Optional libsodium acceleration on Linux
- Cross-compilation support for Linux, macOS, FreeBSD, Windows, Android, iOS

## Integrations
WireGuard protocol, libsodium, Wintun (Windows), Linux kernel WireGuard module, STUN, UPnP-IGD, mDNS, DNS TXT

## Platforms
WINDOWS, MACOS, LINUX, ANDROID, IOS, API, CLI

## Pricing
Open Source

## Version
v0.9.0

## Links
- Website: https://rioblocks.io
- Documentation: https://igorls.github.io/meshguard/
- Repository: https://github.com/igorls/meshguard
- EveryDev.ai: https://www.everydev.ai/tools/meshguard