A WireGuard mesh you run yourself. One static binary per machine, peer-to-peer tunnels, no coordination server you don't control and no account to create.
$ npx nullroute init
✓ One binary, 9 MB
✓ True peer-to-peer
✓ You hold the keys
✓ ACLs in a text file
→ 9 MB static binary
$ ▍
Static Go binary for Linux, macOS, BSD and Windows. No daemon zoo, no Docker required.
NAT traversal punches direct tunnels between peers 94% of the time; relays only when they must.
Coordination runs on your own box. Keys never leave the machines that generated them.
Write who can reach what in a 20-line TOML file. Changes apply to every peer in under two seconds.
Reach machines by name — db.home, nas.home — resolved on device, no external lookups.
Every line is public. Independently audited in 2025; the full report is in the repo.
“I replaced three VPN products and a cloud dashboard with one TOML file. My homelab and my office now act like one LAN.”
The full mesh, self-hosted, unlimited peers.
Fund development, get a relay close to you.
Support contract and SSO for companies.
curl -fsSL nullroute.sh | sh — reviewed, signed and under 200 lines. Read it first; we would.