TCPeer

TCPeer is an experimental dual-stack Layer 3 peer-to-peer VPN built around direct TCP connections.

TCP is the outer transport used for VPN traffic. A lightweight coordinator provides authentication, peer discovery, endpoint registration, device synchronization, and coordinated TCP simultaneous-open.

The coordinator does not relay tunneled traffic.

Once a direct connection is established, IPv4 and IPv6 packets are transferred directly between peers as their original raw IP bytes.

TCPeer adds 0 bytes of TCPeer-specific framing overhead to the data plane.

Warning

TCPeer is not an encrypted VPN.

Authentication proves possession of the configured Secret Key using HMAC-SHA256, but the direct TCP stream itself is cleartext.

Applications should use their own encryption, such as HTTPS or SSH, when confidentiality is required.

Features TCPeer currently provides:

Direct peer-to-peer TCP transport TCP over IPv4 and IPv6 Coordinator-assisted peer discovery Separate IPv4 and IPv6 endpoint registration TCP simultaneous-open / TCP hole punching HMAC-SHA256 Secret Key authentication Raw IPv4 and IPv6 Layer 3 tunneling 0-byte TCPeer data-plane framing Linux TUN interface Native Android VpnService client IPv4 DHCP support IPv6 SLAAC and Router Advertisements DHCPv6 Prefix Delegation support Automatic upstream DNS discovery RDNSS advertisement IPv4 and IPv6 forwarding NAT44 NAT66 nftables integration Optional nftables software flow offload Linux exit-node operation Persistent SQLite state Device/peer synchronization Automatic Android reconnection TPP / TCPPeerPing Coordinator-local administration Interactive Linux configuration systemd services