wgrtc

WireGuard tunnels that just work, even when both ends are behind NAT.

You already know WireGuard is fast, modern, and audited. What you might not know is how irritating it is to deploy: somebody has to be on a static, port-forwardable IP, or you end up paying for a relay. Wgrtc removes that requirement. Two devices that have nothing in common but internet access can discover each other, agree on their current public endpoints, and bring up a direct WireGuard tunnel between them — no central VPN provider, no port forward, no DDNS, no account.

It's the same protocol kernel WireGuard already speaks. We don't fork WireGuard, we don't replace it, we don't re-invent NAT traversal. We glue together pieces that already exist — WireGuard for the data plane, a thin WebRTC-style signaling layer for endpoint discovery, raw-UDP hole punching for NAT — and we package them so the result is a Debian .deb on the Linux side and a signed .apk on the Android side.

What this is good for

- Reach your home network from anywhere. Your router is behind carrier NAT; your ISP won't give you a port forward. Run the daemon on a Linux box at home, install the Android app on your phone, and your phone routes through home from the coffee shop just like it does on your couch.

- Bridge two NATed sites. You have two small offices, neither has a public IP, and you don't want a cloud relay charging you per gigabyte. Run the daemon on a small box at each site; both daemons publish their current endpoint through the broker; a direct kernel WireGuard tunnel comes up between them.

- Phone-to-phone, no servers. Two phones on different mobile carriers can join a tunnel hosted on one of them, with no involvement from any server you operate. Use it for ad-hoc file sharing, remote desktop into a phone you left at home, or pair-programming over a shared subnet. This gives you reachability between the two devices, not internet egress through the host — for "use my home network as my internet from the road", point your phone at a daemon running at home instead.

- Tunnels you can trust on hostile hotspots. Hotel Wi-Fi captive portals don't care. Coffee-shop DNS hijacking doesn't care. Long-lived WireGuard tunnels keep humming as the underlying network roams; wgrtc's signaling automatically follows.

- Several tunnels at once. Run home + work + a friend's network side-by-side on the same phone. Android caps a process at one VpnService slot, so wgrtc shares that single slot across every joiner tunnel you've enrolled — per-tunnel routing stays separate in-process via a userspace netstack. When you roam from Wi-Fi to cellular, every tunnel re-races its endpoint candidates independently, so all the tunnels stay reachable without a manual reconnect. Host-mode tunnels are similarly N-at-a-time.

What you DON'T need

- No port forwarding. The NAT discovers itself. - No DDNS. Endpoints update automatically as both sides roam. - No accounts. No login, no email, no telemetry, no central database of who's connected to whom. - No central VPN. Traffic goes peer-to-peer; we never see it. Even the signaling broker only ever sees ciphertext + opaque routing IDs. - No new protocol on the wire. It's still kernel WireGuard at both ends, the kind that's been audited and shipped in Linux since 5.6. - No IPv4 dependency. Dual-stack throughout: hosts and joiners exchange both v4 and v6 endpoints, allocate v4 + v6 addresses inside the tunnel, and the through-host forwarder relays TCP / UDP / ICMP / ICMPv6 to the public internet. An IPv6-only joiner reaches a dual-stack host directly, no 464XLAT or relay.

License

Apache 2.0