Welcome to the Documentation for TunGuard⚓

One userspace control plane connects people, cloud, edge devices and AI workloads.

This documentation provides you not only with the basic setup and configuration of TunGuard but also with advanced configuration, elaborate usage scenarios, detailed examples, hints and more.

About⚓

TunGuard is a self-hosted networking platform for connecting remote devices and exposing internal services. One server gives you three things: a direct peer-to-peer mesh between devices, a TCP relay for publishing services that run on them, and a WireGuard-compatible VPN for ordinary client access.

The mesh and the relay are TunGuard's own protocols, not WireGuard. Devices sharing a group key discover each other automatically, punch a direct UDP path through NAT, and fall back to relaying through the server when no direct path can be opened — so traffic leaves the server path as soon as the peers can reach each other. The VPN half still produces standard WireGuard configurations and QR codes for any device that wants one.

Everything runs in userspace, so there are no kernel modules to install, no apt install wireguard, and no container runtime. A small client binary keeps unattended devices on the mesh with no local configuration, and a web dashboard and API drive all of it.

What TunGuard Does⚓

Pick the part that matches what you are building.

• P2P Mesh — devices sharing a group key discover each other, punch a direct UDP path through NAT, and relay through the server only when a direct path is not possible. TunGuard's own protocol; no VPN involved.
• TunGuard Client — one small binary that puts an unattended device on the mesh. No config file, no routes, no local state beyond a device id.
• VPN Access — standard WireGuard configurations and QR codes, generated from the dashboard for phones, laptops, and routers.
• AdGuard DNS Filtering — a managed AdGuard Home instance that filters DNS for devices in an AdGuard-enabled policy group, enforced on the server, so moving a device into the group protects it immediately. The same filter can be published as a public DNS resolver.
• Domains & HTTPS Proxy — put a public domain with automatic Let's Encrypt HTTPS in front of a TRP mapping or a tunneled service, or map it as a public DNS-over-HTTPS and DNS-over-TLS resolver.
• SSH Access — jump host, browser SSH terminals, and a built-in ssh client, all using your dashboard login.
• TCP Relay — publish a service running on a mesh node to the internet on a port of your choosing.
• Dashboard and API — everything above is drivable from a browser or from curl.

Contents⚓

Getting Started⚓

If you're new to TunGuard, make sure to read the Getting Started chapter first. If you want to look at examples for a new VPS, we have an Examples page.

Contributing⚓

We are always happy to welcome new contributors. For guidelines and entrypoints please have a look at the Contributing section.

Migration⚓

If you are upgrading from an older version of TunGuard, please read the Migration chapter.

Privacy⚓

TunGuard is self-hosted and collects nothing on your behalf. The Privacy Policy spells out exactly what the server stores, which two third-party CDNs the dashboard loads assets from, and what this documentation site does.