Veilway

A VPN for networks that block VPNs

Veilway is open-source software for running your own VPN server on a censored or hostile network, for yourself or a small group. The current release, v0.3.13-alpha, installs a server and its web panel with one script or Docker. Apps for Windows, Linux and Android connect to it. macOS has a command-line client only, and there is no iPhone app yet.

  1. Rent a Linux server outside Iran.
  2. Run one command on it, then open the panel and add a user.
  3. Install the app and add the user's link.
Set up a server

Someone gave you a link? Download the app.

AlphaIt has had no outside security review. Every connection method can be spotted by a censor that looks closely. Nothing has been tested against Iran's filtering at scale. The Windows app has never connected to a node on a real PC. Expect bugs, and tell us about them.

Install a server

On a fresh Linux server, run this as root. It asks a few questions and prints your panel address at the end.

curl -fsSL https://raw.githubusercontent.com/veilway-project/veilway/main/scripts/veilway.sh | sudo bash

More options are in the guide.

Downloads

These are on the v0.3.13-alpha release page:

Windows
The desktop app, as an installer.
Linux
The desktop app, as .deb and .rpm.
Android
The app, for arm64.
Linux, macOS, Windows
The command-line client and node.
iPhone and macOS app
Not available yet.

Installer mirrors are signed and refuse an older release. The panel has its own releases. The install script fetches both for you.

Open the release page

What it does differently

The tunnel stays standard. The work goes into getting it through, and into one set of tools from the server to the phone.

  • WireGuard's own cryptography

    The tunnel is unchanged WireGuard, through boringtun. Veilway works around the tunnel and does not invent its own encryption.

  • Transports for where UDP is blocked

    The tunnel can travel over obfuscated UDP, TLS, WebSocket or a fronted HTTP path. Someone who probes the server without an account gets the ordinary answer of the operator's own website.

  • One engine for the server and the apps

    The server and the apps are built on the same Rust core, which is also a library for anyone who wants a WireGuard engine in their own program. Subscription requests are encrypted end to end, and the apps ask before they use a backup update address.

  • Enter one server, leave from another

    Two servers can be linked, so users connect to one and their traffic leaves from the other. The tunnel guide sets up an entry in Iran and an exit abroad. The operators pair them with two codes and compare a fingerprint, in the panel or on the command line. One panel can also run several servers, with one subscription and one quota across them.

  • Works beside Xray and v2ray apps

    Veilway does not replace Xray, 3x-ui or v2ray. The optional Xray add-on is off by default. Once you install it, stock apps can connect with VLESS, Trojan or Shadowsocks, and their traffic counts in the same quotas and follows the same rules.

  • English and Persian from the start

    The design system and the docs are written in both, with right-to-left layout, Persian digits and Jalali dates, and so is every app built on them.

Five transports, one tunnel

  • Plain UDPudp
  • Obfuscated UDPudp-obfs
  • TLStls
  • WebSocketws
  • Fronted HTTP pathfronted

Where it stands

Do not rely on Veilway where a failure would put you at risk. Nothing in it has been tested against deep packet inspection or active probing, and its protocol spec is a draft only the project has reviewed.

What has been tested

Server and panel
The alpha gate installs a fresh systemd server from signed release files and connects a client, and passes 55 checks. The Xray gate passes 119.
Linux
A 70-point check in Docker, with a real node and client.
Android
Used on a real phone against a demo node.
Windows
Unit tests and a short test on a Windows CI runner. The adapter, routes, DNS rule and kill switch take effect, and nothing leaks. It has never connected to a node on a real PC.
macOS and iPhone
There is no macOS app and no iPhone app. The macOS command-line client has only unit tests on a macOS CI runner, and has never been run on a real Mac.
Works today
  • A server that runs WireGuard for many users over five transports, with routing rules, quotas and config reload. Someone who probes it without an account gets the operator's own website.
  • A web panel in English and Persian: users, devices, subscription links and QR codes, exits, routing, traffic history, backup and restore, and an admin API.
  • Subscriptions that stay private on the way: requests and answers are encrypted end to end, so a relay mirror sees nothing of them.
  • Desktop apps for Windows and Linux, and an Android app (arm64), in English and Persian. They import a subscription by link or file, connect with one button, and have a kill switch.
  • Links between two servers, and an optional Xray add-on so stock apps can connect.

The rest is on the alpha page of the docs.

Not built yet

The Android app does not connect to Xray links yet, and the server add-on has no VMess, no Reality and no l3 or chain exits. Split tunneling and store builds are planned for a later release. HTTP/2 and the fronted shapes have not run behind a real CDN.

Read it, run it, report it

Everything happens in the open, under the veilway-project organization on GitHub.

  • Docs

    The install guide, manuals, config reference and protocol spec. The protocol pages are still stubs in Persian.

    veilway-project.github.io/veilway-docs
  • Code

    The core, the control API, the apps and the install script. Its releases page has the apps and the node.

    github.com/veilway-project/veilway
  • Panel

    The web panel for running a server: users, devices, subscription links, linking and mirrors, and the admin API.

    github.com/veilway-project/veilway-panel
  • Security policy

    Report a vulnerability privately through GitHub's form, never in a public issue.

    SECURITY.md
  • Contributing

    Read this before a first pull request, which asks you to sign the CLA once.

    CONTRIBUTING.md
  • All repositories

    The core, the panel, the docs and the design system, each in its own repository.

    github.com/veilway-project