EasyTier — Decentralized Mesh VPN with WireGuard Support

Introduction

EasyTier creates a peer-to-peer mesh network that lets devices communicate as if they were on the same LAN, regardless of NAT or firewall constraints. It requires no central coordination server and uses WireGuard for high-performance encryption.

What EasyTier Does

• Creates a flat Layer-2 or Layer-3 mesh network across the internet
• Traverses NATs automatically using hole-punching, STUN, and relay fallback
• Encrypts all traffic with WireGuard or AES-GCM
• Discovers peers automatically via a shared network name and secret
• Supports multi-hop routing when direct connections are not possible

Architecture Overview

Each EasyTier node runs a userspace networking stack in Rust that manages TUN/TAP interfaces, peer discovery, and encrypted tunnels. Nodes form a gossip-based mesh: when a new peer joins with the correct network name and secret, existing nodes propagate its address. Traffic is routed along the shortest path, falling back to multi-hop relay if direct NAT traversal fails.

Self-Hosting & Configuration

• Single static binary for Linux, macOS, Windows, Android, and FreeBSD
• Network name and secret are the only required parameters for basic setup
• Configure via CLI flags, TOML config file, or the built-in web management console
• Optional public relay nodes can be self-hosted for NAT-unfriendly environments
• Docker image available for containerized deployments

Key Features

• Fully decentralized with no central server requirement
• WireGuard-based encryption with zero-configuration key exchange
• Automatic NAT traversal with multiple strategies (UDP hole-punching, STUN, relay)
• Built-in web UI for network topology visualization and management
• Cross-platform support including Android and FreeBSD

Comparison with Similar Tools

• Tailscale — Tailscale requires a coordination server (or Headscale for self-hosting); EasyTier is fully decentralized
• ZeroTier — ZeroTier uses its own protocol; EasyTier uses WireGuard for proven security
• Netmaker — Netmaker needs a server and client setup; EasyTier is a single binary with peer discovery built in
• WireGuard (direct) — Raw WireGuard requires manual key exchange and config; EasyTier automates everything

FAQ

Q: Do I need a central server? A: No. Peers discover each other using the shared network name and secret. Optional public relay nodes are available for difficult NAT scenarios.

Q: How does NAT traversal work? A: EasyTier tries UDP hole-punching first, falls back to STUN-assisted traversal, and as a last resort routes through a relay peer.

Q: Can I use it alongside existing WireGuard setups? A: Yes. EasyTier can interoperate with standard WireGuard peers via its WireGuard gateway feature.

Q: What platforms are supported? A: Linux, macOS, Windows, Android, and FreeBSD. An iOS client is in development.

Sources

• https://github.com/EasyTier/EasyTier
• https://easytier.top