A next-generation mesh VPN that behaves like your local network — device discovery, encrypted multicast and real-time traffic included.
Website · Docs · Download · Pricing
VIGIL-MESH connects machines, field sites and services into a private end-to-end encrypted network — even where classic VPNs fail (symmetric NAT, LTE, locked-down site networks). Free for personal use.
Most mesh VPNs (Tailscale, ZeroTier, NetBird) give you point-to-point unicast over WireGuard. VIGIL-MESH takes a different path — a QUIC VPN with a single crypto layer — and makes the overlay behave like a real LAN segment:
- Encrypted L2 broadcast & multicast — mDNS, SSDP, WS-Discovery, DDS/ROS 2 and LAN games traverse the mesh as if plugged into the same switch.
- QUIC end-to-end (the HTTP/3 transport), no WireGuard — TLS 1.3 sessions between nodes, raw Ed25519 keys, hybrid post-quantum key exchange: a post-quantum VPN by default, not as an option.
- A browser is a node — the WASM runtime turns a tab into a mesh peer: SSH terminal and RDP desktop in the browser, no port open, no bastion.
- Blind relays you can self-host — relays ("vigies") are structurally unable to read your traffic, and you can run your own.
- Built for real-time — RTSP/RTP video, drones and field robotics; 350k+ packets/s measured, connection migrates from relay to direct path without dropping.
Windows · Linux · Android · NVIDIA Jetson · Browser (WASM)
The client is free to use (download). This repository hosts releases, documentation pointers and issue tracking.
How this mesh VPN stacks up against Tailscale, ZeroTier and NetBird — honest feature comparison: https://vigil.design/docs/comparatif
Deep dives: QUIC VPN (TLS 1.3, HTTP/3) · Post-quantum VPN · Mesh VPN without WireGuard · Encrypted L2 multicast