One binary. Mesh, VPN, or public tunnel — your choice.
wayangi is a single static binary that solves three connectivity problems with one install: private mesh between your own devices, hub-and-spoke VPN with WireGuard, and inbound public IPv6 so the internet can reach you. Pick the mode at signup; switch any time.
Private mesh
Up to 3 of your devices reachable from each other through the wayangi tunnel. None of them visible to the public internet. Just install, paste a token on each, done.
- 10.66.0.0/16 internal IPv4
- 2001:df6:d2c0:1400:ffff::/64 internal IPv6 link
- WireGuard data plane
- No public exposure
Public IPv6 tunnel
Dedicated public IPv6 per device. Anyone on the internet can connect — point a domain, run a service, host a game server. Single binary, single token, WireGuard underneath.
- One /128 per device ($5/mo) or /124, /120, /112+ prefixes
- BYO domain (AAAA record)
- Raw TCP/UDP, any protocol
- CGNAT, mobile, restrictive ISPs all work
Sub-device mesh
One parent device gets a whole prefix; sub-devices on other machines auto-claim one IPv6 each. Same install UX, billed under the parent.
- /124 → 16 IPs across 16 machines
- /120 → 256 IPs across 256 machines
- No per-IP charge
- Manage all from the parent's page
Common setups
🏠 Self-host from home on CGNAT
Your home ISP gives you CGNAT'd IPv4 and IPv6 your router refuses to forward. Run wayangi on your home server, get a public IPv6, point a domain. Nextcloud, Vaultwarden, Jellyfin — all reachable from the open internet.
🎮 Host a game server
Minecraft, Factorio, Valheim — bind the server to your wayangi IPv6, hand the address (or your AAAA hostname) to friends. UDP works fine.
📱 Private mesh between phone + laptop + VPS
Free tier covers three devices. SSH from your laptop to your home server and your VPS through the mesh, without any device being publicly exposed.
🌐 Bitcoin / Nostr / Mastodon node
Federation needs an inbound-reachable address. wayangi gives you one without a static IPv4 from your ISP.
🧑💻 Dev server reachable from anywhere
Your laptop dev environment, exposed at a stable URL for webhook testing, mobile testing on real devices, demo links.
🛰️ IoT fleet behind one prefix
Buy a /120 (256 IPs), provision 256 IoT devices as sub-devices, each with its own routable address. Server-initiated push to any of them works.
Mesh, VPN, tunnel — clarified
Can I use wayangi as a VPN?
Yes — between your own wayangi devices. Traffic between any two of your devices flows through the hub-mediated WireGuard tunnel using the internal mesh addresses. It's a hub-and-spoke VPN, not a peer-to-peer one.
Can I use wayangi as a private mesh?
Yes — the free tier exists exactly for this. Up to 3 devices on one account, all reachable from each other through the wayangi mesh addresses, none reachable from the public internet.
Can I use wayangi as a tunnel?
Yes — that's the headline use case. Each paid device gets a dedicated public IPv6 address that's reachable from anywhere on the internet.
Can I use wayangi as a reverse proxy?
wayangi is the layer below a reverse proxy. Put Caddy / nginx / Traefik on your wayangi device and bind it to your assigned IPv6 — that's your reverse proxy. wayangi just makes sure the public IP is reachable.
Does it use WireGuard?
Yes — both data planes (mesh + tunnel) are WireGuard. The agent uses the wireguard-go library; no kernel module required.
Is it like Headscale or Innernet?
Headscale is a self-hosted Tailscale control plane — mesh-focused. wayangi adds public-IPv6 inbound on top of the mesh, which Headscale doesn't do. Innernet is mesh-only, no public exposure.
One binary. All three modes.
Free mesh for three devices, $5/mo per public IPv6, sub-devices billed under the parent.
Sign in with Google →