"Share a Secret, Build a Mesh."
Decentralized WireGuard mesh networking with DHT peer discovery. No central server. No subscriptions. Just encrypted, self-organizing networks.
Capabilities
WGMesh handles the complexity of multi-node WireGuard so you don't have to juggle keys, endpoints, and config files manually.
Nodes find each other automatically via a distributed hash table. No tracker server, no single point of failure.
All traffic is encrypted end-to-end using WireGuard's modern cryptography — ChaCha20, Poly1305, Curve25519.
Automatically detects and handles NAT scenarios with UDP hole-punching to connect peers behind firewalls.
Configuration changes applied via wg set without interface restarts — peers stay connected.
Segment your network with group-based access control policies. Limit which peers can reach which resources.
Mesh state stored locally with systemd integration. Survives reboots and reconnects automatically.
Container images available on GitHub Container Registry. Runs in Docker with full mesh capability.
Unix socket JSON-RPC for scripting and querying peer state programmatically from your own tools.
Pre-built binaries for Linux amd64, arm64, and armv7. Runs on servers, Raspberry Pis, and edge devices.
How it works
WGMesh reduces a complex multi-node WireGuard setup to a single shared secret and a one-line command.
All nodes joining the same mesh share a single secret. This is used to derive the DHT swarm key — only nodes with the secret can find each other.
Each node announces itself to the distributed hash table. WGMesh resolves other peers from the DHT without any central registry.
Peer public keys and endpoints are exchanged via the DHT. NAT traversal is attempted automatically. WireGuard takes over from there.
When nodes join or leave, the DHT reflects this. WGMesh updates WireGuard config on the fly — no restarts, no manual edits.
Deployment
Run fully decentralized for maximum autonomy, or use centralized mode for admin-controlled enterprise deployments.
Nodes discover each other via DHT. No server required. Ideal for dynamic, distributed environments.
Admin controls the topology via SSH deployments with diff-based updates. Ideal for teams needing strict governance.
Comparison
Open source, self-hosted, no subscriptions — and nothing phoning home.
| Feature | WGMesh | Tailscale | Netbird |
|---|---|---|---|
| Open Source | ✓ MIT | Partial | ✓ |
| No central server | ✓ | ✗ | Hosted or self-host |
| DHT peer discovery | ✓ | ✗ | ✗ |
| WireGuard based | ✓ | ✓ | ✓ |
| NAT traversal | ✓ | ✓ | ✓ |
| Subscription fee | Free | Paid tiers | Paid tiers |
| Self-hostable | ✓ | Partial | ✓ |
Installation
Pre-built binaries for Linux and macOS. Requires WireGuard kernel module and wg-tools on Linux.