Tunguard

TunGuard is a self-hosted networking platform for connecting remote devices and exposing internal services. One server gives you three things: a direct peer-to-peer mesh between devices, a TCP relay for publishing services that run on them, and a WireGuard-compatible VPN for ordinary client access.

The mesh and the relay are TunGuard's own protocols, not WireGuard. Devices sharing a group key discover each other automatically, punch a direct UDP path through NAT, and fall back to relaying through the server when no direct path can be opened — so traffic leaves the server path as soon as the peers can reach each other. The VPN half still produces standard WireGuard configurations and QR codes for any device that wants one.

Everything runs in userspace, so there are no kernel modules to install, no apt install wireguard, and no container runtime. A small client binary keeps unattended devices on the mesh with no local configuration, and a web dashboard and API drive all of it.
What TunGuard Does⚓

Pick the part that matches what you are building.

P2P Mesh — devices sharing a group key discover each other, punch a direct UDP path through NAT, and relay through the server only when a direct path is not possible. TunGuard's own protocol; no VPN involved.
TunGuard Client — one small binary that puts an unattended device on the mesh. No config file, no routes, no local state beyond a device id.
VPN Access — standard WireGuard configurations and QR codes, generated from the dashboard for phones, laptops, and routers.
AdGuard DNS Filtering — a managed AdGuard Home instance that filters DNS for devices in an AdGuard-enabled policy group, enforced on the server, so moving a device into the group protects it immediately. The same filter can be published as a public DNS resolver.
Domains & HTTPS Proxy — put a public domain with automatic Let's Encrypt HTTPS in front of a TRP mapping or a tunneled service, or map it as a public DNS-over-HTTPS and DNS-over-TLS resolver.
SSH Access — jump host, browser SSH terminals, and a built-in ssh client, all using your dashboard login.
TCP Relay — publish a service running on a mesh node to the internet on a port of your choosing.
Dashboard and API — everything above is drivable from a browser or from curl.