meshp
Self-hostable private networking built on WireGuard. One device can hold live memberships in many networks at once — which is the part nobody else does.
Pre-alpha. Do not deploy this.
Packets cross on Linux and full-tunnel egress fails closed. Direct paths and DNS are unimplemented, and the data plane is Linux only. If you need something that works this afternoon, use Tailscale or NetBird — we mean that.
What it is
Every device runs an agent and gets a stable private address. A control plane decides what should be true — who may reach what, which machine provides egress — and every agent converges toward it. You run the control plane.
Why it exists
A device belongs to many networks, not one
A technician supporting forty customers should not need forty laptops. Each membership carries its own address and its own WireGuard key, so those customers cannot correlate the same device across their networks.
Egress that fails closed
When a device sends everything through the tunnel, traffic that would leave any other way is refused — and those rules are firewall state, so they survive the agent crashing. A dropped tunnel cannot quietly put a real address back on the wire. When something is blocked, meshp doctor explains why on a machine with no internet access at all.
Failover that happens without asking
Gateways and exit nodes are one primitive: a set of prefixes with ordered, health-checked advertisers. A device leaves a dead gateway on its own evidence, without a round trip to the control plane — which matters most during the outage that took the control plane with it.
Honest comparison
| meshp | Tailscale | Headscale | NetBird | |
|---|---|---|---|---|
| Self-hostable control plane | yes | no | yes | yes |
| Control plane open source | yes | no | yes | yes |
| Automatic exit-node failover | yes | no | no | partial |
| Stable egress IP across failover | yes | n/a | n/a | no |
| Device in several networks at once | yes | no | no | no |
| NAT traversal maturity | immature | excellent | excellent | good |
| Client platform maturity | immature | excellent | n/a | good |
| Production ready today | no | yes | yes | yes |
The two maturity rows are where we are years behind, and no amount of architecture makes up for it yet.
Try it
On a device joining a network:
curl -fsSLO https://raw.githubusercontent.com/meshpnet/meshp/main/scripts/install.sh
less install.sh && sudo sh install.shIt verifies the download against the release checksums, installs the agent and its systemd unit, and stops before starting anything — joining needs a token, and that is your decision to make.
Open, and how far
Apache 2.0, and commercial use is permitted — including running it as a service. Every line that touches a packet is open source: the agent, the control plane, the relay, policy, route groups and failover. Redundancy is not a paid feature.
What is not open is the multi-tenant layer we operate ourselves. It is operated rather than distributed, so there is no on-premise build of it and no licence key — a self-hosted meshp is a complete single-tenant deployment, not a trial of one. See ADR-0009.