ztunnel is a from-scratch desktop VPN client in Rust — a clean-room rewrite of Tunnelblick's feature set as a Tauri v2 app behind a cyberpunk HUD. It drives OpenVPN (the system openvpn binary + its management interface, the faithful Tunnelblick model) and WireGuard (a native pure-Rust data path) — a superset of Tunnelblick's OpenVPN-only scope. The VPN logic is the embeddable ztunnel-core engine; this app is the thin GUI host. This project is in active development.
Two Protocols
OpenVPN via the system binary + management interface, and WireGuard via a native Rust data path — one connection manager, one HUD.
Embeddable Core
All VPN logic lives in ztunnel-core; the app registers ztn_invoke and mounts the engine's webui. The same engine embeds in other hosts.
Cyberpunk HUD
Connection list with live status, throughput readout, log viewer, command palette, and the shared embedded terminal — all CSP-safe.
Network Diagnostics
Host-OS tunnel & leak checks, app-local and engine-independent: public-IP echo, default-route inspection (via-tunnel detection), interface enumeration, plus on-demand ping, traceroute, DNS lookup and TCP reachability — with a one-click per-config reachability probe.
Host Benches
Three more app-local benches beside the diagnostics: Network tools (TLS cert inspect, DNS-over-HTTPS, path MTU, speedtest, HTTP headers, config parse), Network scan (subnet calc, ping sweep, ARP, reverse DNS, RDAP, port knock) and Network monitor (netstat sockets, firewall ruleset, HTTP benchmark, TLS cipher scan, DNS dump, AXFR test).
SSH Tunnels
A port-forwarding manager over the system ssh — local (-L), remote (-R) and dynamic SOCKS (-D) forwards, jump hosts, persisted profiles, live session tracking with drop reasons, key listing/generation and ~/.ssh/config import.
Engine Labs
Six tabbed benches that drive ztn_invoke directly with no app-local Rust: VPN toolkit, Config lab, Routing lab, DNS lab, Crypto lab and Ops lab — the engine's analytical command surface (config lint/migrate/redact, CIDR & AllowedIPs math, DNS wire/split-horizon modeling, Noise/cookie/IKEv2 models, usage & failover accounting) reachable from the ⌘K palette.
Handshake Probe
One real Noise_IKpsk2 initiation per peer from an ordinary UDP socket (wg.probe, the engine's wgprobe feature) — no utun, no route change, no privilege. Verdicts are authenticated / rejected / cookie_challenged / silent / unreachable, and wg.probe_all sweeps every saved WireGuard config at once.
Connect Impact Preview
Pre-connect blast-radius simulation (⌘⇧I): a live-host snapshot (routes, sockets, ARP, resolvers, link MTU) correlated against the routes/DNS/MTU the selected config would install, returning a clean / disruptive / leaky verdict with per-socket rebind predictions, LAN reachability loss, residual leak surface, DNS delta and an MTU check. Touches no wire, needs no privilege.
Honest Status
Tunnels need root; until the privileged helper lands, connect reports a needs_privilege state. Nothing here claims a working capability not yet in the codebase.
Two-layer split
The desktop app (this repo) is the Tauri v2 shell, cyberpunk HUD front-end and action-to-engine wiring. The VPN engine (ztunnel-core) is the embeddable logic — config parsing, the connection manager, the OpenVPN/WireGuard backends, logs and stats — decoupled from any GUI and reusable by other hosts.
Where it goes next
See the engineering report for the build layout and roadmap, the ztunnel-core engine for the command surface and Tunnelblick port coverage, and the MenkeTechnologiesMeta umbrella for the wider stack.