Your network, fully connected
Bline-X is an open-source WireGuard mesh VPN. Connect every server, laptop, and container into one private network that works behind any NAT — with Magic DNS, tag-based access control, and a web dashboard.
$ curl -fsSL https://get.blinex.co.uk | sh
installing blinex-agent... done
$ sudo blinex-agent --setup-key BLINEX-DEFAULT-KEY
Connected to mesh as server-1 (100.64.0.1)
$ ping server-2.blinex
64 bytes from 100.64.0.2: icmp_seq=1 ttl=64 time=2.1 ms
64 bytes from 100.64.0.2: icmp_seq=2 ttl=64 time=1.9 msEverything you need for a private mesh
A complete, self-hostable alternative to commercial mesh VPNs — no per-seat pricing, no vendor lock-in.
WireGuard Encryption
Every byte between peers is encrypted end-to-end with WireGuard's modern Noise-protocol crypto. Keys never leave the device — the control plane only ever sees ciphertext.
Works Behind Any NAT
WireGuard traffic is relayed through the signal server by default, so there is no port forwarding to configure. When peers are reachable, Bline-X auto-upgrades to a direct peer-to-peer connection.
Magic DNS
Reach any peer by name. Every device gets a stable .blinex hostname resolved by the built-in DNS server — no /etc/hosts, no remembering IP addresses.
Tag-Based Access Control
Group peers with tags and write simple allow policies between them. Lock down who can talk to what without juggling firewall rules on every host.
Web Dashboard
Manage peers, setup keys, tags, and access policies from a clean Next.js dashboard. See which devices are online and how they are connected at a glance.
Cross-Platform
Run the agent on Linux (kernel TUN or userspace netstack), Windows, and macOS. Pre-built binaries for amd64 and arm64 — one command to install.
How it works
From zero to a working mesh in three steps.
Deploy the control plane
Clone the repo and bring up management, signal, and relay with a single docker compose command. Postgres-backed or in-memory for a quick spin-up.
git clone https://github.com/DJR-FP/blinex
cd blinex
docker compose up -dInstall the agent
Run the install script on every machine you want on the mesh. It drops the blinex-agent binary and a systemd service into place.
curl -fsSL https://get.blinex.co.uk | shJoin the mesh
Enroll the agent with a setup key. It registers with management, builds its WireGuard tunnels, and is instantly reachable by every other peer.
sudo blinex-agent --setup-key BLINEX-DEFAULT-KEYA simple, secure architecture
A lightweight control plane coordinates peers. The data path stays end-to-end encrypted — by default relayed through signal, upgrading to direct peer-to-peer when possible.
┌──────────────────────────────┐
│ CONTROL PLANE │
│ │
┌────────────┐ gRPC │ ┌────────────┐ ┌────────┐ │
│ │◄──────┼──┤ management │ │ relay │ │
│ │ :50051│ │ :50051/:8080│ │ :3478 │ │
│ │ │ └────────────┘ └────────┘ │
│ │ │ ┌────────────────────────┐ │
│ blinex- │◄──────┼──┤ signal :10000 │ │
│ agent A │ ICE + │ │ ICE signaling + │ │
│ │ relay │ │ WireGuard packet relay│ │
└─────┬──────┘ │ └───────────┬────────────┘ │
│ └──────────────┼───────────────┘
│ WireGuard (encrypted) │
│ relayed via signal ......│..... or DIRECT p2p
│ │ (after probe)
┌─────▼──────┐ ┌─────▼──────┐
│ blinex- │◄──────────────►│ blinex- │
│ agent B │ WireGuard p2p │ agent C │
└────────────┘ └────────────┘Build your mesh in minutes
Bline-X is free and open source under the Apache 2.0 license. Self-host it and own your network end to end.