A deliberately minimal forwarding fabric for WireGuard endpoints operating behind CGNAT, mobile networks and restrictive NAT environments.
The central idea: the only publicly exposed relay is deliberately outside the protected network.
BastionRoute moves the reachability problem outside the security boundary. The endpoint establishes an outbound WebSocket connection; the relay forwards opaque traffic; WireGuard remains the endpoint-to-endpoint security layer.
It has no need for a private-network interface, a route into the LAN, or WireGuard private keys. Its essential job is to associate connections and move bytes.
The relay is closer to a switch than a VPN gateway. It does not need to understand IP packets, WireGuard semantics, or application protocols.
The exposed component is intentionally given less authority and less knowledge. WireGuard retains the cryptographic trust boundary at the endpoints.
Connections, timing, traffic volume, frame sizes and connection state.
WireGuard plaintext, private keys, internal hosts, internal topology or application semantics.
A hostile relay can drop, delay or disrupt traffic and can observe transport metadata. Payload blindness is not anonymity.
The endpoint does not need a stable public address or inbound reachability. It needs outbound connectivity — a much more practical assumption on modern mobile and NAT-constrained networks.
The architecture has been built and operated on Android behind 5G/CGNAT and across Wi-Fi and cellular transitions, with the variable latency and network-path changes that come with mobile connectivity.
BastionRoute is an exploration of how little the Internet-facing component needs to know to make an encrypted private network reachable from difficult environments.
Outbound WebSocket transport, UDP adaptation, relay forwarding, CGNAT traversal, mobile-network resilience and deployment behind conventional TLS infrastructure.
The interesting property is not custom cryptography. It is the deliberate placement of the exposed relay outside the private network and the separation of forwarding from cryptographic trust.
BastionRoute is provided for legitimate network administration, research, development, and authorized deployment scenarios only.
Users are solely responsible for ensuring that their use, deployment, modification, and distribution of BastionRoute comply with all applicable laws, regulations, contractual obligations, and organizational policies.
BastionRoute is a networking tool and does not determine whether a particular deployment or use is authorized. Users are responsible for obtaining the necessary authorization before deploying it on networks, systems, or infrastructure they do not own or administer.
The software should not be deployed or used in environments where doing so would violate applicable laws, regulations, agreements, acceptable-use policies, or other restrictions.
BastionRoute is licensed under the Apache License 2.0.
The Apache License governs the use, reproduction, modification, and distribution of the software and includes its applicable warranty disclaimer and limitation-of-liability provisions.
See the LICENSE file distributed with the project for the complete license terms.
This project is provided as-is. Nothing on this site constitutes legal advice.