flexaccess.dev

flexaccess.dev / ezvpn

ezvpn

The easy-setup VPN for reaching private networks.

Access level
IP routing — whole subnets, any protocol
Privileges
Root / Administrator (creates the network interface)
Tunnel modes
Split or full, dual-stack IPv4 + IPv6
Server exposure
No public IP, no open inbound port

ezvpn creates a virtual network interface and routes IP packets — IPv4, IPv6, or both — through an encrypted QUIC connection. By default it runs as a split tunnel, carrying only the private prefixes you need, though it can full-tunnel everything when you want it to. Clients dial the server by its stable endpoint identity, so the server needs no public IP and no open inbound port: hole punching finds a direct path through NAT, and an encrypted relay carries traffic when it can't.

There is no VPN subnet to plan, either. The server assigns client addresses dynamically, so nothing has to be kept collision-free by hand, as long as the number of connected devices fits the subnet's address space. A typical deployment is a small ezvpn server inside a private network — an AWS VPC, a homelab — that clients join temporarily to reach private resources.

How it works

your device ══ IP packets over encrypted QUIC ══▶ ezvpn server ──▶ private subnet
(TUN iface)     NAT traversal · relay fallback       (no open port)    any protocol

Features

  • No inbound ports

    Clients dial a stable endpoint identity — no port forwarding, no dynamic DNS, and it works from behind CGNAT.

  • No subnet planning

    Client VPN addresses are assigned dynamically by the server, so there are no static IPs to keep collision-free.

  • Minimal setup

    Generate a server key and an auth token, and you're done. Each client needs only the server's ID and that token as a shared secret — no certificates, no PKI.

  • Dual stack

    Run the tunnel over IPv4, IPv6, or both at once — clients receive an address in each family the server enables.

  • End-to-end encrypted

    Traffic rides QUIC with TLS 1.3 from client to server. Relays that carry it can't decrypt it.

  • Auto-reconnect

    Keep-alive and idle-timeout health checks re-establish the tunnel when the path drops.

Apps & repos

  • client and server CLI
    ezvpn

    The core — command-line client and server for Linux / macOS / Windows.

  • iOS / macOS GUI client
    ezvpn-apple

    The native GUI client for the ezvpn server — an iOS and macOS SwiftUI app with a packet-tunnel extension and multiple saved profiles.

  • Windows GUI client
    ezvpn-windows

    The native GUI client for the ezvpn server — a WinUI 3 desktop app driving the same core.

Good for

  • Private cloud subnets — instances in private or egress-only VPC subnets
  • Home-hosted servers behind dynamic IPs, NAT, or CGNAT
  • Temporary split-tunnel access without standing VPN infrastructure
View ezvpn on GitHubCompare with flextunnel