flexaccess.dev

flexaccess.dev / ezvpn

ezvpn

The easy-setup VPN for reaching private networks.

Access level
IP routing — whole subnets, any protocol
Privileges
Root / Administrator (creates the network interface)
Tunnel modes
Split or full, dual-stack IPv4 + IPv6
Authentication
Per-client Ed25519 keys, authorized-keys style
Server exposure
No public IP, no open inbound port

ezvpn creates a virtual network interface and routes IP packets — IPv4, IPv6, or both — through an encrypted QUIC connection. By default it runs as a split tunnel, carrying only the private prefixes you need, though the CLI can full-tunnel everything when you want it to. Clients dial the server by its stable endpoint identity, so the server needs no public IP and no open inbound port: hole punching finds a direct path through NAT, and an encrypted relay carries traffic when it can't.

There is no VPN subnet to plan, either. The server assigns client addresses dynamically, so nothing has to be kept collision-free by hand, as long as the number of connected devices fits the subnet's address space. A typical deployment is a small ezvpn server inside a private network — an AWS VPC, a homelab — that clients join temporarily to reach private resources.

Access control is a per-client Ed25519 keypair in the shared flexaccess-keys format: each client generates its own key, and the server keeps the public keys in an ssh-style authorized-keys file. No certificates, no PKI, no shared secret to rotate.

How it works

your device ══ IP packets over encrypted QUIC ══▶ ezvpn server ──▶ private subnet
(TUN iface)     NAT traversal · relay fallback       (no open port)    any protocol

Features

  • No inbound ports

    Clients dial a stable endpoint identity — no port forwarding, no dynamic DNS, and it works from behind CGNAT.

  • No subnet planning

    Client VPN addresses are assigned dynamically by the server, so there are no static IPs to keep collision-free.

  • Keys, not certificates

    Each client authenticates with its own Ed25519 keypair; the server lists the public keys it accepts in an ssh-style authorized-keys file. Generate keys once with flexaccess-keys — no PKI, no shared token.

  • Dual stack

    Run the tunnel over IPv4, IPv6, or both at once — clients receive an address in each family the server enables.

  • Split DNS on mobile

    The iOS and Android apps can send DNS for chosen match domains through the tunnel, so private names resolve on the phone without capturing all of its DNS.

  • End-to-end encrypted

    Traffic rides QUIC with TLS 1.3 from client to server. Relays that carry it can't decrypt it.

  • Auto-reconnect

    On the CLI, keep-alive and idle-timeout health checks re-establish the tunnel when the path drops. The mobile apps stop cleanly on a network change and reconnect on tap.

  • Fast on Linux

    Automatic TUN GSO offload on Linux, with software segmentation fallback for peers that don't support it.

Install

Linux / macOS
curl -sSL https://flexaccessdev.github.io/ezvpn/install.sh | sudo bash
Windows (elevated PowerShell)
irm https://flexaccessdev.github.io/ezvpn/install.ps1 | iex

Windows also needs wintun.dll from wintun.net next to ezvpn.exe.

The installer downloads the latest release binary and verifies its checksum. Prebuilt binaries cover Linux amd64/arm64, Apple Silicon macOS, and Windows amd64. Client keys are generated with flexaccess-keys. Set up flexaccess-keys

Apps & repos

  • client and server CLI
    ezvpn

    The core — command-line client and server for Linux / macOS / Windows.

  • iOS / macOS GUI client
    ezvpn-apple

    Native SwiftUI client with a packet-tunnel extension: dual-stack split tunnel, split DNS on iOS, multiple saved profiles. macOS ships as a signed, notarized drag-to-Applications .dmg; iOS is built from source under your own team.

  • Android GUI client
    ezvpn-android

    Native Kotlin / Jetpack Compose client running the Rust core inside a VpnService: dual-stack split tunnel, split DNS via an in-tunnel forwarder, always-on VPN support. Android 10+, arm64.

  • Windows GUI client
    ezvpn-windows

    Native WinUI 3 desktop app driving the ezvpn core through its C FFI: dual-stack split tunnel, multiple profiles, Ed25519 client keys kept in Windows Credential Manager. Unsigned MSI for personal use.

Good for

  • Private cloud subnets — instances in private or egress-only VPC subnets
  • Home-hosted servers behind dynamic IPs, NAT, or CGNAT
  • Temporary split-tunnel access without standing VPN infrastructure
  • Reaching a homelab or VPC from a phone — iOS and Android apps included
View ezvpn on GitHubCompare with flextunnel