02 — veylNET
No single hop sees the full path.
veylNET is a platform for building multi-hop VPN chains from your own infrastructure. Register Linux nodes, order them into a chain, and WireGuard tunnels stitch a path where every node knows only its neighbours — and no one knows the whole.
Hop isolation
Entry, relay, exit: each node holds a WireGuard tunnel to its immediate neighbours and nothing more. Compromise any single machine — yours or anyone's — and the chain still can't be mapped.
Self-healing chains
Every hop is health-checked every sixty seconds — latency, jitter, handshake liveness. When one fails, a standby node is swapped in, configs are regenerated, and the heal is recorded in the audit log.
Ephemeral by default
Per-hop keys are generated, deployed and purged — never persisted on the control plane. What must be stored is sealed with AES-256-GCM, and optional AmneziaWG obfuscation lets a chain blend into ordinary traffic.
Panic mode
One rate-limited, password-verified call tears down every chain in your team, deletes its nodes and wipes its VPN configs. When you need to vanish, you vanish completely.
What is a multi-hop VPN chain?
A multi-hop VPN chain routes traffic through several VPN servers in sequence. With veylNET, each hop only knows the previous and next node, so compromise or logging at any single hop cannot reveal the complete path.
Do I own the nodes in a veylNET chain?
Yes. veylNET is self-hosted: you register your own Linux nodes, define their order, and the control plane generates and deploys WireGuard configs automatically.
How does panic mode work?
Panic mode is a rate-limited, password-verified API call that tears down every chain, deletes node records and wipes VPN configs. It is designed for situations where you need to disappear completely and quickly.
Can veylNET obfuscate VPN traffic?
Optional AmneziaWG obfuscation is supported, allowing a chain to blend into ordinary UDP traffic and resist simple traffic-classification blocks.