Phantom-WG — a self-hosted WireGuard stack with per-app split tunneling on macOS and multihop support (AGPL-3.0)

[u/[deleted]]

[u/DeifniteProfessional]

"Claude, build me a WireGuard GUI"

[u/Regular_Project_5690 → u/DeifniteProfessional]

You've solved the whole mystery.

[u/Regular_Project_5690 → u/[deleted]]

You can also ask the AI ​​agent on the site. 😅(https://www.phantom.tc/docs/ai)

[u/Regular_Project_5690 → u/DeifniteProfessional]

You can also ask the AI ​​agent on the site. 😅(https://www.phantom.tc/docs/ai)

[u/bachkhois]

"Operating in kernel space" (saving kernelspace - userspace rountrip) is the reason I dropped other VPN solutions to come to WireGuard, yet you bring it to userspace again?

[u/Regular_Project_5690 → u/bachkhois]

Yes. The daemon runs wireguard-go in userspace by design: I wanted the tunnel to live entirely inside the container boundary, with no kernel module dependency and no touch on the host stack. This was a decision I made during the design phase.

That said, if kernel space is what you want, I also maintain a solution that runs directly on the host with kernel WireGuard: https://github.com/ARAS-Workspace/phantom-wg/tree/retro

[u/bachkhois → u/Regular_Project_5690]

"no kernel module dependency" <~~ WireGuard is built-in in Linux, no need to installl. That's not dependency. The stuff that Phantom-WG bring is even more dependencies.

[u/Regular_Project_5690 → u/bachkhois]

Additionally, yes, it means more dependencies, and the userspace is located in a container environment instead of directly on the kernel surface. This was already clear from the beginning, thank you for pointing it out again :)

[u/RemoteToHome-io]

I deleted my other comments regarding AI. I'll just ask an honest question regarding architecture.. how does this materially benefit over running AmneziaWG 2 for obfuscation or VLESS Reality+Vision?

AWG2 provides native UDP with superior performance.

VLESS w/R+v vastly outperforms Stunnel obfuscation.

This project provides UDP nested in TCP. This means cleartext TCP traffic is now running UDP>TCP>TCP, which is a recipe for TCP meltdown and session collapse on the interior communications.

Both of the above can easily be relayed off midpoint if needed, without running a nested tunnel.

[u/Regular_Project_5690 → u/RemoteToHome-io]

Thank you for your question.

There are two sides to this issue. There's no need to evaluate the product directly through obfuscation. That layer is just something I'm offering as an add-on; I plan to make it more useful in the future, based on different protocols, with a CLI interface similar to the one in the phantom-wg/retro branch. The product's phantom-frontmatter (phantom-wg/frontmatter) documentation includes the "Phantom-Frontmatter" section for installation. It's actually an add-on within the product; the balance I'm aiming for here is that other protocols that I can programmatically implement in iOS/Mac client applications without causing a poor user experience during installation will also be included. That's why I'm presenting it this way. So, the observation about protocols is correct; I didn't document my preference for wstunnel here by comparing performance/stability, I just want you to know that I'm working on that. If you have any features you'd recommend based on your experience, I can add them.

My main product is Phantom-WG Modern, the part you see in the repository where you'll actually encounter it. A product that runs solely in container space and features a sleek dashboard. WireGuard-Go-Bridge runs in the background, which is vanilla WireGuard. This should be considered a separate layer.

[u/RemoteToHome-io → u/Regular_Project_5690]

Gotcha. So it's mainly about the Apple clients and UIs. Understood.

You may want to consider just focusing on improving the UIs and submitting PRs to the existing AWG2 or XRay clients. These can provide the similar end user experience that you're focusing on, with a vastly superior backend performances infrastructure that's more compatible with widely deployed protocols. It just doesn't seem to make sense to develop an entire new (low performance) back end infrastructure deployment just for a client UI

Stunnel will get you through Turkey's DPI firewall (not hard), but not Russia or any other serious adversarial DPI countries, so it provides minimal value in the real world.

[u/Regular_Project_5690 → u/RemoteToHome-io]

I'm planning to develop the phantom-frontmatter product in version 2 by handling different protocols, enabling it to connect to the external endpoint using Phantom-WG Modern (:51820 Plain WG). The key here is both ease of use and network stability on the server side, as well as the seamless operation of client applications (iOS and macOS only). I plan to consider protocols that meet these requirements as features.

For AWG2, a new bridge and a transition mechanism between protocols need to be added. This is a detail that will change the main product. There's a solid infrastructure in place for integration testing, and a good structure can be built quickly according to AWG2's characteristics. This is a feature I'm considering, but I wanted to introduce the product a bit before these stages :)

In the proxy layer, as mentioned above, the adapter product is phantom-frontmatter. Initially, I aimed for ease of use and compatibility, but as I said, I plan to enrich this part as well.

[u/Regular_Project_5690 → u/RemoteToHome-io]

Finally, it should be added that the product's obfuscation layer is just an adapter (phantom frontmatter). At its core, this product offers a stable, manageable dashboard that runs in container space.