One Rust binary (relay, node daemon and CLI). Enroll your machines with a relay you run yourself, then share, forward, nc or ssh any TCP port between them from anywhere, or publish a local port on a public HTTPS name.
Mac (Apple silicon) · Linux x86_64 · Windows: coming · no telemetry, no update check
Inside every stream the two machines run Noise_IK_25519_ChaChaPoly_BLAKE2s. The relay forwards ciphertext it cannot read, and an end-to-end test captures everything the relay receives and sends and fails if the plaintext ever appears.
Nothing is reachable until that machine runs warren share PORT, optionally only for named machines. The check happens on the destination, so even a compromised relay cannot open an unshared port.
Each machine remembers a peer's key the first time it sees it and refuses a changed key until you verify the new fingerprint with warren trust NAME --expect FINGERPRINT.
Everything rides one outbound WebSocket, for networks that allow outbound WSS on 443: no inbound ports on your machines, no kernel driver, no third-party account.
Release binaries are built in CI with the build machine's paths stripped. With Rust 1.88 or newer: cargo install --locked --git https://github.com/willykeenan/warren --tag v0.1.1
Apple silicon (aarch64)
The platform warren has been used on so far.
Download macOSx86_64 (glibc)
A relay has run on Ubuntu in production since October 2026; Linux nodes are tested in CI only. Please report problems.
Download LinuxYou need a small server with a public IP for the relay, a DNS name pointing at it, and two machines. Enrollment codes are single use and valid for ten minutes. The full walkthrough, including a one-machine trial with a self-signed relay, is in the README.
# on the relay (a small server with a public IP)
sudo warren relay --domain relay.example.com --acme you@example.com --state /var/lib/warren
sudo warren relay invite --state /var/lib/warren # one code per machine
# on machine b (the one with the service)
warren join CODE --relay https://relay.example.com --name b
warren install # start at login (launchd / systemd --user)
warren share 22
# on machine a
warren join CODE --relay https://relay.example.com --name a
warren install
warren ssh b # or: warren forward 2222 b:22
warren devices # compare fingerprints on both machinesSince October 2026 warren has carried the traffic of a real product's web hub. The relay runs on a small Ubuntu server (1 GB of RAM) behind nginx, with a certificate from certbot; the hub runs on a Mac that publishes it through the relay.
Until then the hub was reached through a hosted tunnel, which stays up as the fallback. The product's web front end forwards every request over one of the two routes, so they can be compared like for like. In the 30 minutes after the switch, the sign-in page, a signed-in API call, the live activity feed and a 20 KB script went through the front end 120 times each over warren and, at the same moments, over the hosted tunnel. Every request was a fresh connection from the same client, and every one succeeded.
| Route | Requests | p50 | p95 |
|---|---|---|---|
| warren relay | 480 | 148 ms | 311 ms |
| hosted tunnel | 480 | 154 ms | 595 ms |
The medians are about the same; at the 95th percentile warren took about half as long. That is one client over half an hour on a busy evening, not a benchmark. The whole setup, including backups, health checks and how to remove it, is in docs/production-relay.md.
The 1.6 to 1.9 Gbit/s private-link throughput in the README was measured on loopback, not over the internet. The field report above has latency from real use over the internet.
Warren is free and MIT licensed, built by William Keenan at KE Studios.