Bringing intranet on the internet with Zero-Config Mesh VPNs.
Bringing intranet on the internet with Zero-Config Mesh VPNs.
Zero-Config P2P Mesh VPN for AI, Robotics, and Edge Computing
Building distributed AI systems is hard. Connecting robots, edge devices, and cloud infrastructure across networks is even harder:
OmniEdge solves this with a single binary.
| Challenge | OmniEdge Solution |
|---|---|
| NAT traversal | Automatic hole punching + relay fallback, 99%+ success |
| Symmetric NAT | Zero-knowledge relay for hardest NAT types |
| Latency-critical AI inference | WireGuard encryption, ~0.3ms overhead |
| Deterministic networking | 6-Sigma stability (Cpk 2.92) for teleoperation |
| Secure model transfer | End-to-end encrypted mesh |
| Heterogeneous devices | Single binary for x86, ARM64, RISC-V |
| Air-gapped labs | Self-hosted nucleus mode (no cloud dependency) |
Validated through 50-run longitudinal testing using Process Capability Analysis (Cpk):
| Metric | OmniEdge Tunnel | Raw Internet | Improvement |
|---|---|---|---|
| Latency | 54.69ms | 54.36ms | +0.3ms overhead |
| Latency Stability (Cpk) | 2.92 (6-Sigma) | 6.47 | Near-deterministic |
| Throughput | 484.7 Mbps | 344.1 Mbps | +140.8% |
| Jitter (StdDev) | 0.057ms | 0.026ms | Bounded, predictable |
What this means: Cpk > 2.0 indicates industrial-grade process capability. OmniEdge provides deterministic, jitter-controlled networking suitable for real-time robot control and latency-sensitive AI inference.
# Install on any Linux device (Jetson, Pi, server)
curl -fsSL https://raw.githubusercontent.com/omniedgeio/omniedge/main/scripts/omniedge-install.sh | bash
# Start and connect (interactive login on first run)
sudo omniedge start
# That's it. Your devices can now reach each other by virtual IP.When running omniedge start --mode nucleus or --mode dual, the CLI can auto-register a custom user server using the public IP and chosen port. This requires an auth token; if auth is missing or public IP lookup fails, it skips registration and continues.
# Download the package for your architecture (example: aarch64, OpenWrt 24.10)
wget https://github.com/omniedgeio/omniedge/releases/download/v2.9.0/omniedge_2.9.0_aarch64_generic.ipk
# Install the package
opkg install omniedge_2.9.0_aarch64_generic.ipk
# Configure via UCI
uci set omniedge.main.enabled='1'
uci set omniedge.main.network_id='your-network-id'
uci commit omniedge
# Start the service
/etc/init.d/omniedge start
/etc/init.d/omniedge enable # Start on boot| Device | Architecture | Status |
|---|---|---|
| NVIDIA Jetson (Nano/Xavier/Orin) | ARM64 | Tested |
| Raspberry Pi 4/5 | ARM64 | Tested |
| Intel NUC / x86 Servers | x86_64 | Tested |
| Apple Silicon (M1/M2/M3) | ARM64 | Tested |
| RISC-V Boards | riscv64 | Experimental |
| OpenWrt Routers | x86_64, ARM64 | Tested |
omniedge-cli)| Platform | Architecture | Package Formats |
|---|---|---|
| Linux | x86_64, ARM64, RISC-V | .tar.gz, .deb, .rpm, .AppImage |
| macOS | x86_64 (Intel), ARM64 (Apple Silicon) | .tar.gz |
| Windows | x86_64 | .zip |
omniedge-desktop)| Platform | Architecture | Package Formats |
|---|---|---|
| Windows | x86_64 | .msi, .exe |
| macOS | x86_64, ARM64 | .dmg |
| Linux | x86_64 | .deb, .AppImage |
omniedge-openwrt)| OpenWrt Version | Architecture | Package Format | Status |
|---|---|---|---|
| 24.10.x | x86_64 | .ipk |
Tested |
| 24.10.x | aarch64 | .ipk |
Tested |
| 25.x (snapshot) | x86_64 | .apk |
Tested |
| 25.x (snapshot) | aarch64 | .apk |
Tested |
Note: MIPS architecture is not supported due to Rust toolchain limitations.
…OmniEdge now supports a WASM-based plugin system that allows extending functionality without modifying the core application.
| Feature | Description |
|---|---|
| WASM Sandboxing | Plugins run in secure WebAssembly sandboxes |
| Event Hooks | React to VPN state changes, peer events, network changes |
| Capability-Based Security | Fine-grained permissions per plugin |
| Hot Reload | Install, enable, disable plugins without restart |
| Cross-Platform | Single plugin binary works on all platforms |
| Capability | Description |
|---|---|
network-status |
Read VPN connection state |
peer-info |
Access peer list and status |
event-hooks |
Subscribe to VPN events |
http-client |
Make outbound HTTP requests |
key-value-store |
Persist plugin data |
notifications |
Show system notifications |
logging |
Write to application logs |
…See examples/plugins/hello-world for a complete example.
// Minimal plugin structure
wit_bindgen::generate!({
world: "omniedge-plugin",
exports: {
world: MyPlugin,
},
});
struct MyPlugin;
impl Guest for MyPlugin {
fn on_load() -> Result {
Ok(())
}
}OmniEdge automatically handles complex network environments with multi-layer NAT traversal:
┌─────────────────────────────────────────────────────────────────┐
│ NAT Traversal Stack │
├─────────────────────────────────────────────────────────────────┤
│ 1. STUN Detection → Identify NAT type (Open/Cone/Symmetric) │
│ 2. UDP Hole Punching → Direct P2P for compatible NAT types │
│ 3. Port Mapping → UPnP/NAT-PMP to open router ports │
│ 4. Relay Fallback → Zero-knowledge relay for symmetric NAT │
└─────────────────────────────────────────────────────────────────┘| Your NAT | Peer NAT | Connection Method |
|---|---|---|
| Open/Full Cone | Any | Direct P2P |
| Restricted Cone | Open/Full/Restricted | Direct P2P |
| Port-Restricted | Open/Full Cone | Direct P2P |
| Symmetric | Open/Full Cone | Direct P2P (usually) |
| Symmetric | Symmetric | Relay (automatic) |
| Feature | Description |
|---|---|
| Auto NAT Detection | STUN-based detection on connection |
| Relay Fallback | Zero-knowledge relay for symmetric NAT |
| Port Mapping | UPnP/NAT-PMP/PCP support |
| Encrypted Signaling | X25519 + XSalsa20-Poly1305 |
| IPv6 Dual-Stack | Happy Eyeballs (RFC 8305) |
# Check your NAT type and settings
omniedge status
# Configure NAT traversal
omniedge config show # View current settings
omniedge config relay on # Enable relay fallback
omniedge config portmap on # Enable UPnP/NAT-PMP
omniedge config ipv6 prefer # Prefer IPv6 when faster
omniedge config encrypt on # Enable encrypted signaling| Mode | Description | Use Case |
|---|---|---|
| edge (default) | VPN client | Connect devices to mesh |
| nucleus | Signaling server only | Self-hosted relay, no cloud |
| dual | VPN + signaling | Central hub + mesh participant |
# Edge mode - Join an existing network
sudo omniedge start -n
# Nucleus mode - Run your own signaling server (air-gapped labs)
sudo omniedge start --mode nucleus --port 51821 --secret "YourLabSecret123"
# Dual mode - Hub node that also participates in mesh
sudo omniedge start -n --mode dual --secret "YourSecret123456"OmniEdge supports two transport modes for different networking requirements:
| Mode | Layer | Interface | Platforms | Use Case |
|---|---|---|---|---|
| L3 (default) | IP (Layer 3) | TUN | All | Standard VPN, IP routing |
| L2 | Ethernet (Layer 2) | TAP | Linux only | Bridging, non-IP protocols |
Layer 3 mode operates at the IP level, routing IP packets between peers. This is the default and works on all platforms.
# L3 mode (default - no flag needed)
sudo omniedge start -n
# Explicit L3 mode
sudo omniedge start -n --transport-mode l3Layer 2 mode operates at the Ethernet level, bridging Ethernet frames between peers. This enables:
No open issues yet, or sync has not completed.