Secure transport. Flexible exits.

TCP and UDP relay over TLS and QUIC.

Get connected · Ecosystem · Architecture · Observability · Documentation · Wire protocol

Nowhere gives TCP and UDP traffic a secure path to the exit you choose. One Rust binary brings the pieces together: Vector connects applications, Portal receives their traffic, and Egress places the exit on another host.

Capability	What you get
Encrypted transport	TLS or QUIC for TCP and UDP traffic
Exit placement	Direct access, a SOCKS5 upstream or a remote Egress
Standard ingress	Connect applications through SOCKS5
Optional Morph	Shared-key masking of the transport wire image
Operational visibility	Local status and structured telemetry

Get connected

Start with a stable Rust toolchain and a reachable Portal host.

1. Build

cargo build --release --locked

2. Create a key

Use the generated value for <generated-key> on both peers:

./target/release/nowhere generate-key

3. Run Portal

Listen on port 2000; allow both TCP and UDP through the firewall:

./target/release/nowhere "portal://<generated-key>@*:2000"

4. Verify the certificate

Compare this fingerprint with Portal's startup log obtained through a trusted channel, then set pin=<sha256>:

./target/release/nowhere fingerprint "nowhere://<generated-key>@portal.example:2000?morph=1"

5. Connect applications

Run Vector, then point applications at SOCKS5 127.0.0.1:1080:

./target/release/nowhere \
  "vector://<generated-key>@portal.example:2000?pin=<sha256>&in=127.0.0.1:1080"

6. Read local statistics

Run on either host to inspect its local instances:

./target/release/nowhere status

Ecosystem

Connect, deploy and operate with focused tools. Interfaces and integration requirements are documented in the ecosystem guide.

Project	Purpose	Get started
Anywhere	Native connections on Apple platforms	App Store
nowhere-sh	Linux deployment and service management	Quick start
OpenCtrl	Process control through REST and SSE	API reference
NowhereDash	Fleet operations from a web dashboard	Quick start

Architecture

Vector connects applications to Portal. Portal forwards directly, through SOCKS5, or through an Egress that connects back to it. Arrows show connection establishment; traffic travels in both directions.

+----------+   TLS / QUIC    +----------+  Direct / SOCKS5  +----------+
|  Vector  |---------------->|  Portal  |------------------>|  Target  |
+----------+                 +----------+                   +----------+
                                   ^
                                   | TLS / QUIC
                             +----------+     TCP / UDP     +----------+
                             |  Egress  |------------------>|  Target  |
                             +----------+                   +----------+

One endpoint grammar

Configure each role with a URL. Portal declares one or two listener carriers; Vector and Egress each select one carrier. Choose ports and address families through the endpoint path. See Configuration.

Connection and flow

TLS dedicates a connection to each Flow. QUIC shares a connection across Flows, using streams for TCP and streams plus DATAGRAMs for UDP. Egress opens its own outbound connection to Portal, so its host needs no inbound relay port. See the Egress Extension for the connection model.

Wire design

Connection-bound authentication and explicit Flow setup give every transfer a clear beginning and lifetime. The protocol reference links the Core contract and documents Nowhere's extensions.

Wire masking

Morph is enabled by default (morph=1) for shared-key masking below TLS and QUIC. Use morph=0 to disable it. TLS/QUIC provides certificate verification and authenticated encryption. Morph TCP requires an authenticated Prelude. Nowhere's Morph UDP clients send a separate short Prelude datagram. The Prelude Extension describes both and their security boundaries.

Remote exits

Place target access where it belongs. With out=egress, independent registered TLS and QUIC exits serve Portal's clients. Follow the Egress Extension to set it up.

Observability

Read local instance identity and traffic statistics with nowhere status. Telemetry runs inside each service, even without a terminal or log output. Build monitoring integrations against the public Telemetry interface.

Trust and deployment

Vector and Egress verify system CA trust and the server name, or an exact certificate pin. Serve a CA-issued certificate for hostname-based trust:

nowhere "portal://<generated-key>@*:2000?tls=2&crt=/etc/nowhere/cert.pem&key=/etc/nowhere/key.pem"
nowhere "vector://<generated-key>@portal.example:2000?in=127.0.0.1:1080"

Reference

Guide	Focus
Quick start	First connection
Configuration	URLs, defaults and runtime settings
Prelude Extension	Morph TCP and UDP Prelude
Egress Extension	Remote exits and registration
Platforms	Native targets and containers
Operations	Service lifecycle and diagnostics
Security	Trust and resource boundaries
Telemetry	Discovery, schemas and messages
Wire protocol	Authentication, framing and Morph
Interoperability	Compatible peer requirements
Integrations	Supervision and independent subscribers
Ecosystem	Clients, deployment and control
Testing	Regression coverage and validation

Explore the complete documentation index.

Build and verify

Validate locally with the standard Rust checks:

cargo fmt --all -- --check
cargo test --all-targets --locked
cargo clippy --all-targets --locked -- -D warnings
cargo build --release --locked

CI runs on Linux, macOS and Windows. Platforms provides build and deployment details; the testing guide covers native checks and performance measurements.

License

Licensed under the GNU General Public License v3.0.

---

© 2026 NodePassProject. All rights reserved.