Tund

A lightweight, self-hosted virtual LAN tool. C core, minimal dependencies, optional desktop GUI.

Windows 10/11 GNU/Linux
macOS
Apple Silicon Intel

MIT license · source code on GitHub

⚠️ Packet contents are authenticated but not encrypted — use only on trusted networks.

SipHash authentication

Every packet is verified using the shared network key.

Hub and spoke

One server node, up to 253 connected client peers.

Zero registration

No accounts, no external services. Just an IP and a key.

quick start 
# on the machine with a public IP
sudo ./tund server -k "a-long-random-key"
# on every machine that should join the LAN
sudo ./tund client -s <server_ip> -k "a-long-random-key"

Getting it running on Windows

  1. Download tund-windows-x86_64.zip above and extract all files into the same folder.
  2. Run tund-gui.exe for the GUI or tund-cli.exe for the CLI. If Windows shows a UAC prompt, accept it so Tund can create the TUN interface.
  3. If this machine is the server, allow inbound UDP on port 9909 in Windows Defender Firewall so clients can reach it:
    netsh 
    netsh advfirewall firewall add rule name="Tund" dir=in action=allow protocol=udp localport=9909
  4. Launch with the same commands as Linux/macOS, e.g. tund-cli.exe server -k "a-long-random-key".

Windows Firewall often blocks ping (ICMP) on the virtual adapter even when the tunnel works fine — this doesn't affect game traffic, only connectivity checks.

macOS — first run

  1. macOS may show "apple cannot verify the identity of the developer" because the binary is not signed with an Apple certificate. Run this once to clear the quarantine flag:
clear quarantine flag 
xattr -d com.apple.quarantine ./tund

If the warning persists, go to System Settings → Privacy & Security and click Open Anyway.

Firewall — allow port 9909 on Linux / macOS

# ufw (Ubuntu/Debian)
sudo ufw allow 9909/udp
# firewalld (Fedora/RHEL)
sudo firewall-cmd --add-port=9909/udp --permanent
sudo firewall-cmd --reload
# iptables
sudo iptables -A INPUT -p udp --dport 9909 -j ACCEPT
# macOS — usually no firewall blocks inbound,
# but check System Settings > Network > Firewall