Secure transport. Flexible exits.

TCP and UDP relay over TLS and QUIC.

Get connected · Ecosystem · Architecture · Observability · Documentation · Wire protocol

Nowhere gives TCP and UDP traffic a secure path to the exit you choose. Run it close to your applications, on a public relay, or at a remote exit. One Rust binary provides Portal, Vector and Egress.

Capability	What you get
Encrypted transport	TLS or QUIC for TCP and UDP traffic
Exit placement	Direct access, a SOCKS5 upstream or a remote Egress
Standard ingress	Connect applications through SOCKS5
Optional Morph	Shared-key masking of the transport wire image
Operational visibility	Local status and structured telemetry

Get connected

Start with a stable Rust toolchain and a reachable Portal host.

1. Build

cargo build --release --locked

2. Create a key

Use the generated value for <generated-key> on both peers:

./target/release/nowhere generate-key

3. Run Portal

Listen on port 2000; allow both TCP and UDP through the firewall:

./target/release/nowhere "portal://<generated-key>@*:2000"

4. Verify the certificate

Compare this fingerprint with Portal's trusted startup log, then set pin=<sha256>:

./target/release/nowhere fingerprint "nowhere://<generated-key>@portal.example:2000?morph=1"

5. Connect applications

Run Vector, then point applications at SOCKS5 127.0.0.1:1080:

./target/release/nowhere \
  "vector://<generated-key>@portal.example:2000?pin=<sha256>&in=127.0.0.1:1080"

6. Read local statistics

Run on either host to inspect its local instances:

./target/release/nowhere status

Ecosystem

Connect, deploy and operate with focused tools. Interfaces and integration requirements are documented in the ecosystem guide.

CLIENT Anywhere Native connections on Apple platforms. App Store	DEPLOY nowhere-sh Linux deployment and service management. Quick start
CONTROL OpenCtrl Process control through REST and SSE. API reference	OPERATE NowhereDash Fleet operations from a web dashboard. Quick start

Architecture

Vector connects applications to Portal. Portal forwards directly, through SOCKS5, or through an Egress that connects back to it. Arrows show connection establishment; traffic travels in both directions.

+----------+   TLS / QUIC    +----------+  Direct / SOCKS5  +----------+
|  Vector  |---------------->|  Portal  |------------------>|  Target  |
+----------+                 +----------+                   +----------+
                                   ^
                                   | QUIC
                             +----------+     TCP / UDP     +----------+
                             |  Egress  |------------------>|  Target  |
                             +----------+                   +----------+

One endpoint grammar

Configure each role with a URL. Portal declares one or two listener carriers; Vector selects one carrier and Egress selects QUIC. Choose ports and address families through the endpoint path. See Configuration.

Connection and flow

Ingress and exit can live on different hosts. Egress opens an outbound connection, so its host needs no inbound relay port. See Architecture for the connection model.

Wire design

Connection-bound authentication and explicit Flow setup give every transfer a clear beginning and lifetime. The wire specification describes the complete contract for independent implementations.

Wire masking

Morph is enabled by default (morph=1) for shared-key masking below TLS and QUIC. Use morph=0 to disable it. Certificate verification and transport security still apply. See Morph.

Remote exits

Place target access where it belongs. With out=egress, one registered exit serves Portal's clients over QUIC. Follow the Egress guide to set it up.

Observability

Read local instance identity and traffic statistics with nowhere status. Telemetry runs inside each service, even without a terminal or log output. Build monitoring integrations against the public Telemetry interface.

Trust and deployment

Vector and Egress verify system CA trust and the server name, or an exact certificate pin. Serve a CA-issued certificate for hostname-based trust:

nowhere "portal://<generated-key>@*:2000?tls=2&crt=/etc/nowhere/cert.pem&key=/etc/nowhere/key.pem"
nowhere "vector://<generated-key>@portal.example:2000?in=127.0.0.1:1080"

Reference

Guide	Focus
Quick start	First connection
Ecosystem	Clients, deployment and control
Configuration	URLs, defaults and runtime settings
Egress	Remote exits and registration
Wire protocol	Authentication, framing and Morph
Security	Trust and resource boundaries
Operations	Service lifecycle and diagnostics
Platforms	Native targets and containers
Telemetry	Discovery, schemas and messages

Explore the complete documentation index.

Build and verify

Validate locally with the standard Rust checks:

cargo fmt --all -- --check
cargo test --all-targets --locked
cargo clippy --all-targets --locked -- -D warnings
cargo build --release --locked

CI runs on Linux, macOS and Windows. The testing guide covers native checks, Linux containers and performance measurements; Platforms provides build and deployment details.

License

Licensed under the GNU General Public License v3.0.

---

© 2026 NodePassProject. All rights reserved.