Posted by pcarroll 3 days ago
Netrinos creates a LAN-like overlay network across your devices. Connections are direct P2P via WireGuard, with no central server routing traffic. Each device gets a stable IP and DNS name (pc.you.netrinos.com). When direct connections fail, they fall back to a relay server that's still encrypted end-to-end. We can't see your traffic.
The most challenging problem to solve was NAT traversal. UDP hole punching works most of the time. The rest is a cocktail of symmetric NAT, CGNAT, and serial NATs. We use STUN-style discovery and relay fallback for the edge cases. I was surprised by how unreliable low-end ISP routers really are, and how much technical wizardry it takes to hide that behind a clean, simple UX.
Our stack is a Go backend for client and server, WireGuard kernel mode for Linux and Windows (macOS is userspace), Wails.io for cross-platform UI. WireGuard does all the heavy lifting. Go ties it all together.
Popular use cases include: RDP to home PCs, accessing NAS without exposing it, and SSH into headless Linux boxes. One customer manages hundreds of IoT devices in the field, eliminating the need to deal with customer routers.
We just released Pro with multi-user, access control, and remote gateway routing. Personal is free (up to 100 devices).
I'd love to hear what you expect from a simple mesh VPN, what's missing from current tools, and what's lacking from your remote access setup. Use code HNPRO26 for a 30-day trial of Pro.
Edit: Just found this post https://netrinos.com/blog/tailscale-alternatives-2025, so it looks like main differentiator is pricing right now.
One isn't.
After two weeks of back and forth the wireguard packets were still being discarded somewhere by a firewall/router thanks to "deny VPNs by default". Tailscale got through those immediately though by using their relays + one of the workarounds for standard wireguard ports being blocked. Point being, the service provided by a mature solution like Tailscale for punching through networks is surprisingly effective even for corporate-level networks.
Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public internet, unrestricted, and treat your users like adults who don't need micromanaging or constant surveillance (do sane logging, ofc.)
If you need a host that's subject to continuous surveillance, design it as such and require remote access with MFA, and so on.
Give your end users as much freedom as possible, and only constrict it where necessary, or you're going to incentivize shadow IT, unintended consequences, and a whole lot of unnecessary make-work that doesn't contribute to security.
Unrestricted access forces change management, design choices, and policy to confront each user and device for the attack vector they are, and to behave accordingly.
I'm from a cybersec and devops background, and the IT admin here is just an ancient family-appointed person with no idea of how stuff works and with a lot to gain from under the table corporate dealings.
This is a man who believes that 15 megabit is sufficient bandwidth for CompSci students in their hostels (not the college, mind you, the hostel specifically) and decided that banning games was a "hero move".
Vendor locked into Sophos and a custom third party provider, these people have zero idea about what they're doing. I've met them various times and had various discussions up and down the org chart - this is a man who thinks he should have full access to every student's browsing history in their own time and that all VPNs are the same (he doesn't know how VPNs work btw) and allow for evasion from their network policies.
It's all a bit cursed because he fear-mongers the upper echelons of the college administration by showing them made up logs saying "students are hacking the network" to justify this.
However, they have failed to provide isolated networks for the research labs which just need it for even downloading LLMs (they have banned huggingface!).
Moreover, a hostel is residential. They should provide either the option of getting an external connection (which I would happily do!) or provide a means of non-stupid internet which they aren't.
Network controls alone don’t stop exfiltration. HDMI/DP can move data faster than most consumer NICs. Does the system account for that scenario?
Same with RBAC. It's not perfect because some people need legit access to stuff and it can be abused. But it makes it much harder for bad actors.
Stop signs alone don't stop all traffic accidents.
Also there's different classes of state sponsored APT groups. You won't stand a chance against the NSA but there's a lot of state sponsored groups in Russia that are just looking for low hanging fruit to get some foreign money for their regime.
The actual fix for things like that is to ensure that your sensitive data is properly protected, and things that you don't want exfiltrated aren't put into scenarios where exfiltration is possible. If you need to compromise on security for practicality, then make those exceptions highly monitored with multiple people involved in custody and verification. Zero trust means you don't give any of your users or host devices any trust at all, and modern security software can require multiple party approvals and MFA.
You can use a phone to scan documents as you scroll through them, or mitm hardware devices that appear to be part of a cable, or all sorts of sneaky shenanigans, and it's a never-ending arms race, so you have to decide what level of convenience is worth what level of risk and make policies enforceable and auditable. In some cases that might mean SCIF level security with metal detectors and armed guards, in other cases it might mean ensuring a good password policy for zip files shared via email.
Inconveniencing users by limiting web access and doing the TSA style performative security thing is counterproductive. This doesn't mean you give them install rights, or you don't log web activity, or run endpoint malware scanning, or have advanced unusual activity monitoring on the network and so forth. It just means if Sally from accounting wants to go shopping for ugly christmas sweaters for staff on Etsy, she doesn't have to fill out forms in triplicate and wait 3 months while the IT department gets approvals and management has meetings and the third party security vendor does a policy review and assessment before signing off on it, or telling her no.
That relaxation tends to have ripple effects - once you allow tunneling tools in for one purpose - like SaaS integration - then it becomes more normalized and people start using it for other purposes.
The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc...
Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there.
Trusting a VPN provider is a lot. If you're running the control plane - why should I trust Netrinos?
"After years of SSH tunnels, IPsec headaches, and the ssh log horror movie, I wanted something simpler: install, sign in, get work done."
"Target market" could be the author
There's no good reason to discourage people from writing overlays, unless one is doing so for commercial (i.e., anti-competitive) reasons
A more interesting question might be, "In your opinion, what is unsatisfactory about XYZ that does essentially the same thing"
For example, one might be a Layer 2 overlay whilst the other is Layer 3
Maybe we'll never have web browser diversity (or meaningful competition) as the web browser has become an instrument of surveillance and advertising controlled by "Big Tech", but overlay diversity (and competition) is still a possibility
If everyone thought IPsec and OpenVPN was "good enough" then Wireguard and Tailscale would not exist
I still use an unpopular non-commercial L2 overlay from before Wireguard existed that is smaller and faster than anything else I have ever seen
IMHO, the more overlays that exist, the better
We all get that sometimes companies have IT policies which are outdated and get in the way, but that's a problem for someone up the chain to solve. A team or department deciding to just start doing their own thing with something like this which isn't managed by or even known about by the official company IT is at best a path to future problems if not an immediate compliance problem.
These are all things that the target audience either doesn't have, or doesn't want. If the above words are important to you, then you're probably not in the target market.
Think of an SMB where you might know you need to do something (like connect a new store location to the server in your main location’s closet), but don’t know how or can’t afford to hire an IT person full time. This is probably the main market for this. Then once you get more buy in, experience, and reputation, this VPN could stay to see larger clients. That’s at least how I’d expect to see this grow.
Love to see the ecosystem of wireguard based services growing into different business segments, i.e. you targeting SMBs/small teams.
Not for me, but legitimate use case and product :)
Either provide the Github (for whatever reasons) or remove the link from your website. I am assuming it is closed source.
Personally I don't trust new VPN solutions without published source code!
Alternatives: Tailscale with Headscale or better Self-hosted Netbird if one is a itty-bitty IT savvy.
Netbird (self-hosted) offers a lot lot more with the self-hosted solution. - SSO - Independent networks - Superb policies / ACLs - Keybased onboarding - auto-expiration and a lot more like integrations and what not!
Tough to beat the Netbird Open source offering if one tends to spent a little time and effort (though not everyone's cup of coffee!)
Such can look at tailscale's offering since the free version of Tailscale offers more than what is offered here and all the client applications are open source and constantly updated.
If pricing is going to the only difference, (at a high level, everything under the hood looks similar - wireguard based, zero config, p2p mesh, port forwarding etc etc.,) bring a lot more trust by offering an open source version like others.
If you install the OpenSSH server on Windows, you can manage Netrinos in a terminal, just like on Linux or Mac. e.g.
https://netrinos.com/cdn/images/screens/windows-terminal.png
https://netrinos.com/cdn/images/screens/linux-terminal.png
On a trip to Europe last year, I tried it from the Air Canada in-flight WiFi somewhere over Iceland. I was able to RDP to my desktop at home, then RDP right back to my laptop on the plane. Performance wasn't great. And it's not a terribly useful use case. But it did work.
Wireguard deserves a lot of credit there. No ports were opened on my home end. And who knows what the plane has for NAT.
As I understand it, with traditional VPNs, you basically have to trust third-party audits to verify the VPN isn't logging all traffic and selling it. Does the WireGuard protocol address theses issues? Or is there still the same risk as a more traditional VPN provider?
In this case, though, it creates an encrypted tunnel _only between your own devices_. This allows you to connect to all your devices, home desktop, phone, laptop, as if they were on the same network, allowing you to do fairly sensitive things like remote desktop without having to expose your machine to the public internet or deal with firewall rules in the same way.
Assuming this project is legitimate, then the only traffic this service would even touch would be those between your own devices, nothing related to public internet requests. And, on top of that, the requests should be encrypted the entire way, inaccessible to any devices other than the ones sending and receiving the requests.
There are many caveats and asterisks I could add, but I think that's a fairly straightforward summary.
If a direct connection cannot be established due to a very restrictive firewall or a messed-up ISP modem, it will fall back to a relay server. But in that case, the relay relays the traffic, but it does not have the keys to read it.
You can learn more here: https://www.wireguard.com/
TL;DR WireGuard itself is a relatively small project at roughly 4,000 lines of code. It has been thoroughly audited and is even built into the Linux kernel.
Our target market is smaller teams and people with limited IT skills. So, we chose not to send all traffic through the vpn. The only traffic going through the VPN is traffic to and from your other devices (in your account). Internet access is still through your default network.
In the Pro version, you can route specific destinations through other peers, also belonging to you. An example use case here would be accessing your web banking while on vacation in a distant country. You would route your bank website through your home connection.
Similarly, our access control is only restricting traffic that comes from your devices on the wireguard network. We do not interfere with the settings of your own personal firewall.
Only downsides are no mobile support & seems to be somewhat abandoned
https://netrinos.com/help/gateways-routing
You can also have multiple gateways and send traffic through different locations. e.g. You can access a NAS on one site and a website through another.
