About angt/glorytun
Glorytun is a small, simple, and secure multipath UDP tunnel designed for reliable connectivity in SD-WAN environments. It features strong encryption with automatic algorithm selection (AEGIS-256 with AES-NI hardware acceleration, falling back to ChaCha20-Poly1305), perfect forward secrecy via ECDH over Curve25519, and hourly key rotation. Multipath capabilities allow TCP and other protocols to utilize all available links with aggregation and failover, supporting backup paths. The tool also includes manual traffic shaping, path MTU discovery without ICMP (to avoid black holes), and minimal dependencies (libsodium). It runs on Linux and has been tested on OpenBSD, FreeBSD, and macOS, with support for both IPv4 and IPv6.
Key Features
Fast and highly secure encryption with AEGIS-256 (AES-NI) or ChaCha20-Poly1305 fallback
Perfect forward secrecy via ECDH over Curve25519 with hourly key rotation
Multipath aggregation and failover for SD-WAN connectivity
Traffic shaping to maintain low latency (currently manual, auto planned)
Path MTU discovery without ICMP to avoid black holes
Minimal dependencies (only libsodium) and cross-platform support (Linux, OpenBSD, FreeBSD, macOS)
Pros & Cons
Pros
- Strong, modern encryption with hardware acceleration support
- Multipath aggregation and failover built-in
- Minimal dependencies (only libsodium) making it easy to compile
- Cross-platform: works on Linux, OpenBSD, FreeBSD, macOS
- Active open-source community with 120 releases and over 700 stars
- Comprehensive documentation available via wiki
Cons
- Traffic shaping must be configured manually (automatic shaping planned but not yet implemented)
- High latency links (+500ms) are not recommended for aggregation
- Requires time synchronization between peers (10 minute offset tolerance)
- Project appears to have slowed development (latest release March 2020)
Best For
Building secure SD-WAN tunnels with multipath redundancyAggregating multiple internet links for increased throughputCreating backup network paths for failover scenariosSecure VPN tunneling with strong encryption and perfect forward secrecyNetwork environments requiring path MTU discovery without ICMP relianceEmbedded or resource-constrained systems due to small footprint
FAQ
What encryption does Glorytun use?
Glorytun uses AEGIS-256 when AES-NI is available, otherwise falls back to ChaCha20-Poly1305. It also implements perfect forward secrecy with ECDH over Curve25519 and rotates keys every hour.
Does Glorytun support multipath?
Yes, Glorytun is designed for multipath UDP tunneling, supporting aggregation across multiple links and failover to backup paths when needed.
What are the dependencies for building Glorytun?
Glorytun only depends on libsodium version 1.0.4 or later.
Which operating systems are supported?
Linux is the primary platform, but it has been successfully tested on OpenBSD, FreeBSD, and macOS.