GhostMesh for Linux & Routers

BETA

Version 0.1.0-beta+build.20260824 · released 2026-08-24. TUN (full-tunnel) and proxy mode, on desktop Linux and on router-class ARM hardware, both guarded by an automatic rollback watchdog so a misconfiguration cannot strand the device.

What's new:

0.1.0-beta+build.20260824 (2026-08-24): Linux & Router • Refreshed the embedded SRSP core with traffic shaping in the production mux write path, cryptographic padding randomness, conservative defaults and bounded backpressure. • TUN/proxy installation and the stacked route/DNS rollback watchdog remain included. • These packages were cross-built on Windows; validate TUN, DNS, routes and rollback on the target Linux/router hardware before production use.

Linux (desktop / server)

Linux x86_643.5 MB

x86_64-unknown-linux-gnu

SHA-256

13ce43ad3ef64b9195466e51e76351b050cb165f0af53f0b3625c6c8363d5d2f

Linux ARM643.3 MB

aarch64-unknown-linux-musl

SHA-256

3554b696b01ccbc3c0d794b3d86c1ddefbc3f4cef76e7dbef74085822c547e8d

Router hardware

For router-class ARM devices with a conventional Linux userland (plain ip, /dev/net/tun). There is no OpenWrt ipk/UCI/procd package yet — this installer will not appear in your router's own network configuration UI.

Router ARM641.7 MB

aarch64-unknown-linux-musl

SHA-256

1fc6659f9b42c72a45dee25bc3c9528de00beb2f8ca00d2050f1629495086aa4

Router ARMv71.7 MB

armv7-unknown-linux-musleabihf

SHA-256

a75d4ec4cc0fed04b74cd46bf23842630d17acd3a6db1d63c4f95534a9bbca9c

Install

Extract the archive for your target and run the installer as root. It asks a few questions (server / SNI / UUID / REALITY key, and Proxy vs TUN) and sets everything up — no manual config editing required.

tar xzf GhostMesh-*.tar.gz
cd <extracted-folder>
sudo ./install.sh

Verify the archive first: sha256sum -c SHA256SUMS

Updating later: download the newer archive and run its install.sh again — it detects the existing install, keeps your server config untouched, and restarts the service. Check for a newer Beta any time with sudo ghostmesh-safe-enable check-update.

TUN mode's auto-rollback safety net

TUN mode redirects this device's default route and DNS through GhostMesh. Two independent watchdogs guard that change — this matters most on a router administered only through the link TUN is about to redirect:

In-process — srsp-client itself reverts the routes/DNS it just applied if no upstream becomes reachable within confirm_timeout_secs (default 30s), and falls back to proxy-only.
Shell-level, independent of the binary — ghostmesh-safe-enable arms a detached watchdog process before starting anything. It keeps working even if srsp-client is killed outright, or if TUN mode is what cuts off the SSH session you used to start it.

Both remove only what GhostMesh itself added — never your existing default route — so there is nothing risky about running the manual break-glass command at any time:

sudo ghostmesh-safe-enable rollback

Proxy mode never touches routing/DNS — it has nothing to roll back, which is why the installer picks it as the default.

What this Beta doesn't cover yet

— No OpenWrt ipk/UCI/procd/netifd package; routes are managed with plain ip/resolvectl.

— Not yet validated across every ARM router SoC/kernel combination — keep a second way to reach a router (console, LAN cable, a second SSH session) the first time you enable TUN on it.

— No IPv6 transparent proxying in TUN mode; keep OS/browser IPv6 disabled while it's active.